Solid state disk management method
Patent Information
- Application Number
- CN202411135542.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-19
- Publication Date
- 2026-03-03
Smart Images
Figure CN121598359A_ABST
Abstract
Description
Technical Field
[0001] This application relates to a management method for a solid-state drive (SSD), and particularly to a management method that can perform authentication operations through a single connection or dual connection to identify multiple identities and set corresponding permissions, so that multiple identities can access the namespace of the SSD. Background Technology
[0002] In fields such as office systems, gaming systems, homes, government agencies, databases, and academic institutions, there may be application scenarios where multiple users access the same data. Each user may have the same or different access permissions for the same data. Managing and maintaining information security in these scenarios presents a significant challenge.
[0003] For data stored on solid-state drives (SSDs), one could try installing software (e.g., third-party software) and then using that software for data management. However, such software is difficult to integrate across different operating systems, and it's also difficult to control the permissions of each account. Furthermore, because the software is easily compromised and modified by unauthorized individuals through hacking and other means, security is difficult to guarantee. Therefore, there is a lack of suitable solutions in the field for managing data on solid-state drives. Summary of the Invention
[0004] An embodiment provides a method for managing a solid-state drive (SSD), including performing a boot operation, performing an authentication operation via a connection, identifying whether the authentication operation corresponds to a first identity or a second identity based on the authentication operation, querying a predetermined table, and if the authentication operation corresponds to the first identity, setting a first permission for the first identity to access a first namespace of the SSD and a second permission to access a second namespace of the SSD; if the authentication operation corresponds to the second identity, setting a third permission for the second identity to access the second namespace of the SSD and a fourth permission to access a third namespace of the SSD, and performing a basic input / output system (BIOS) load operation. The second namespace is a shared namespace for the first identity and the second identity.
[0005] Another embodiment provides a method for managing a solid-state drive (SSD), including performing a boot operation, performing an authentication operation through a first connection, identifying whether the authentication operation corresponds to a first identity based on the authentication operation, querying a predetermined table, performing the authentication operation through a second connection to identify whether the authentication operation corresponds to a second identity, querying the predetermined table, and if the authentication operation corresponds to the first identity, setting a first permission for the first identity to access a first namespace of the SSD and a second permission to access a second namespace of the SSD; if the authentication operation corresponds to the second identity, setting a third permission for the second identity to access the second namespace of the SSD and a fourth permission to access a third namespace of the SSD, and performing a basic input / output system (BIOS) load operation. The second namespace is a shared namespace for the first identity and the second identity. Attached Figure Description
[0006] Figure 1 This is a flowchart of the solid-state drive management method in the embodiment.
[0007] Figure 2 for Figure 1 A diagram illustrating how to check the reservation table to confirm the permissions of each identity.
[0008] Figure 3 This is a schematic diagram of a single-ended solid-state drive in the embodiment.
[0009] Figure 4 for Figure 3 A flowchart of the solid-state drive management method.
[0010] Figure 5 This is a schematic diagram of a dual-end solid-state drive in another embodiment.
[0011] Figure 6 for Figure 5 A flowchart of the solid-state drive management method.
[0012] The reference numerals in the attached figures are explained as follows:
[0013] 100, 400, 600: Management Methods
[0014] 110 to 150, 410 to 480, 610 to 680: Steps
[0015] 200: Reservation Form
[0016] 300, 500: Solid State Drives
[0017] 305, 510, 520: Controller
[0018] 380, 580: Storage space
[0019] ID1, ID2 to IDN: Identity
[0020] NSA, NSB, NSC: Namespaces
[0021] P1, P2, P3, P4: Permissions
[0022] PT1, PT51, PT52: Connecting terminals
[0023] SYS1, SYS2: Operating Systems Detailed Implementation
[0024] In this document, "accessing" data on a solid-state drive (SSD) may include at least one of reading and writing data, or both. The namespaces mentioned herein refer to the environment and space within an SSD, which can be defined using code. Each namespace can be created to set the data that a corresponding identity is allowed to view and access. For example, the company's first employee (with a first identity) can use the symbols, code, and data in the first namespace, while the company's second employee (with a second identity) can use the symbols, code, and data in the second namespace, and so on. For example, if a user's identity does not have permission to view a namespace, that identity will not be able to see the namespace after logging in. Furthermore, for example, if a user's identity has the permission to read but not write data in a namespace, that identity can only read the data in the namespace after logging in, and cannot modify it. Depending on the permission settings, an identity can access data in one or more namespaces, and multiple identities can access data in the same or different namespaces.
[0025] The solid-state drives (SSDs) described in this article may include peripheral component interconnect express (PCIe) SSDs and / or other suitable types of SSDs.
[0026] Figure 1 This is a flowchart of the solid-state drive management method 100 in the embodiment. Figure 2 for Figure 1 A diagram illustrating the process of querying reservation table 200 in step 130 to confirm the permissions of each identity. Figure 1 and Figure 2 For example, in this case, the solid-state drive (SSD) may contain a first namespace NSA, a second namespace NSB, and a third namespace NSC. For example... Figure 1 and Figure 2 As shown, management method 100 may include the following steps:
[0027] Step 110: Perform a boot-up operation on the host.
[0028] Step 120: Perform a pre-boot operation to perform authentication operations, thereby confirming the user's first identity ID1 and second identity ID2;
[0029] Step 130: Query reservation table 200 to confirm the permissions of the first identity ID1 and the second identity ID2;
[0030] Step 140: Set access permissions for the first identity ID1 and the second identity ID2 to the first namespace NSA, the second namespace NSB, and the third namespace NSC; and
[0031] Step 150: Perform the BIOS loading operation.
[0032] In step 120, the shadow master-boot-record (shadow MBR) can be used for authentication. For example, the user can enter their username and password to verify their identity.
[0033] A shadow master boot record (Shadow MBR) is a special feature on storage devices. When a user powers on the storage device, they first enter the Shadow MBR's simulated space for pre-boot authentication. This process can occur before powering on; only after successful authentication does the system enter the actual boot process. The Shadow MBR provides enhanced security because the actual contents of the device can only be accessed after successful authentication. For example, even if the storage device falls into the wrong hands, the unauthorized access to the data on the device will be impossible without proper authentication information. Therefore, the Shadow MBR serves as a hardware-level data protection mechanism.
[0034] In steps 120 and 130, the user's identity can be verified from N identities ID1 to IDN based on the authentication data entered by the user (e.g., username and password). Figure 2 In the example, a first identity ID1 and a second identity ID2 can be identified. The predetermined table 200 mentioned in step 130 can be set in firmware or other suitable space.
[0035] like Figure 2 As shown, the first identity ID1 (for example, corresponding to the first user) may have a first permission P1 and a second permission P2, wherein the first permission P1 is to read and write data in the first namespace NSA, and the second permission P2 is to read and write data in the second namespace NSB.
[0036] The second identity ID2 (e.g., corresponding to the second user) may have a third permission P3 and a fourth permission P4, wherein the third permission P3 is to read data in the second namespace NSB, and the fourth permission P4 is to read and write data in the third namespace NSC.
[0037] exist Figure 2 In this context, the first namespace NSA can be a namespace dedicated to the first identity ID1, the third namespace NSC can be a namespace dedicated to the second identity ID2, and the second namespace NSB can be a shared namespace for both the first and second identities ID1. For example... Figure 2 As shown, the second permission P2 for the first identity ID1 to access the second namespace NSB is different from the third permission P3 for the second identity ID2 to access the second namespace NSB. However, Figure 2 This is merely an example, and the embodiments are not limited thereto. In another embodiment, different identities may have the same permissions for a shared namespace (e.g., a second namespace NSB).
[0038] The first identity ID1 and the second identity ID1 can correspond to different users (e.g., different members of a family) or different accounts of the same user (e.g., the same user's work account and private account).
[0039] Figure 1 and Figure 2 The management method described above can be applied to both single-port and dual-port systems, as described below.
[0040] Figure 3 This is a schematic diagram of a single-ended solid-state drive 300 in an embodiment. The solid-state drive 300 may include a controller 305, a connection terminal PT1, and a storage space 380. Depending on the type of connection terminal PT1 and the solid-state drive 300, a suitable controller 305 may be selected. For example, the connection terminal PT1 may be a PCIe (Platform for External Component Interconnect) connection terminal, the controller 305 may support the non-volatile memory express (NVMe) protocol, and the controller 305 may support PCIe control functions.
[0041] like Figure 3 As shown, storage space 380 may include a first namespace NSA, a second namespace NSB, and a third namespace NSC.
[0042] Figure 4 for Figure 3 The management method for solid-state drives (SSDs) is shown in the flowchart below (example 400). Figures 1 to 4As shown, management method 400 may include the following steps:
[0043] Step 410: Perform the boot-up operation;
[0044] Step 420: Perform authentication via connection PT1 to identify the user as either the first identity ID1 or the second identity ID2;
[0045] Step 430: If the user is the first identity ID1, according to the authentication operation, identify the first identity ID1, query the predefined table 200 to query the first permission P1 for accessing the first namespace NSA and the second permission P2 for accessing the second namespace NSB; if the user is the second identity ID2, according to the authentication operation, identify the second identity ID2, query the predefined table 200 to query the third permission P3 for accessing the second namespace NSB and the fourth permission P4 for accessing the third namespace NSC; if the user is the first identity ID1, proceed to step 440; if the user is the second identity ID2, proceed to step 441.
[0046] Step 440: Set the first identity ID1 to access the first namespace NSA with first permission P1, and the second permission to access the second namespace NSB with second permission P2; Proceed to step 450;
[0047] Step 441: Set the second identity ID2 to access the second namespace NSB with third permission P3, and to access the third namespace NSC with fourth permission P4; proceed to step 450; and
[0048] Step 450: Perform the BIOS loading operation.
[0049] Figure 4 Step 410 can correspond to Figure 1 Step 110, Figure 4 Steps 420 to 440 may correspond to Figure 1 Steps 120 to 140, and Figure 4 Step 450 can correspond to Figure 1 Step 150.
[0050] In step 430, after the authentication process is completed, the identity can be identified, and the reservation table can be queried to compare the identity in order to grant permissions in the future.
[0051] After the startup operation in step 410, an authentication operation can be performed through the connection terminal PT1. If the user's identity is identified as first identity ID1 in this authentication operation, the subsequent query of the predetermined table 200 can identify the namespace access permissions of first identity ID1, and the permissions of first identity ID1 can be set accordingly. If the user's identity is identified as second identity ID2 in this authentication operation, the subsequent query of the predetermined table 200 can identify the namespace access permissions of second identity ID2, and the permissions of second identity ID2 can be set accordingly. According to the embodiment, the startup operation can correspond to either first identity ID1 or second identity ID2, and there may not be a scenario where first identity ID1 and second identity ID2 are operated simultaneously in the same startup operation.
[0052] Figure 5 This is a schematic diagram of a dual-ended solid-state drive 500 in another embodiment. The solid-state drive 500 may be similar to the solid-state drive 300. However, the solid-state drive 500 may be dual-ended rather than single-ended. The solid-state drive 500 may include a first connection terminal PT51, a second connection terminal PT52, a first controller 510, a second controller 520, and storage space 580, wherein the controller 510 can process data transmitted and received by the first connection terminal PT51, and the second connection terminal 520 can process data transmitted and received by the second connection terminal PT52. For example, the first connection terminal PT51 may be a first external component interconnect (PCIe) connection terminal, and the second connection terminal PT52 may be a second external component interconnect (PCIe) connection terminal. The first controller 510 and the second controller 520 may support the Non-Volatile Memory Communication Protocol (NVMe), and the first controller 510 and the second controller 520 may support PCIe control functions.
[0053] Figure 6 for Figure 5 The flowchart for the management method of solid-state drives 500 and 600. (See attached diagram.) Figure 1 , Figure 2 and Figure 5 As shown, management method 500 may include the following steps.
[0054] When using the first connector PT51:
[0055] Step 610: Perform the boot-up operation;
[0056] Step 620: Perform authentication via the first connection port PT51 to identify whether the user is the first identity ID1;
[0057] Step 630: If the user is the first identity ID1, according to the authentication operation, identify the first identity ID1, query the predefined table 200 to query the first permission P1 for accessing the first namespace NSA and the second permission P2 for accessing the second namespace NSB.
[0058] Step 640: Set the first identity ID1's first access permission P1 to access the first namespace NSA, and the second access permission P2 to access the second namespace NSB; and
[0059] Step 650: Perform the BIOS loading operation.
[0060] When using the second connector PT52:
[0061] Step 610: Perform the boot-up operation;
[0062] Step 620: Perform authentication via the second connection port PT52 to identify whether the user is the second identity ID2;
[0063] Step 630: If the user is the second identity ID2, according to the authentication operation, identify the second identity ID2, query the predefined table 200 to query the first permission P4 for accessing the third namespace NSC and the second permission P3 for accessing the second namespace NSB;
[0064] Step 641: Set the second identity ID2's first access permission P3 to access the second namespace NSB and the second access permission P4 to access the third namespace NSC; and
[0065] Step 650: Perform the BIOS loading operation.
[0066] Therefore, as Figure 6 As shown, in step 620, authentication can be performed through at least one of the first connection port PT51 and the second connection port PT52 of the dual-ended solid-state drive. After step 630, if the user is identified as the first identity ID1, step 640 can be entered to set the access permissions of the first identity ID1 to the namespace; and if the user is identified as the second identity ID2, step 641 can be entered to set the access permissions of the second identity ID2 to the namespace.
[0067] Figure 6 Step 610 can correspond to Figure 1 Step 110, Figure 6 Steps 620, 630, 640, and 641 can correspond to Figure 1 Steps 120 to 140, and Figure 6 Step 650 can correspond to Figure 1Step 150.
[0068] Figure 6 The order of steps described is merely an example; appropriate modifications based on requirements still fall within the scope of this embodiment. Figures 3 to 6 In the process, the authentication operations described in steps 420 and 620 can be performed using the Shadow Master Boot Record (shadowMBR) in the solid-state drive.
[0069] exist Figures 3 to 6 In this process, the authentication operations described in steps 420 and 620 can correspond to a first username and a first password, and the authentication operation described in step 620 can also correspond to a second username and a second password. Therefore, the user can enter the correct username and password to complete the verification. The username here can be an account number, a specific code, numbers, an email address, or other suitable format.
[0070] The first identity ID1 and the second identity ID2 mentioned above are merely examples to illustrate that multiple identities can be managed, but the number of identities is not limited to two. According to the embodiments, the number of identities can be multiple, and may be greater than two. For example, the authentication operations in steps 420 and 620 can use multiple usernames and multiple user passwords to identify multiple users. For instance, in a corporate computer or gaming system, using the architecture of the embodiments, related permission management can be performed on hundreds of identities for hundreds of users.
[0071] exist Figures 1 to 6 In this context, the first namespace NSA can have a first namespace identifier (namespaceidentity, namespace ID), the second namespace NSB can have a second namespace identifier, and the third namespace NSC can have a third namespace identifier. The first namespace identifier, the second namespace identifier, and the third namespace identifier can be different from each other.
[0072] like Figure 3 and Figure 5 As shown, the first operating system SYS1 can be installed in the first namespace NSA, and the second operating system SYS2 can be installed in the third namespace NSC.
[0073] Since the first namespace NSA can be a namespace dedicated to the first identity ID1, after a user completes authentication using the first identity ID1, they can use the working environment of the first operating system SYS1 to perform operations. For example, a user with the first identity ID1 can access a shared namespace (e.g., the second namespace NSB) through the first operating system SYS1.
[0074] Since the third namespace NSC can be a namespace dedicated to the second identity ID2, after a user completes authentication using the second identity ID2, they can use the working environment of the second operating system SYS2 to perform operations. For example, a user with the second identity ID2 can access a shared namespace (e.g., the second namespace NSB) through the second operating system SYS2.
[0075] The first operating system SYS1 and the second operating system SYS2 mentioned above can be the same or different operating systems. For example, the first operating system SYS1 and the second operating system SYS2 can be different versions of the Windows operating system, or the first operating system SYS1 and the second operating system SYS2 can be a Linux operating system and a Windows operating system, respectively.
[0076] about Figure 3 and Figure 4 The single-ended solid-state drive 300 and management method 400 are illustrated below with examples of practical application scenarios. In homes, libraries, and administrative institutions, there is often a need for multiple users to share a computer. In the past, if a hard drive had more than two operating systems installed, users would often see other operating systems after booting up, which could lead to the accidental formatting or deletion of data from other operating systems. Figure 3 Solid State Drive 300 and Figure 4 The management method 400, in the Basic Input / Output System (BIOS) and operating system, allows users to see only the namespaces they have viewing permissions for, while other namespaces can be hidden. Therefore, it can prevent the accidental modification and deletion of data and greatly improve information security.
[0077] about Figure 5 and Figure 6 The dual-ended solid-state drive 500 and management method 600 are illustrated below with a practical application scenario. In a game console system, the game operator can access the first namespace NSA, where the operating system SYS1 is installed, via the first connection PT51 to update and modify game parameters and settings data located in the second namespace NSB. Meanwhile, the game player can access the third namespace NSC, where the operating system SYS2 is installed, via the second connection PT52 to read the game parameters and settings data in the second namespace NSB to play the game. Since the game player's permissions are limited to reading the second namespace NSB and not writing to it, it prevents unauthorized individuals (e.g., game players, unauthorized intruders, etc.) from mistakenly modifying or deleting game parameters and settings data.
[0078] In summary, using Figures 1 to 6The management method 100, solid-state drive 300, management method 400, solid-state drive 500 and management method 600 described above can easily realize permission management of multiple namespaces, and can also effectively prevent users from accidentally or maliciously modifying the data in the solid-state drive, which is helpful for improving efficiency and enhancing information security.
[0079] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made in accordance with the claims of the present invention should be included within the scope of the present invention.
Claims
1. A method for managing a solid-state drive, comprising: Perform a startup operation; Perform an authentication operation through a connection; Based on the authentication operation, a predetermined table is queried to identify whether the authentication operation corresponds to a first identity or a second identity; If the authentication operation corresponds to the first identity, set a first permission for the first identity to access a first namespace of a solid-state drive and a second permission to access a second namespace; If the authentication operation corresponds to the second identity, set a third permission for the second identity to access the second namespace of the solid-state drive, and a fourth permission to access the third namespace; and Perform a basic input / output system load operation; The second namespace is a shared namespace for the first identity and the second identity.
2. The management method as described in claim 1, wherein the connection terminal is a high-speed channel connection terminal for interconnecting external components.
3. A method for managing a solid-state drive, comprising: Perform a startup operation; An authentication operation is performed through a first connection. Based on the authentication operation, to identify whether the authentication operation corresponds to a first identity, a pre-defined table is queried; This authentication operation is performed through a second connection. Based on the authentication operation, the predefined table is queried to identify whether the authentication operation corresponds to a second identity; If the authentication operation corresponds to the first identity, set a first permission for the first identity to access a first namespace of a solid-state drive and a second permission to access a second namespace; If the authentication operation corresponds to the second identity, set a third permission for the second identity to access the second namespace of the solid-state drive, and a fourth permission to access the third namespace; and Perform a basic input / output system load operation; The second namespace is a shared namespace for the first identity and the second identity.
4. The management method as described in claim 3, wherein the first connection end is a first external component interconnect high-speed channel connection end, and the second connection end is a second external component interconnect high-speed channel connection end.
5. The management method as described in claim 1 or 3, wherein the second authority is different from the third authority.
6. The management method as described in claim 1 or 3, wherein the authentication operation is performed using a Shadow Master Boot Record in the solid-state drive.
7. The management method as described in claim 1 or 3, wherein the predetermined table is set in firmware.
8. The management method as described in claim 1 or 3, wherein: The first namespace has a first namespace identifier; The second namespace has a second namespace identifier; This third namespace has a third namespace identifier; and The first namespace identifier, the second namespace identifier, and the third namespace identifier are different from each other.
9. The management method as described in claim 1 or 3, wherein a first operating system is installed in the first namespace, and a second operating system is installed in the third namespace.