Encrypted USB disk system and encryption method based on national secret security chip and fingerprint authentication

Abstract

The application relates to the field of mobile storage and information security technology, and discloses an encrypted U disk system and method based on a national secret security chip and fingerprint authentication, which comprises a USB interface, a USB storage controller, a storage medium, an online encryption module, a national secret security chip, a fingerprint collection module and a control communication interface; a data channel between the USB storage controller and the storage medium is connected through the online encryption module, the online encryption module is used for performing SM4 symmetric encryption and decryption on data flow corresponding to an encrypted logical partition; the USB storage controller is used for maintaining partition information containing a normal logical partition and an encrypted logical partition; when an enumeration / mounting request or a read-write access request of a host for the encrypted logical partition is detected, an authorization request is initiated to the national secret security chip through the control communication interface. The application solves the problem of how to realize closed-loop authentication and stealth hierarchical anti-leakage of the encrypted U disk.

Description

Technical Field

[0001] This invention relates to the field of mobile storage and information security technology, specifically to an encrypted USB flash drive system and encryption method based on national cryptographic security chips and fingerprint authentication. Background Technology

[0002] USB flash drives remain an important and commonly used physical data carrier in application scenarios such as cross-network data transfer, offline copying of classified data, and taking sensitive financial / government and enterprise data out of the office. However, their "portable and offline copying" characteristics also make them inherently more vulnerable to data leakage and theft.

[0003] Existing encrypted USB drive solutions mainly include software-encrypted USB drives, ordinary password USB drives, and some "fingerprint USB drives." These solutions generally suffer from the following problems: the key or authentication logic relies on host software or ordinary controllers, making them vulnerable to reverse engineering / debugging / memory capture / firmware replacement, leading to data leakage; when directly reading NAND / eMMC after disassembly, if the data written to the disk is not mandatory encrypted or the key can be obtained indirectly, offline recovery is risky; some fingerprint USB drives only use the fingerprint module as an external device, with the authentication result determined by the controller or host computer, posing a risk of bypassing authentication and directly opening the data path; furthermore, traditional encrypted drives are mostly "fully visible upon unlocking," lacking a minimal exposure strategy of "no enumeration / display for unauthorized access," making it difficult to achieve hierarchical and covert access management for areas such as the exchange area and the secret area.

[0004] Therefore, there is an urgent need for an encrypted USB flash drive system and method that can solidify encryption capabilities at the hardware level, forcing data written to the storage medium to be encrypted and effectively resisting offline analysis after disassembly; complete authentication access control and key generation / storage / management in a closed loop within the security chip to prevent keys and authentication from being bypassed by the host or control side; and support encrypted partitions not to be displayed / unenumerable in an unauthorized state, and to be displayed and open for reading and writing after authorization, thereby achieving hierarchical storage and access control with minimal exposure. Summary of the Invention

[0005] Based on the above description, the present invention provides an encrypted USB flash drive system and encryption method based on national cryptographic security chips and fingerprint authentication, in order to solve the problem of how to achieve closed-loop authentication and stealth hierarchical anti-leakage of encrypted USB flash drives.

[0006] On the one hand, the technical solution of the present invention to solve the above-mentioned technical problems is as follows: an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication, including a USB interface, a USB storage controller, a storage medium, an online encryption module, a national cryptographic security chip, a fingerprint acquisition module, and a control communication interface; the data path between the USB storage controller and the storage medium is connected via the online encryption module, and the online encryption module is used to perform SM4 symmetric encryption and decryption on the data stream corresponding to at least one encrypted logical partition;

[0007] The USB storage controller is used to maintain partition information including the normal logical partition and the encrypted logical partition, and to prevent the encrypted logical partition from being enumerated or displayed to the host side when session authorization information is not obtained.

[0008] When the USB storage controller detects an enumeration / mount request or read / write access request from the host for the encrypted logical partition, it initiates an authorization request to the national cryptographic security chip through the control communication interface.

[0009] The national cryptographic security chip is used to receive the fingerprint features collected by the fingerprint acquisition module and complete the comparison and authentication within the chip. Based on the authentication result, it generates session authorization information and generates or selects the SM4 data key or key identifier corresponding to the encryption logic partition according to the partition key field identifier. It outputs key-related information for driving the online encryption module to the USB storage controller in a controlled manner.

[0010] The USB storage controller is used to open the mapping / enumeration of the encrypted logical partition and allow data reading and writing to the encrypted logical partition when the session authorization information is valid. At the same time, it controls the online encryption module to perform SM4 encryption on the data written to the encrypted logical partition and write the ciphertext to the storage medium, and to perform SM4 decryption on the ciphertext read from the storage medium and return it to the host.

[0011] When a session authorization is revoked, a session times out, or a USB flash drive is removed, the USB storage controller disables the mapping / enumeration of the encrypted logical partition and clears the session key context.

[0012] The above technical solution places the online encryption module on the data path between the USB storage controller and the storage medium. This ensures that data for the encrypted logical partition is encrypted with SM4 before being written to disk and decrypted before being returned to the host during retrieval. This achieves online protection of the encrypted partition data at the hardware data path level, preventing plaintext from being directly written to the storage medium. This improves protection against scenarios such as offline reading after disassembly and direct media analysis. Furthermore, the national cryptographic security chip performs fingerprint comparison authentication within the chip, generating session authorization information and generating or selecting the corresponding SM4 data key or key identifier based on the authentication result. This ensures that both the authentication and key management processes are secure. The chip's internal closed-loop design reduces the risk of keys being exposed to the host or ordinary control side, thus improving the security of authentication and key usage. By preventing the encrypted logical partition from being enumerated or displayed to the host side when session authorization information is not obtained, and only opening the mapping / enumeration and read / write permissions of the corresponding partition when authorization is valid, the encrypted partition can be made visible on demand, accessed according to permissions, and hierarchically stored, reducing the exposure surface in the unauthorized state. Furthermore, by closing the mapping / enumeration of the encrypted logical partition and clearing the session key context when session authorization is revoked, session times out, or the USB flash drive is removed, the security risks caused by session remnants are reduced, and the overall access control reliability of the system is improved.

[0013] Based on the above technical solution, the present invention can be further improved as follows.

[0014] Furthermore, the USB storage controller is configured to present only at least one unencrypted logical unit to the host side and suppress the enumerability of encrypted logical partitions when session authorization information is invalid, the suppression including at least one of the following:

[0015] When responding to a specific request from the Get Max LUN class of the USB mass storage class, return the maximum logical unit number that does not include the logical unit number corresponding to the encrypted logical partition;

[0016] For SCSI transparent commands initiated by the host side with non-existent or unauthorized logical unit numbers, the default CHECKCONDITION is returned, along with additional awareness code information corresponding to "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOT READY", without triggering the data path of the online encryption engine.

[0017] And when the session authorization information changes from invalid to valid or from valid to invalid, USB re-enumeration is triggered and the maximum logical unit number is updated after re-enumeration. At the same time, a Unit Attention of "REPORTED LUNS DATA HASCHANGED" is reported to the host to prompt the host to rediscover the logical unit.

[0018] Furthermore, after fingerprint authentication or password authentication is successful, the national cryptographic security chip generates a session authorization token. The session authorization token includes at least a session identifier, an authorization partition identifier or authorization level, validity period information, and a random challenge value or a monotonically increasing counter. The national cryptographic security chip performs integrity and source authentication on the session authorization token based on SM2 digital signature or SM4 message authentication code. The USB storage controller is configured to allow the execution of at least one operation related to the encrypted logical partition only after verifying the authenticity and freshness of the session authorization token: opening encrypted logical partition enumeration, establishing an encryption engine key context, or executing read / write commands on the encrypted logical partition.

[0019] All control commands transmitted on the control communication interface related to unlocking, key loading, or policy adjustment must carry the session authorization token or its derived session key for verification.

[0020] Furthermore, the online encryption engine performs online bidirectional encryption and decryption based on SM4 for the data of the encrypted logical partition using sectors as data units. In order to satisfy random access read and write and suppress ciphertext shifting attacks, the online encryption engine generates an initialization vector or adjustable parameter associated with the logical block address LBA for each sector. The initialization vector or adjustable parameter is determined by at least one or more of the following fields: logical block address LBA, partition key field identifier, key version number, and session identifier.

[0021] The national cryptographic security chip supports key rotation based on key version number for the same partition key field, and the USB storage controller clears the encryption context corresponding to the session identifier or key version number when authorization is revoked.

[0022] The online encryption engine is also configured to optionally generate an integrity check value for the sector data and store it in association with the sector data. When reading, the integrity check value is verified based on an SM3 hash or an SM4 message authentication code to detect offline tampering.

[0023] Furthermore, it also includes a secure storage and verification mechanism for policy records, wherein the policy records are used to represent at least one partition policy or access control policy. The policy records include at least a policy version number, partition type identifier and visibility default value, read and write permission parameters, authentication method parameters or failure threshold parameters, and include an SM3 hash value of the policy record content and an SM2 signature generated by the national cryptographic security chip.

[0024] The policy record is stored in the hidden area of ​​the storage medium and has at least two redundant copies, a primary and a secondary copy. It is updated using a two-phase commit method. The USB storage controller applies the policy record only when hash verification and signature verification are completed, and the policy version number is not lower than the monotonic counter or version baseline maintained internally by the security chip, during startup or policy change.

[0025] Furthermore, the national cryptographic security chip is configured to maintain a failure count and time window parameters associated with the user identifier or device identifier when fingerprint authentication or password authentication fails. The failure count is stored in the non-volatile secure storage area of ​​the security chip and is maintained after the device is powered off or unplugged. When consecutive failures reach a first threshold, a freeze period is entered and the time for the next authorized authentication is extended by incremental waiting or exponential backoff. The freeze period timing is based on the internal timing or counting source of the security chip and does not depend on the host system time.

[0026] Upon continuous failures reaching the second threshold or detection of abnormal reset, control communication interface tampering, or disassembly events, a second-level procedure is executed. The second-level procedure includes at least one of the following: revoking or erasing the SM4 key field of the encrypted logic partition, clearing the fingerprint template or authentication data, restoring the factory reset policy, or requiring administrator credentials to intervene and unlock.

[0027] Secondly, the technical solution of the present invention to solve the above-mentioned technical problems is as follows: an encryption method based on a national cryptographic security chip and fingerprint authentication, which is executed in an encrypted USB flash drive including a USB storage controller, a storage medium, an online encryption engine located on the data path between the USB storage controller and the storage medium, a national cryptographic security chip, and a fingerprint acquisition module, comprising:

[0028] Establish partition identifiers and access policies, which include at least partition type identifiers, visibility policies, access control policies, and partition key field identifiers, and divide the storage space into at least a normal area and at least one encrypted area;

[0029] When at least one triggering condition for the encrypted area is detected, the national cryptographic security chip is triggered to perform fingerprint comparison authentication or password authentication in a closed loop within the chip. The triggering conditions include at least: the host requests to enumerate / mount the encrypted area, the host initiates read / write operations on the encrypted area, or the management call requests to open the encrypted area.

[0030] Upon successful authentication, the national cryptographic security chip generates session authorization information and generates or selects an SM4 data key or key identifier / version corresponding to the encrypted area based on the session authorization information and the partition key field identifier, and provides the USB storage controller with key-related information for controlled use.

[0031] Only when the session authorization information is valid and the authorization scope covers the target partition, the enumeration / mounting and read / write paths of the encrypted zone are opened, and online bidirectional SM4 processing is performed on the data belonging to the encrypted zone on the data path between the USB storage controller and the storage medium. This includes: the write path encrypts the written data with SM4 and writes it to the storage medium, and the read path decrypts the ciphertext read from the storage medium with SM4 and returns it to the host, so that the data written to the disk in the encrypted zone is ciphertext.

[0032] When a session authorization is revoked, a session times out, or a device is unplugged, the mapping of the encrypted area is turned off and the encrypted area is prevented from being enumerated / displayed. At the same time, the session-related key context is cleared, and the encrypted area is restored to an unauthorized and unavailable state.

[0033] Specifically, data access to the ordinary area does not enter the online bidirectional SM4 processing flow.

[0034] The above technical solution establishes a partition identification and access policy that includes partition type identifiers, visibility policies, access control policies, and partition key field identifiers. The storage space is divided into a normal area and at least one encrypted area, enabling different data to be partitioned and managed differently according to security levels. This facilitates hierarchical protection and access control with minimal exposure. When conditions such as encrypted area enumeration / mounting, read / write access, or management calls are detected, the national cryptographic security chip is triggered to perform fingerprint comparison authentication or password authentication within a closed loop. This ensures that the authentication process does not rely on the host side, reducing the risk of the authentication link being bypassed, tampered with, or forged. After successful authentication, the national cryptographic security chip combines session authorization information and partition key field identifiers to generate or select the corresponding SM4 data key or key identifier / version, and provides the USB storage controller with controlled key-related information. This centralizes key generation, storage, selection, and usage control within the security chip, reducing the risk of key exposure and improving key management security. By opening the enumeration / mounting and read / write paths of the encrypted zone only when the session authorization information is valid and the authorization scope covers the target partition, and performing online bidirectional SM4 processing on the data path between the USB storage controller and the storage medium for data belonging to the encrypted zone, the data written to the encrypted zone is written to disk in ciphertext and restored to plaintext when read back to the host. This achieves continuous protection of the encrypted zone data at the hardware data path level, which is beneficial to improving the protection capabilities against attack scenarios such as direct reading of the storage medium after disassembly and offline analysis of storage content. By disabling the encrypted zone mapping, preventing it from being enumerated or displayed, and clearing the session-related key context when the session authorization is revoked, the session times out, or the device is unplugged, the encrypted zone can be restored to an unauthorized and unusable state in a timely manner, which helps to reduce the security risks caused by session remnants and abnormal unplugging. In addition, by stipulating that data access to the ordinary zone does not enter the online bidirectional SM4 processing process, the impact on the performance of ordinary data access and system compatibility can be reduced while ensuring the encryption protection of sensitive data.

[0035] Furthermore, the "preventing the encrypted area from being enumerated / displayed" includes implementing logical unit set gating during the USB mass storage enumeration phase: when responding to a Get Max LUN-specific request when session authorization information is invalid, returning the largest logical unit number that does not contain the logical unit number corresponding to the encrypted area, and returning CHECK CONDITION with additional awareness code information representing "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOT READY" to SCSI transparent commands initiated by the host for logical unit numbers that have not been reported; triggering re-enumeration or Bulk-Only Mass Storage Reset when session authorization information changes from invalid to valid or from valid to invalid, and establishing UnitAttention with additional awareness code "REPORTED LUNS DATA HAS CHANGED" after rediscovery, so as to prompt the host to refresh the logical unit list before presenting or hiding the encrypted area.

[0036] Furthermore, the session authorization information is constructed into a session authorization token, which includes at least one of a session identifier, authorization scope, validity period information, and a random challenge value or a monotonically increasing counter. The national cryptographic security chip performs SM2 signature or SM4-based message authentication code calculation on the session authorization token. Before enumerating / mounting the open encrypted zone, establishing an SM4 encryption context, or processing encrypted zone read / write operations, the USB storage controller verifies the authenticity and freshness of the session authorization token. Subsequently, it carries the session authorization token or derived session key in each sensitive control command related to unlocking, key loading, authorization revocation, or policy adjustment for verification to reject replay or bypass injection control messages.

[0037] Furthermore, the "online bidirectional SM4 processing" performs sector-level encryption and decryption for the encrypted area using sectors as data units, and generates an initialization vector or adjustable parameter associated with the logical block address (LBA) when performing SM4 encryption and decryption on each sector. The initialization vector or adjustable parameter is determined by at least two of the LBA, partition key field identifier, key version number, and session identifier. The national cryptographic security chip maintains the key version number according to the partition key field identifier and supports rotating the key version under session switching or preset conditions. The USB storage controller clears the encryption context corresponding to the session identifier or key version number when the authorization is revoked.

[0038] Compared with the prior art, the technical solution of this application has the following beneficial technical effects:

[0039] 1. This invention constructs a closed-loop authorization system by coordinating a national cryptographic security chip, a fingerprint acquisition module, a USB storage controller, and an online encryption module. Fingerprint comparison, password authentication, session authorization information generation, and partition key generation / selection are all controlled and completed on the security chip side, achieving full-process security control from "authentication—authorization—partition opening—read / write—revocation." This ensures that the encrypted logical partition cannot be enumerated or displayed in an unauthorized state, and data written to the encrypted area is encrypted online using SM4 and stored in ciphertext form on the disk. Even if an attacker directly reads the storage medium, it is difficult to obtain plaintext data, thus significantly improving the USB flash drive's protection against risks such as data leakage, unauthorized copying, disk loss reading, and bypassing host-side software control.

[0040] 2. This invention achieves a controlled presentation of the encrypted partition on the host side by setting up a normal zone and an encrypted zone, combined with session authorization tokens, LUN gating, SCSI anomaly response, authorization state switching re-enumeration, and a Unit Attention prompt mechanism. The encrypted partition "dynamically appears according to authorization and is immediately hidden after failure." Compared with the traditional method of exposing the complete drive letter of an encrypted USB flash drive upon power-on and then relying on software interception, this invention can suppress unauthorized access from the USB enumeration layer and protocol interaction layer, reducing security risks caused by automatic host scanning, cache residue, and incorrect mounting. At the same time, it ensures that the read and write paths of the corresponding partition can be smoothly opened after successful authorization, balancing high security and ease of use, and improving the device's adaptability and availability in multiple terminals and scenarios.

[0041] 3. This invention further enhances the system's comprehensive defense capabilities against ciphertext movement, offline tampering, policy rollback, brute-force guessing, abnormal reset, and disassembly attacks by employing sector-level online SM4 bidirectional encryption and decryption, generating initialization vectors or adjustable parameters based on LBA and partition key fields, key version rotation, optional integrity verification, two-phase commit of policy record signature verification and dual copies, failure count maintenance, freeze period backoff, and secondary handling of abnormal triggers. This not only ensures data confidentiality but also takes into account data integrity, authorization freshness, policy consistency, and device operational reliability, enabling the encrypted USB drive to maintain stable, reliable, and traceable secure storage even under complex operating conditions such as long-term use, power outages, repeated authentication failures, etc. Attached Figure Description

[0042] Figure 1 This is a hardware structure block diagram of an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication according to an embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of the logical partition and LUN mapping of an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication according to an embodiment of the present invention;

[0044] Figure 3 This invention provides a process for generating session authorization tokens and verifying control channels in an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication, according to an embodiment of the present invention.

[0045] Figure 4 This is the timing sequence of an unauthorized, non-enumerable mechanism for an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication, according to an embodiment of the present invention.

[0046] Figure 5 This is a schematic block diagram illustrating sector-level online SM4 encryption / decryption, IV generation, and tag metadata association storage of an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication, according to an embodiment of the present invention.

[0047] Figure 6 This is a schematic block diagram illustrating the policy recording structure and two-stage submission of an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication, according to an embodiment of the present invention.

[0048] Figure 7 This invention provides an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication.

[0049] Figure 8 This invention provides an encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication. Detailed Implementation

[0050] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0052] Explanation of Symbols, English Terms and Abbreviations

[0053] USB: Universal Serial Bus;

[0054] MSC: Mass Storage Class, USB Mass Storage Class;

[0055] SCSI: Small Computer System Interface; this case involves SCSI transparent command sets.

[0056] LUN: Logical Unit Number; Get Max LUN is a USB MSC class-specific request used by the host to obtain the maximum logical unit number supported by the device.

[0057] CHECK CONDITION: SCSI status, indicating an anomaly that requires the use of Sense Data to determine the cause; "LOGICAL UNIT NOT SUPPORTED / NOT READY" are common Sense Data semantics.

[0058] Unit Attention: SCSI event notification mechanism; "REPORTED LUNS DATA HAS CHANGED" is an event semantic used to notify that the host logical unit list has changed;

[0059] SM2 / SM3 / SM4: Public-key algorithms / hash algorithms / block cipher algorithms in the Chinese national cryptographic algorithm system;

[0060] MAC: Message Authentication Code; This article provides an example of MAC based on SM4 (such as CMAC semantics) to illustrate the implementation of "Message Authentication Code based on SM4";

[0061] LBA: Logical Block Address (sector address);

[0062] Token: Session authorization token; contains fields such as session identifier, authorization scope, validity period, random challenge or monotonic counter, and is signed or MAC protected by a security chip;

[0063] Nonce: Random challenge value (one-time random number);

[0064] CTR: Counter, a monotonically increasing counter (used for anti-replay / freshness verification).

[0065] Example 1:

[0066] refer to Figures 1-8 An encrypted USB flash drive system based on national cryptographic security chips and fingerprint authentication.

[0067] I. System Hardware Structure and Data / Control Path: The encrypted USB flash drive system in this embodiment includes: a USB interface, a USB storage controller, a storage medium, an online encryption module, a national cryptographic security chip, a fingerprint acquisition module, and a control communication interface. The data path between the USB storage controller and the storage medium is connected via the online encryption module, which performs SM4 symmetric encryption and decryption on the data stream corresponding to at least one encrypted logical partition. This structure ensures that "data written to the storage medium is forced to be ciphertext," thus preventing the direct acquisition of plaintext when the storage chip is read offline.

[0068] 1. Hardware Interconnection and Functional Division of Labor: In this embodiment, the USB storage controller can be a main control chip integrating a USB 3.0 or higher high-speed interface, RAM, and a storage controller (e.g., eMMC Controller / SD Host); the storage medium can be eMMC and / or NAND Flash. The online encryption module can be an encryption hard core / encryption coprocessor inside the USB storage controller, or it can be an independent encryption device located on the data path; its input side is connected to the data transfer channel (DMA or equivalent channel) of the USB storage controller, and its output side is connected to the data port of the storage medium controller to achieve online bidirectional processing of "write encryption, read decryption".

[0069] In this embodiment, the control communication interface can be a UART or an equivalent serial bus, used for control command and authorization interaction between the USB storage controller and the national cryptographic security chip. The fingerprint acquisition module is used to acquire fingerprint images / feature data and submit them to the security chip for comparison. The fingerprint template / comparison algorithm is executed on the security chip side to ensure that the authentication loop is completed within the security boundary.

[0070] 2. Partition organization and engineering representation of "partition information"; The USB storage controller maintains partition information including ordinary logical partitions and encrypted logical partitions, and prevents encrypted logical partitions from being enumerated or displayed to the host side when session authorization information is not obtained.

[0071] Partition information can be represented by a partition table structure, and each partition entry must contain at least the following fields:

[0072] PartID: Partition number (16 bits); LUN_ID: Logical unit number mapped to this partition (8 bits); StartLBA / LenLBA: Starting logical block address and length (64 bits each); PartType: Partition type (e.g., ISO / Normal / Exchange / Secret, 8 bits); EncFlag: Whether to enter the online SM4 data path (1 bit); ROFlag: Whether to be read-only (1 bit); DefaultVisible: Default visibility (1 bit); DomainID: Partition key domain identifier (32 bits); KeyVer: Key version number (16 bits).

[0073] In this case, the normal area or ISO area with "EncFlag=0" will not enter the SM4 encryption process (the ISO area can be read-only or not decrypted) in order to reduce unnecessary decryption overhead and avoid authentication dependence on public content.

[0074] In some implementations, the storage space can be divided into a hidden area, a read-only ISO area, a normal area, and at least one encrypted area; the encrypted area can be further divided into a swap area and a secret area, and each partition can be configured with whether it is hidden, whether it is read-only, and authentication policies. This division method is also consistent with the example in the solution specification (hidden area, ISO area, normal area, swap area, secret area, and the swap area / secret area is not displayed by default).

[0075] 3. Data Path: Online SM4 encryption / decryption and task-based data transfer; When the host initiates a read / write request for a logical partition, the USB storage controller parses the request according to the protocol and converts it into a block I / O task for the storage medium; When the target partition is an encrypted logical partition and the session authorization is valid, the USB storage controller imports the read / write request for that partition into the online SM4 data path, where the online encryption module completes the write encryption and read decryption during the data transfer process, ensuring that the data written to the disk is ciphertext.

[0076] To balance high-speed throughput and security control, in this embodiment, the data plane of the USB storage controller can adopt an asynchronous I / O task architecture: the front end is responsible for receiving requests from the host side and generating tasks, while the back end is responsible for performing read and write operations on the storage medium and triggering "encrypted transmission" (i.e., performing online SM4 encryption / decryption on encrypted partition data) during the data phase; this decouples "protocol response" from "media read and write latency" and improves overall throughput and stability.

[0077] 4. Control Path: Triggering authorization, synchronous interaction and closed-loop authentication of the security chip. When the USB storage controller detects an enumeration / mounting request or read / write access request from the host for the encrypted logical partition, it initiates an authorization request to the national cryptographic security chip through the control communication interface. To reduce authentication status confusion and session context confusion caused by concurrency, this embodiment adopts synchronous IO interaction between the security chip and fingerprint access: that is, after each authentication / authorization / key request instruction is issued, the system waits for the security chip to respond before sending subsequent instructions.

[0078] The national cryptographic security chip receives fingerprint features collected by the fingerprint acquisition module and performs comparison and authentication within the chip. After successful authentication, session authorization information is generated, and an SM4 data key or key identifier corresponding to the encryption logic partition is generated or selected based on the partition key field identifier. The key-related information used to drive the online encryption module is output to the USB storage controller in a controlled manner.

[0079] Meanwhile, the security chip can employ multi-task scheduling to process serial port I / O, cryptographic operations (SM2 / SM4 / SKF object operations), and security logic such as fingerprint acquisition / comparison and failure counting, thereby improving response efficiency while ensuring security boundaries.

[0080] 5. Three controlled output formats for "key-related information": To reduce the risk of key exposure, "key-related information" in this embodiment can adopt at least one of the following three controlled output formats:

[0081] KeyID + KeyVer Method: The security chip only returns the key identifier KeyID (e.g., 32 bits) and the key version KeyVer (e.g., 16 bits). The USB storage controller does not directly hold the plaintext key, but instead calls the "secure loading interface" of the online encryption module to load it according to KeyID (the loading process may require further handshake between the online encryption module and the security chip, or the key packet may be forwarded by the master controller and then unpacked within the security domain of the encryption module). This method is suitable for online encryption modules with protected registers / key slots. WrappedKey Method: The security chip returns a key packet WrappedKey = Enc_SM4(Ks, DataKey || Meta), where Ks is the session key or a pre-built encapsulated key in the device, and Meta may contain metadata such as DomainID, KeyVer, and validity period. The USB storage controller imports the WrappedKey into the online encryption module only during the session's validity period and erases the import cache upon session termination, preventing the main controller from retaining plaintext keys for extended periods. A one-time derived key material method is used: the security chip derives a one-time session key material Ktmp based on session authorization information (such as SID, Scope, TTL) and the partition key field DomainID, which is used to drive the online encryption module to establish a "session encryption context." Ktmp becomes invalid when the session is terminated, along with the context. This method is suitable for key management strategies that prioritize "session binding and short-term validity."

[0082] 6. Session Activation / Revocation and Context Clearing: When the session authorization information is valid, the USB storage controller opens the mapping / enumeration of the encrypted logical partition and allows data reading and writing to that partition. Simultaneously, it controls the online encryption module to complete write encryption and read decryption. Examples of authorization revocation conditions are provided in the disclosure: host-initiated locking, timeout, device removal, or failure threshold triggering a security rollback. After revocation, the controller closes the partition mapping and clears the session-related key context, restoring the partition to a hidden state. Simultaneously, the controller should clear: the online encryption module session register / key slot, the cache of unfinished encrypted area I / O tasks in the task queue, and the cache of authorization tickets associated with the SID in the control channel to avoid the bypass risk of "decryption continuing after revocation."

[0083] II. Protocol layer implementation for "non-enumerable / not displayed" under unauthorized conditions, such as Figure 4 As shown, this embodiment applies the "minimum exposure of unauthorized access" to the executable mechanism of the USB MSC and SCSI command layers: when the session authorization information is invalid, the USB storage controller presents only at least one unencrypted logical unit to the host side and suppresses the enumerability of the encrypted logical partition.

[0084] 1. The key node for the interaction between the state machine and the host is that the USB storage controller maintains at least two working states: LOCKED and UNLOCKED.

[0085] In the LOCKED state: only the "public LUN set" can be discovered by the host (e.g., normal zone LUN, ISO zone LUN), and the LUN corresponding to the encrypted zone is not included in the host's discoverable list; any enumeration / mounting / read / write attempt against the encrypted zone is rejected by the protocol layer; in the UNLOCKED state: if and only if the session authorization is valid and the authorization scope covers the target partition, the encrypted partition is allowed to be mapped as an enumerable device / mountable volume, and read / write requests for the partition are directed to the online SM4 data path.

[0086] 2. Get Max LUN Gating: This makes the "encrypted LUN" invisible on the enumeration link. When the host issues a Get Max LUN request for a USB mass storage device, the "maximum logical unit number" returned by the device does not include the logical unit number corresponding to the encrypted logical partition. This prevents the host from entering the subsequent process of "sending INQUIRY / READ CAPACITY / read / write probes to the encrypted LUN". For example, if the system actually supports LUN0 (normal area), LUN1 (ISO area), and LUN2 (encrypted area), then MaxLUN=1 is returned in the LOCKED state; and MaxLUN=2 is returned in the UNLOCKED state (this is just an example and does not constitute a limitation).

[0087] 3. SCSI rejection semantics for unauthorized LUNs: Block detection and avoid triggering the data path; For SCSI transparent commands initiated by the host side with "non-existent or unauthorized logical unit number", the USB storage controller returns the preset CHECKCONDITION and carries the additional awareness code information corresponding to "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOT READY", while explicitly preventing the triggering of the data path of the online encryption engine.

[0088] In some possible implementations, the following Sense example may be used:

[0089] LOGICAL UNIT NOT SUPPORTED: SenseKey=ILLEGAL REQUEST, ASC / ASCQ=25h / 00h; LOGICAL UNIT NOT READY: SenseKey=NOT READY, ASC / ASCQ=04h / 02h or 04h / 00h.

[0090] By using "reject semantics + do not trigger data path", we can avoid the encryption engine from working passively due to host automatic scanning, avoid leaking bypass information such as "encryption zone existence / capacity / media characteristics", and reduce the probability of the host writing disk signature / cache mount point.

[0091] 4. Re-enumeration and Unit Attention during authorization switching: Refresh the host cache LUN view; When session authorization information changes from invalid to valid or from valid to invalid, the USB storage controller triggers USB-side re-enumeration and updates the maximum logical unit number after re-enumeration. At the same time, it reports "REPORTED LUNS DATA HAS CHANGED" UnitAttention to the host side to prompt the host to rediscover the logical unit and refresh the cached LUN view.

[0092] In some implementations, "triggering re-enumeration" can be achieved in any of the following ways: simulating disconnection / reconnection (SoftDisconnect / Connect); triggering a USB bus reset or equivalent reset process; triggering device-side re-initialization and reporting Unit Attention in the MSC command processing link (e.g., first returning Unit Attention, and then guiding the host to resend probe commands such as REPORT LUNS / INQUIRY).

[0093] Among them, Unit Attention can use ASC / ASCQ=3Fh / 0Eh as an example value (corresponding to "REPORTEDLUNS DATA HAS CHANGED") to improve the recognition probability of "LUN set has changed" on different host systems.

[0094] III. Session Authorization Token and Control Channel Verification (Item by Item)

[0095] like Figure 3 As shown, this embodiment uses "session authorization token + freshness verification + control command verification" to solidify the authentication access control on the device side control path: After fingerprint authentication or password authentication is passed, the national cryptographic security chip generates a session authorization token. The token includes at least a session identifier, authorization partition identifier or authorization level, validity period information, and random challenge value or monotonically increasing counter. The national cryptographic security chip performs integrity and source authentication on the token based on SM2 digital signature or SM4 message authentication code.

[0096] 1. Token field, parameters, and encoding rules; In this embodiment, the following parameters are defined:

[0097] SID (Session ID): Session identifier, 64 bits; Scope: Authorization scope / level, 16 bits (e.g., bit0 = exchange zone authorization, bit1 = secret zone authorization, bit2 = management operation authorization); TTL: Validity period, 32 bits (unit can be seconds); Nonce: Random challenge value, 128 bits, generated by the USB storage controller and used only once; CTR: Monotonically increasing counter, 64 bits, maintained and incremented by the security chip in its non-volatile secure storage area for replay protection; DevID: Device identifier (optional), such as a truncated value of a 64-bit serial number or a unique chip ID; Payload: Token payload byte string, concatenated with the above fields in big-endian order.

[0098] Payload = SID || Scope || TTL || Nonce || CTR || DevID (DevID can be omitted).

[0099] 2. The generation and verification process of SM2 signature token: The controller generates a Nonce and requests authentication. The security chip constructs a token and signs it. Only after the controller verifies the signature will it enable the encrypted LUN enumeration and key context.

[0100] More specifically, the USB storage controller and the security chip can interact according to the following synchronous I / O process (waiting for a response at each step before proceeding to the next step to reduce the risk of state confusion):

[0101] AUTH_REQ: The USB storage controller generates a Nonce and sends an authorization request frame to the security chip. The request frame must contain at least the Scope request value, the Nonce, and the target partition key field DomainID (optional); BIO_VERIFY: The security chip drives the fingerprint acquisition / comparison task to complete authentication. After successful authentication, it generates a SID, updates the CTR, and writes it to its secure storage; TOKEN_BUILD: The security chip constructs the Payload and calculates the digest H = SM3(Payload); TOKEN_SIGN: The security chip outputs a signature Sig = SM2_Sign(SK_dev, H), where SK_dev is the security chip's built-in and non-exportable device private key; it returns {Payload, Sig} to the USB storage controller; TOKEN_VERIFY: The USB storage controller verifies the signature Sig using the preset public key PK_dev and performs the verification.

[0102] The following checks are performed: whether the Nonce matches the current request; whether the CTR is greater than the most recent CTR_last (anti-replay) cached by the controller; whether the TTL has not expired; and whether the Scope covers the target partition access. Only after these checks are passed can the USB storage controller allow at least one operation related to the encrypted logical partition to be performed: open the encrypted logical partition enumeration, establish the encryption engine key context, or execute read / write commands on the encrypted logical partition.

[0103] 3. Session Key + MAC Token: In some implementations where master control resources are limited or higher frequency control command performance is required, the “session key + MAC token” approach can be adopted: the security chip and the controller first generate a session key Ks through a challenge-response process. Subsequently, the token and control commands are encrypted using SM4 / SM3 or SM4-CMAC for message authentication, and each command is accompanied by a sequence number seq. Both parties maintain a sliding window to prevent replay.

[0104] To ensure full transparency, a set of feasible parameter definitions (example values) are provided:

[0105] Ks: Session key, 128 bits; seq: Command sequence number, 32 bits incrementing; W: Sliding window size, e.g., W=64; MAC: Message authentication code, 128 bits; MAC calculation: MAC = MAC_SM4(Ks, seq || CmdID || Payload).

[0106] The security chip and controller perform "received set + window" maintenance on the sequence number (seq): if the seq falls outside the window or has already appeared, the control command is rejected and recorded in the "control channel abnormality count".

[0107] 4. Verify each control channel individually: Block "bypass unlocking" inside the device; all control commands transmitted on the control communication interface related to unlocking, key loading, or policy adjustment must carry a session authorization token or its derived session key for verification.

[0108] To facilitate engineering implementation, the control channel frame format can be defined:

[0109] Header (1B) = 0xA5; Version (1B); CmdID (1B); Len (2B); Payload (Len bytes); AuthField: {PayloadToken, Sig} or {seq, MAC}; CRC (2B, optional, for serial port physical error detection).

[0110] Specifically, actions involving security decisions (such as opening the encrypted area and loading the key context) must be based on the authorization result of the security chip. If the verification fails, the subsequent process of "opening enumeration / loading the key / importing the encrypted path" will not proceed, in order to prevent the host or master control side from forging the unlock status by injecting control commands. This principle of "security decisions based on the security chip" is also clearly stated in the briefing.

[0111] 5. Session cancellation and closed-loop clearing: When cancellation conditions such as host active locking, timeout, or device removal occur, the USB storage controller sends a REVOKE command to the security chip (optional), or directly invalidates the session and clears the local context; then triggers "reduced Max LUN + re-enumeration + Unit Attention", so that the host-side LUN view returns to the LOCKED state; and clears the encryption engine key context, so that the partition is restored to a hidden state.

[0112] IV. Sector-level online SM4 encryption, IV / adjustable parameter generation, and optional integrity verification, such as Figure 5 As shown, the online encryption engine performs online bidirectional encryption and decryption based on SM4 for data in the encrypted logical partition, using sectors as data units. To satisfy random access read / write and suppress ciphertext shifting attacks, the online encryption engine generates an initialization vector IV or adjustable parameter Tweak associated with the logical block address LBA for each sector. The initialization vector or adjustable parameter is determined by at least one or more of the following: logical block address LBA, partition key domain identifier DomainID, key version number KeyVer, and session identifier SID. In this embodiment, the SM4 data key is generated and managed by a national cryptographic security chip and can be managed hierarchically or on a rolling basis according to dimensions such as user / time / partition / address range. The USB storage controller imports read / write requests for the encrypted area into the online SM4 data path; ordinary areas or ISO areas do not enter the SM4 encryption process.

[0113] 1. For ease of implementation, the following parameters are defined:

[0114] SectorSize: Sector size, example 512 B or 4096 B; LBA: Logical block address, 64-bit unsigned integer; DomainID: Partition key domain identifier, 32 bits; KeyVer: Key version number, 16 bits; SID: Session identifier, 64 bits; B: Block length, SM4 blocks are 128 bits; BlkCnt = SectorSize / 16: Number of SM4 blocks per sector; "||": Fixed-length byte string concatenation (all using big-endian encoding); Trunc128(x): Takes the high or low 128 bits of x (only one method needs to be fixed in the implementation); SM3(m): Performs SM3 hash on message m, outputting 256 bits; SM4_Enc(K, X): Encrypts 128-bit block X using SM4 key K; MAC_SM4(Km, m): Message authentication code based on SM4 (can be implemented according to CMAC semantics), output example is 128 bits.

[0115] And define a sector-level context structure (stored in the running memory of the USB storage controller, cleared upon authorization revocation):

[0116] EncCtx = {DomainID, KeyVer, SID, KeyRef}, where KeyRef can be a key identifier or a session key handle; KeyRef is provided by the national cryptographic security chip in a controlled manner after authentication (e.g., KeyID / KeyVer or key package), and becomes invalid upon revocation of authorization.

[0117] 2. Example of sector-level online encryption / decryption working mode; To simultaneously satisfy "random access read / write" and "association of each sector parameter with LBA", this embodiment provides a feasible method: the online encryption engine adopts a randomly accessible counter-like mode (e.g., CTR semantics or equivalent implementation) for each sector. Its core is: first, generate a 128-bit initial sector counter IV(LBA) for each sector; then, construct a counter CTRj = IV(LBA) + j (modulo 2^128) for the j-th block (j from 0 to BlkCnt-1) within the sector; calculate the keystream block S(j) = SM4_Enc(Kdata, CTRj); and then execute:

[0118] Write path (encryption): C(j) = P(j) ⊕ S(j); Read path (decryption): P(j) = C(j) ⊕ S(j).

[0119] Where: P(j) is the j-th 128-bit plaintext block in the sector, C(j) is the corresponding ciphertext block, and Kdata is the SM4 data key of the partition key field under KeyVer (managed by the security chip). This method allows the host to initiate read and write operations on any LBA, regardless of the state of the preceding sector, thus satisfying the purpose of "random access read and write".

[0120] 3. IV / Adjustable Parameter Generation: To suppress "ciphertext moving / cut and paste" and offline comparison analysis, this embodiment binds the IV to the address, partition key field, key version, and session. A public implementation path is provided:

[0121] IV(LBA) = Trunc128( SM3( DomainID || KeyVer || SID || LBA ) ).

[0122] In this configuration, LBA is encoded using 8-byte big-endian; DomainID / KeyVer / SID are encoded into fixed-length byte strings according to their respective bit widths and then concatenated. This achieves the following: the same plaintext corresponds to different encryption parameters under different LBAs, different KeyVers, or different SIDs, thereby reducing the benefits of offline relocation and comparison analysis, and making it difficult for attackers to correctly decrypt ciphertext from one sector after it has been moved to another sector.

[0123] In some implementations, an "address segment identifier SegmentID" may be introduced to support the strategy described above of "using different keys or subkeys to identify storage address segments (segments)": SegmentID = ⌊LBA / SegSize⌋ (SegSize is the address segment granularity, in the example, 2^k sectors), and the SegmentID is concatenated into the SM3 input or used to derive subkey identifiers.

[0124] 4. Partial Sector Write and Read-Modify-Write (RMW) Processing: When the data length of the host write request is not an integer multiple of SectorSize or the write offset is not aligned with the sector boundary, the USB storage controller adopts a read-modify-write process: First, it reads the target sector ciphertext from the storage medium and decrypts it using an online engine to obtain the sector plaintext. Then, it overwrites the corresponding offset range with the data written by the host. After that, it re-encrypts the new sector ciphertext according to the IV (LBA) and Kdata in this embodiment and writes it back to the storage medium. This process ensures the consistency of the sector-level ciphertext structure and avoids "plaintext bypass write" caused by alignment issues. (This process is not entered when the target partition is a normal partition or an ISO partition.)

[0125] 5. Key Rotation and Context Cleanup: The national cryptographic security chip supports key rotation at least per KeyVer for the same partition key field. When KeyVer is updated, the security chip marks the old version key as unusable for new writes (allowing read-only compatibility or denying reads is selected by the implementation) and provides the new version of KeyRef to the USB storage controller. Simultaneously, the USB storage controller must clear the encryption context corresponding to the SID or KeyVer (including the online encryption engine key slot / session register, EncCtx cache, IV cache, and data cache for incomplete tasks) when authorization revocation, timeout, or unplugging events occur, thereby avoiding the bypass risk of "decryption continuing after revocation".

[0126] 6. Optional integrity verification tag generation, associated storage, and verification; the online encryption engine can optionally generate an integrity verification value tag for the sector data and associate it with the sector data for storage. During reading, the tag is verified based on SM3 hash or SM4 message authentication code to detect offline tampering. This embodiment provides an achievable "hidden metadata area" associated storage method:

[0127] A hidden metadata area, MetaArea, is reserved in the storage medium to store tags. A metadata sector, MetaSector, is allocated for every N data sectors (N is a positive integer, e.g., N=32 or 64) within the encrypted partition to store the N tags corresponding to these N data sectors. The relative number of a data sector within the partition, Idx = LBA - PartStartLBA, is defined, then the metadata sector number corresponding to that sector is MetaIdx = ⌊Idx / N⌋, and the slot offset within the metadata sector is Slot = Idx mod N. A tag is generated for each data sector and written to the corresponding MetaIdx and Slot position in the MetaArea. For sufficient disclosure, an explicit tag calculation example is given:

[0128] Tag(LBA) = MAC_SM4( Km, DomainID || KeyVer || LBA || Ciphertext(LBA) ).

[0129] Km is the integrity verification key (also provided by the security chip in a controlled manner according to the partition key field or referenced by KeyID), and Ciphertext (LBA) is the ciphertext written to the storage medium for this sector.

[0130] During reading, the USB storage controller first reads the Ciphertext (LBA) and the corresponding Tag, calculates Tag' and compares them; if they do not match, it refuses to output the decrypted data and returns a media error semantic or data verification failure semantic to the host to achieve offline tampering detection.

[0131] V. Secure storage, signature verification, and two-phase commit of policy records, such as Figure 6 As shown, this embodiment provides a secure storage and verification mechanism for policy records. Policy records characterize at least one partition policy or access control policy, and include at least: a policy version number, partition type identifier and default visibility value, read / write permission parameters, authentication method parameters or failure threshold parameters, and an SM3 hash value for the policy record content, as well as an SM2 signature generated by a national cryptographic security chip. The key to this mechanism is that policies are not simply "written in and take effect" on the host side; they must be signed by the security chip and verified by the main controller before taking effect, thereby preventing host malware from tampering with or rolling back partition / visibility / read-only policies. The disclosure also clearly states that private commands are used for partition policy / hiding / read-only control, and security decisions must be authorized by the security chip.

[0132] 1. Policy Record Format: To facilitate signature verification and rollback protection, this embodiment defines the PolicyRecord as having the following structure (example):

[0133] Header: ; Magic: Fixed identifier (e.g., 4-byte "PLCY"); V: Policy version number (32-bit, monotonically increasing); Flags: Status bits (Active / Pending / Invalid, etc., 8 bits); Len: Policy payload length (32 bits); DevID: Device identifier (optional, 64 bits, used for binding to the device); Payload: At least includes a set of parameters such as partition type, default visibility, read / write permissions, authentication method, and failure threshold; H: SM3 hash value, example: H = SM3(Magic || V || Flags || Len || DevID || Payload); Sig: SM2 signature value, example: Sig = SM2_Sign(SK_dev, H), where SK_dev is the non-exportable device private key within the security chip.

[0134] When loading a policy, the USB storage controller performs at least the following checks: Magic check, length boundary check, SM3 recalculation comparison, and SM2 signature verification; if any of these checks fail, the policy record is deemed invalid and will not be applied.

[0135] 2. Hidden Area Primary / Backup Dual-Replica Layout: Policy records are stored in the hidden area of ​​the storage medium and have at least two redundant copies (primary and secondary). Specifically, this can be implemented using two storage slots, Slot-A and Slot-B. Each slot stores a complete PolicyRecord, and an additional fast verification field (such as CRC16 or mirror number) is stored at the top of the slot for quick power-on filtering; however, the final validity is still determined by the SM3 / SM2 verification result.

[0136] 3. Two-phase commit update process: The policy record is updated using a two-phase commit method. In this embodiment, the two-phase commit process can be implemented as follows:

[0137] Phase A (Prepare / Pending): After receiving the "Policy Update" private command request, the USB storage controller forwards the request to the security chip. After the administrator's credentials are verified, the security chip generates and signs a new PolicyRecord (including Vnew). The USB storage controller writes the PolicyRecord to an inactive slot (e.g., if the current active slot is A, write to B) and sets the Flags to Pending. After writing, it can optionally be read back and an SM3 / SM2 check is performed to confirm that the disk was written correctly.

[0138] Phase B (Commit / Active): After a successful Pending write, the USB storage controller requests a "commit confirmation" from the security chip. The security chip performs a consistency check on Vnew, updates its internally maintained monotonic counter or version baseline (ensuring ≥Vnew), and returns a commit confirmation (optionally with a signed receipt). The USB storage controller rewrites the Pending slot Flags to Active, while rewriting the original Active slot Flags to Invalid or retaining them as a backup of the old version, and updates the "active slot pointer".

[0139] Recovery rule (power-on self-healing): Upon power-on, if a pending but not committed copy is detected, the USB storage controller selects the copy that "passes signature verification and has the highest version number that is not lower than the version baseline" as the valid policy from the two copies. If neither copy meets the requirements, security degradation is implemented: only the normal / ISO partition is enumerated and the encrypted partition is not displayed until a valid policy is reissued.

[0140] 4. Version Baseline / Monotonic Counter Anti-Rollback: During startup or policy changes, the USB storage controller only applies the policy record if hash verification and signature verification are completed, and the policy version number is not lower than the monotonic counter or version baseline maintained internally by the security chip. In engineering implementation, the USB storage controller can read the PolicyCtr (monotonic counter) or PolicyBase (version baseline) internally by the security chip through the control channel each time it powers on, and reject lower version policies accordingly. Simultaneously, once a policy is committed by the security chip, the security chip updates PolicyCtr to ≥Vnew, ensuring that "rolling back the old policy file" is still rejected due to insufficient version even after signature verification, thus resisting offline rollback attacks that "replace hidden area content".

[0141] 5. The point at which the policy takes effect on device behavior: Once the policy record takes effect, the USB storage controller updates the partition table / mapping table and access control parameters according to its payload, and links to the following key actions: default visibility and "non-enumerable" behavior of encrypted partitions (e.g., affecting Get Max LUN gating, unauthorized LUN return semantics, etc.); partition read-only policy (it is clearly stated that a certain area can be set to read-only mode through private commands); authentication method and failure threshold parameters (used for FailCnt / freeze / secondary handling policies in Example 6).

[0142] VI. Failure count, freeze period, and Level 2 handling, such as Figure 7 As shown, when fingerprint or password authentication fails, the national cryptographic security chip maintains a failure count FailCnt and a time window parameter Win associated with the user or device identifier. The failure count is stored in the security chip's non-volatile secure storage area and is retained after the device is powered off or removed. When consecutive failures reach a first threshold, a freeze period is entered, and the time for the next authorized authentication is extended using an incremental waiting or exponential backoff method. The freeze period timing is based on the security chip's internal timing or counting source and does not depend on the host system time. A second level of handling is executed when consecutive failures reach a second threshold or when an abnormal reset, control communication interface tampering, or disassembly event is detected. The disclosure also provides optional actions for handling failure thresholds (such as clearing templates, restoring factory settings, freezing, etc.) and the engineering goal of "deleting records and restoring factory settings after multiple verification failures."

[0143] 1. Parameters and state variables: For ease of implementation, the following parameters are defined (example values ​​are for explanation only and are not limited to product parameters):

[0144] FailCnt: Continuous failure count (16 bits); WinLen: Time window length (e.g., 300 s); WinStartTick: Time window start point (internal tick count of the security chip); TickNow: Current value of the internal timing / counting source of the security chip; N1 (first threshold), N2 (second threshold): satisfying N2>N1; BaseWait: Base freeze duration (e.g., 30 s); MaxWait: Maximum freeze duration (e.g., 3600 s); FreezeUntilTick: Freeze expiration tick (maintained on the security chip side); TamperCnt: Tampering / abnormal event count (16 bits, optional); DevID / UserID: Device identifier / user identifier (used for binding FailCnt by person or by device).

[0145] All of the above variables are maintained by the security chip in its non-volatile secure storage area or protected storage area, so that they are retained after power loss / removal.

[0146] 2. Failure Counting and Time Window Update Rules: When an authentication failure occurs, the security chip executes the following logic: If TickNow - WinStartTick > WinLen, then reset the time window: WinStartTick = TickNow, FailCnt = 1; otherwise, FailCnt = FailCnt + 1; write FailCnt and WinStartTick to secure storage; if authentication is successful, FailCnt can be cleared and WinStartTick can be refreshed (selected by policy: clear immediately or clear according to time window decay).

[0147] By using a "time window + power failure retention" mechanism, attackers cannot clear FailCnt by frequently plugging and unplugging the device, thus suppressing brute-force attempts.

[0148] 3. Freeze Period (Soft Handling) and Exponential Backoff Calculation: When FailCnt reaches the first threshold N1 and is less than the second threshold N2, a freeze period is initiated, and incremental waiting or exponential backoff is adopted. This embodiment provides one implementation formula for exponential backoff:

[0149] When FailCnt ≥ N1, the waiting time is frozen.

[0150] Wait(FailCnt) = min( MaxWait, BaseWait × 2^(FailCnt − N1) )

[0151] The setting is: FreezeUntilTick = TickNow + Wait(FailCnt). Before FreezeUntilTick, the security chip refuses to perform new fingerprint / password comparisons and refuses to issue session authorization tokens or key-related information. It can also output a "Frozen" status code to the USB storage controller, keeping the encrypted partition from being enumerated / displayed. Because FreezeUntilTick is calculated based on the security chip's internal timing / counting source and does not depend on the host system time, attackers cannot bypass the freeze by tampering with the host clock.

[0152] 4. Determination of abnormal reset, control communication interface tampering, and disassembly events: When an abnormal reset, control communication interface tampering, or disassembly event is detected, a second-level handling procedure is executed. This embodiment provides an achievable determination method:

[0153] Abnormal Reset: The security chip maintains BootCnt and LastBootTick; if there are multiple power-on / reset events within a very short time Δt (e.g., TickNow-LastBootTick < Δt and BootCnt increments continuously), it is recorded as an abnormal reset event and TamperCnt is accumulated;

[0154] Control communication interface tampering: The control channel frame carries the sequence number seq and the authentication field (MAC or signature). If "message sequence number jump exceeds the threshold", "MAC continuous verification fails", "frame format / baud rate error exceeds the threshold", etc. occur, it is recorded as a tampering event and TamperCnt is accumulated. The briefing also clearly states that control commands must be verified one by one and authorized by the security chip. This can be used to realize a closed loop of tampering detection.

[0155] Disassembly event: Triggered by the anti-tamper switch on the casing, photosensitive / accelerometer trigger, or GPIO anti-tamper input of the security chip (after triggering, it can be locked to an irreversible state or a reversible state that can be unlocked by the administrator, depending on the policy).

[0156] 5. Second-level processing (hard processing) and its action boundaries: When FailCnt reaches the second threshold N2, or TamperCnt reaches the preset threshold, or a disassembly event is detected, the security chip enters the second-level processing. The second-level processing includes at least one of the following: revoking or erasing the SM4 key field of the encrypted logic partition, clearing the fingerprint template or authentication data, restoring the factory reset policy, or requiring administrator credentials to unlock.

[0157] The engineering semantics that each action can achieve:

[0158] Revoke / erase SM4 key field: Force the KeyVer corresponding to DomainID to increment and mark the old KeyVer as disabled, or directly erase the master key material under DomainID, so that the existing encrypted partition data cannot be decrypted by the device (used for anti-theft scenarios); Clear fingerprint template / authentication data: Delete the fingerprint template storage area, password verification value or related salt value / counter, so that re-authentication must go through the administrator recovery process; Restore factory policy: Delete / cancel the policy record of the hidden area and write the factory default policy (e.g., only open the normal area / ISO area, and the encrypted area is not displayed by default); This action is consistent with the goal of "deleting records and restoring factory settings after multiple verification failures" in the briefing; Administrator intervention to unlock: Requires administrator credentials (e.g., administrator password, administrator certificate or unfreezing command signed by SM2) to remove the secondary disposal status and reinitialize the policy and key field.

[0159] Example 2:

[0160] An encryption method based on a national cryptographic security chip and fingerprint authentication is applied to an encrypted USB flash drive. The encrypted USB flash drive includes at least a USB storage controller, a storage medium, an online encryption engine located on the data path between the USB storage controller and the storage medium, a national cryptographic security chip, and a fingerprint acquisition module. The storage medium can be divided into a normal area and at least one encrypted area, and can be further subdivided into a hidden area, an ISO read-only area, a normal area, and multiple encrypted areas. For example, the exchange area and the secret area can be configured with different access control policies and partition key domain identifiers as different encrypted areas. The online encryption engine is used to perform online bidirectional SM4 processing on data belonging to the encrypted area, while data access in the normal area does not enter the online bidirectional SM4 processing flow.

[0161] In this embodiment, the method includes the following steps: First, establish partition identifiers and access policies. Specifically, during the device initialization phase, the USB storage controller or its cooperating management module writes partition policy records for each logical partition. These partition policy records include at least a partition type identifier, a visibility policy, an access control policy, and a partition key field identifier. The partition type identifier distinguishes between ordinary partitions, swap partitions, secret partitions, hidden partitions, or ISO partitions. The visibility policy indicates whether the corresponding partition is allowed to be enumerated, mounted, or displayed by the host in an unauthorized or authorized state. The access control policy indicates the authentication method, allowed read / write actions, read-only attribute, and failure handling rules for the partition. The partition key field identifier uniquely indicates the SM4 data key field corresponding to the partition. Through the above partition identifiers and access policies, the entire storage space is divided into at least an ordinary partition and at least one encrypted partition. The ordinary partition remains always accessible or accessible according to a policy, while the encrypted partition is in a default unauthorized and unavailable state.

[0162] Subsequently, when at least one trigger condition for the encrypted area is detected, the national cryptographic security chip is triggered to perform fingerprint comparison authentication or password authentication in a closed loop within the chip. The trigger conditions include at least: the host requests to enumerate or mount the encrypted area, the host initiates a read / write request for the encrypted area, or the management call requests to open the encrypted area. In one implementation, after receiving a mount request or access request for the target logic unit from the host side, the USB storage controller first freezes the data path of the corresponding encrypted area, does not directly expose the encrypted area to the host, but sends an authorization request to the national cryptographic security chip via the control communication interface. Since the data storage service in the disclosure scheme can be processed asynchronously, while synchronous I / O processing is preferred for the security chip and fingerprint access, a synchronous interaction method is preferred in the authentication stage, that is, after issuing the authentication request, waiting for the security chip to return the authentication result, and then deciding whether to proceed to the subsequent unlocking process.

[0163] After receiving an authorization request, the national cryptographic security chip invokes its internal fingerprint comparison unit or password verification unit to complete authentication. Fingerprint feature acquisition is performed by the fingerprint acquisition module, and fingerprint template comparison or password comparison is preferably performed internally within the security chip to avoid exposing biometric data or authentication passwords in plaintext on the external controller. Upon successful authentication, the national cryptographic security chip generates session authorization information and, based on this information and the partition key field identifier, generates or selects an SM4 data key or key identifier / version corresponding to the encryption zone. It then provides the USB storage controller with controlled key-related information. This controlled key-related information can be a key identifier and key version number, a key package, or a one-time derived key material bound to the current session. This allows the USB storage controller to drive the online encryption engine to establish the corresponding encryption / decryption context without needing to permanently store the partition plaintext key.

[0164] When the session authorization information is valid and the authorization scope covers the target partition, the USB storage controller opens the enumeration, mounting, and read / write paths for the encrypted zone, and performs online bidirectional SM4 processing on the data belonging to the encrypted zone on the data path between the USB storage controller and the storage medium. Specifically, in the write path, plaintext data sent from the host to the encrypted zone first enters the online encryption engine, which encrypts it according to the SM4 encryption context of the current partition before writing it to the storage medium, thus keeping the data written to the disk in the encrypted zone as ciphertext; in the read path, ciphertext data read from the storage medium is first decrypted by the online encryption engine, and then the decrypted plaintext is returned to the host; for data access in the normal zone, the USB storage controller directly performs read / write according to the normal storage process without entering the online bidirectional SM4 processing process.

[0165] When session authorization is revoked, session times out, or the device is unplugged, the USB storage controller disables the mapping of the encrypted area and prevents the encrypted area from being enumerated or displayed. Simultaneously, it clears the session-related key context, restoring the encrypted area to an unauthorized and unusable state. In a preferred embodiment, when consecutive authentication failures reach a preset threshold, the national cryptographic security chip can trigger more stringent security measures, such as erasing relevant session materials, revoking the partition key field, or restoring factory settings, to improve resistance to brute-force attacks and disassembly attacks.

[0166] Furthermore, "preventing the encrypted area from being enumerated / displayed" includes implementing logical unit set gating during the USB mass storage enumeration phase: when responding to a Get Max LUN-specific request when session authorization information is invalid, returning the largest logical unit number that does not contain the logical unit number corresponding to the encrypted area, and returning CHECK CONDITION with additional awareness code information representing "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOT READY" to SCSI transparent commands initiated by the host for logical unit numbers that have not been reported; triggering re-enumeration or Bulk-Only Mass Storage Reset when session authorization information changes from invalid to valid or from valid to invalid, and establishing UnitAttention with additional awareness code "REPORTED LUNS DATA HAS CHANGED" after rediscovery, so as to prompt the host to refresh the logical unit list before presenting or hiding the encrypted area.

[0167] Furthermore, if the host still initiates a SCSI transparent command to an unreported logical unit number based on cached information, historical mount records, or active probing behavior, the USB storage controller returns to the CHECK CONDITION state, carrying additional awareness code information indicating "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOT READY". This maintains consistency in USB mass storage protocol interactions while preventing host retries or unexpected scans caused by simple silent discarding. Simultaneously, upon returning to the aforementioned abnormal state, the USB storage controller does not establish an online encryption context related to the target encrypted area, nor does it trigger read / write processing on the corresponding data path, ensuring that the encrypted area is neither visible nor laterally probed in an unauthorized state.

[0168] In this embodiment, when session authorization information changes from invalid to valid, or from valid to invalid, the USB storage controller triggers a re-enumeration or Bulk-Only Mass Storage Reset to enable the host to rediscover the currently valid set of logical units. Preferably, after rediscovery, the USB storage controller establishes a Unit Attention event with the host and sets the additional awareness code to "REPORTED LUNS DATA HAS CHANGED" to prompt the host to refresh the logical unit list, volume manager status, and mount cache, thereby presenting the encrypted area after authorization and hiding the encrypted area after authorization is revoked. For scenarios with multiple encrypted areas, such as when the swap area and secret area are mapped to different logical units, the USB storage controller can also adjust the reported set of logical units according to the authorization status of different partitions to achieve partition-level visibility control.

[0169] Furthermore, the session authorization information is constructed into a session authorization token, which includes at least one of a session identifier, authorization scope, validity period information, and a random challenge value or a monotonically increasing counter. The national cryptographic security chip performs SM2 signature or SM4-based message authentication code calculation on the session authorization token. Before enumerating / mounting the open encrypted zone, establishing an SM4 encryption context, or processing encrypted zone read / write operations, the USB storage controller verifies the authenticity and freshness of the session authorization token. Subsequently, it carries the session authorization token or derived session key in each sensitive control command related to unlocking, key loading, authorization revocation, or policy adjustment for verification to reject replay or bypass injection control messages.

[0170] Furthermore, in one specific implementation, after fingerprint authentication or password authentication is successful, the USB storage controller first sends an authentication completion notification containing the current target partition identifier and the host-side challenge value to the national cryptographic security chip. The national cryptographic security chip generates the session authorization token based on the challenge value, the current session identifier, the authorization scope, and the validity period, and protects it with an SM2 signature or SM4 message authentication code before returning it to the USB storage controller. Before enumerating / mounting the open encrypted zone, establishing an SM4 encryption context, or processing encrypted zone read / write operations, the USB storage controller first verifies the authenticity and freshness of the session authorization token. Authenticity verification can be completed through signature verification or MAC verification, while freshness verification can be completed by checking whether the validity period has expired, whether the random challenge value matches, and whether a monotonically increasing counter is greater than the previously accepted value. Only when all the above verifications pass will the USB storage controller allow unlocking of the corresponding partition and loading of the corresponding key context.

[0171] Furthermore, the specific structure and usage of the session authorization information are further explained. In this embodiment, the session authorization information is constructed as a session authorization token. The session authorization token includes at least one of the following: a session identifier, an authorization scope, validity period information, and a random challenge value or a monotonically increasing counter. The session identifier is used to uniquely identify the current authentication session. The authorization scope is used to limit the target partition that the token can be applied to, the control actions that can be performed, and the key context types that can be established. The validity period information is used to limit the lifespan of the token. The random challenge value or monotonically increasing counter is used to provide freshness constraints and suppress replay attacks. The national cryptographic security chip performs SM2 signature or SM4-based message authentication code calculation on the session authorization token so that the USB storage controller can verify the source, integrity, and timeliness of the token in subsequent control links.

[0172] In this embodiment, each sensitive control command related to unlocking, key loading, authorization revocation, or policy adjustment is verified one by one, carrying the session authorization token or derived session key. That is, the USB storage controller and the national cryptographic security chip do not assume all subsequent control commands are trusted after the initial authentication; instead, each sensitive control message is bound to the current session identity. Thus, when an external attacker attempts to replay historical messages, tamper with partition parameters, or bypass authentication to directly request key loading, the USB storage controller and the national cryptographic security chip will refuse to execute the corresponding action because the relevant control messages cannot pass the token authenticity and freshness verification, thereby reducing the risk of unauthorized unlocking due to replay attacks and side-channel injection. For policy adjustment commands in management scenarios, the authorization scope can be further required to include a management permission flag to distinguish between ordinary user sessions and administrator sessions.

[0173] Furthermore, the "online bidirectional SM4 processing" performs sector-level encryption and decryption in the encrypted area using sectors as data units, and generates an initialization vector or adjustable parameter associated with the logical block address (LBA) when performing SM4 encryption and decryption on each sector. The initialization vector or adjustable parameter is determined by at least two of the LBA, partition key field identifier, key version number, and session identifier. The national cryptographic security chip maintains the key version number according to the partition key field identifier and supports rotating the key version under session switching or preset conditions. The USB storage controller clears the encryption context corresponding to the session identifier or key version number when the authorization is revoked.

[0174] Furthermore, the sector-level implementation of the "online bidirectional SM4 processing" is further explained. In this embodiment, data access to the encrypted area is performed online encryption and decryption using sectors as data units. For any target sector to be written, the USB storage controller generates an initialization vector or adjustable parameters associated with the logical block address based on the partition key field identifier, current key version number, current session identifier, and logical block address (LBA) of the current sector. Then, the plaintext of the sector is input into the online encryption engine, which performs sector-level encryption based on the initialization vector or adjustable parameters and the corresponding SM4 data key, and writes the resulting ciphertext to the storage medium. For any target sector to be read, the USB storage controller reads the corresponding ciphertext, inputs it into the online encryption engine, performs sector-level decryption based on the same initialization vector or adjustable parameters as during writing, and then returns the resulting plaintext to the host. Since the initialization vector or adjustable parameter is determined by at least two of the LBA, partition key field identifier, key version number, and session identifier, even if the plaintext content is the same, the corresponding encryption result will be different as long as the sector address, key version, or session is different. This helps to suppress ciphertext transfer and offline comparison analysis.

[0175] In a preferred implementation, the initialization vector can be generated as follows: concatenate the partition key domain identifier DomainID, key version number KeyVer, session identifier SID and logical block address LBA, perform SM3 hashing on the concatenation result, and then truncate the first 128 bits as the initialization vector of the current sector, i.e.: IV(LBA)=Trunc128(SM3(DomainID∥KeyVer∥SID∥LBA)).

[0176] In this method, LBA uses fixed-length encoding for computation, with DomainID, KeyVer, and SID represented as fixed-length byte strings. This approach ensures that the initialization vector is simultaneously bound to the partition, version, session, and address, guaranteeing the distinctiveness of sector encryption parameters across different address spaces and authorized sessions.

[0177] In this embodiment, the national cryptographic security chip maintains the key version number according to the partition key field identifier and supports rotating the key version under session switching or preset conditions. For example, after an administrator executes a key rotation command, a user identity changes, a preset time window is reached, a preset number of writes is reached, or a potential security event is detected, the national cryptographic security chip updates the key version number of the target partition from the old version to the new version, and generates or selects the corresponding SM4 data key based on the new version. After receiving the new key version information, the USB storage controller establishes an encryption context corresponding to the new version; when authorization is revoked, the USB storage controller clears the encryption context corresponding to the session identifier or key version number, including but not limited to the session register, cached key packet, sector parameter cache, and derived intermediate values ​​in the online encryption engine, to prevent the old context from continuing to be used after authorization termination.

[0178] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An encrypted USB flash drive system based on a national cryptographic security chip and fingerprint authentication, characterized in that, It includes a USB interface, a USB storage controller, a storage medium, an online encryption module, a national cryptographic security chip, a fingerprint acquisition module, and a control communication interface; the data path between the USB storage controller and the storage medium is connected via the online encryption module, which is used to perform SM4 symmetric encryption and decryption on the data stream corresponding to at least one encrypted logical partition; The USB storage controller is used to maintain partition information including the normal logical partition and the encrypted logical partition, and to prevent the encrypted logical partition from being enumerated or displayed to the host side when session authorization information is not obtained. When the USB storage controller detects an enumeration / mount request or read / write access request from the host for the encrypted logical partition, it initiates an authorization request to the national cryptographic security chip through the control communication interface. The national cryptographic security chip is used to receive the fingerprint features collected by the fingerprint acquisition module and complete the comparison and authentication within the chip. Based on the authentication result, it generates session authorization information and generates or selects the SM4 data key or key identifier corresponding to the encryption logic partition according to the partition key field identifier. It outputs key-related information for driving the online encryption module to the USB storage controller in a controlled manner. The USB storage controller is used to open the mapping / enumeration of the encrypted logical partition and allow data reading and writing to the encrypted logical partition when the session authorization information is valid. At the same time, it controls the online encryption module to perform SM4 encryption on the data written to the encrypted logical partition and write the ciphertext to the storage medium, and to perform SM4 decryption on the ciphertext read from the storage medium and return it to the host. When a session authorization is revoked, a session times out, or a USB flash drive is removed, the USB storage controller disables the mapping / enumeration of the encrypted logical partition and clears the session key context.

2. The encrypted USB flash drive system based on national cryptographic security chip and fingerprint authentication according to claim 1, characterized in that, The USB storage controller is configured to present only at least one unencrypted logical unit to the host side and suppress the enumerability of encrypted logical partitions when session authorization information is invalid, the suppression including at least one of the following: When responding to a specific request from the Get Max LUN class of the USB mass storage class, return the maximum logical unit number that does not include the logical unit number corresponding to the encrypted logical partition; For SCSI transparent commands initiated by the host side with non-existent or unauthorized logical unit numbers, the default CHECKCONDITION is returned, along with additional awareness code information corresponding to "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOT READY", without triggering the data path of the online encryption engine. And when the session authorization information changes from invalid to valid or from valid to invalid, USB re-enumeration is triggered and the maximum logical unit number is updated after re-enumeration. At the same time, a Unit Attention of "REPORTED LUNS DATA HAS CHANGED" is reported to the host to prompt the host to rediscover the logical unit.

3. The encrypted USB flash drive system based on national cryptographic security chip and fingerprint authentication according to claim 1, characterized in that, The national cryptographic security chip generates a session authorization token after fingerprint authentication or password authentication is successful. The session authorization token includes at least a session identifier, an authorization partition identifier or authorization level, validity period information, and a random challenge value or a monotonically increasing counter. The national cryptographic security chip performs integrity and source authentication on the session authorization token based on SM2 digital signature or SM4 message authentication code. The USB storage controller is configured to allow the execution of at least one operation related to the encrypted logical partition only after verifying the authenticity and freshness of the session authorization token: opening encrypted logical partition enumeration, establishing an encryption engine key context, or executing read / write commands on the encrypted logical partition. All control commands transmitted on the control communication interface related to unlocking, key loading, or policy adjustment must carry the session authorization token or its derived session key for verification.

4. The encrypted USB flash drive system based on national cryptographic security chip and fingerprint authentication according to claim 1, characterized in that, The online encryption engine performs online bidirectional encryption and decryption based on SM4 for the data in the encrypted logical partition, using sectors as data units. In order to satisfy random access read and write and suppress ciphertext shifting attacks, the online encryption engine generates an initialization vector or adjustable parameters associated with the logical block address LBA for each sector. The initialization vector or adjustable parameters are determined by at least one or more of the following fields: logical block address LBA, partition key field identifier, key version number, and session identifier. The national cryptographic security chip supports key rotation based on key version number for the same partition key field, and the USB storage controller clears the encryption context corresponding to the session identifier or key version number when authorization is revoked. The online encryption engine is also configured to optionally generate an integrity check value for the sector data and store it in association with the sector data. When reading, the integrity check value is verified based on an SM3 hash or an SM4 message authentication code to detect offline tampering.

5. The encrypted USB flash drive system based on national cryptographic security chip and fingerprint authentication according to claim 1, characterized in that, It also includes a secure storage and verification mechanism for policy records, wherein the policy records are used to represent at least one partition policy or access control policy. The policy records include at least a policy version number, partition type identifier and visibility default value, read and write permission parameters, authentication method parameters or failure threshold parameters, and include an SM3 hash value of the policy record content and an SM2 signature generated by the national cryptographic security chip. The policy record is stored in the hidden area of ​​the storage medium and has at least two redundant copies, a primary and a secondary copy. It is updated using a two-phase commit method. The USB storage controller applies the policy record only when hash verification and signature verification are completed, and the policy version number is not lower than the monotonic counter or version baseline maintained internally by the security chip, during startup or policy change.

6. The encrypted USB flash drive system based on national cryptographic security chip and fingerprint authentication according to claim 1, characterized in that, The national cryptographic security chip is configured to maintain a failure count and time window parameters associated with the user identifier or device identifier when fingerprint authentication or password authentication fails. The failure count is stored in the non-volatile secure storage area of ​​the security chip and is maintained after the device is powered off or unplugged. When consecutive failures reach a first threshold, a freeze period is entered and the time for the next allowed authentication is extended by incremental waiting or exponential backoff. The freeze period timing is based on the internal timing or counting source of the security chip and does not depend on the host system time. Upon continuous failures reaching the second threshold or detection of abnormal reset, control communication interface tampering, or disassembly events, a second-level procedure is executed. The second-level procedure includes at least one of the following: revoking or erasing the SM4 key field of the encrypted logic partition, clearing the fingerprint template or authentication data, restoring the factory reset policy, or requiring administrator credentials to intervene and unlock.

7. An encryption method based on a national cryptographic security chip and fingerprint authentication, executed in an encrypted USB flash drive comprising a USB storage controller, a storage medium, an online encryption engine located on the data path between the USB storage controller and the storage medium, a national cryptographic security chip, and a fingerprint acquisition module, characterized in that, include: Establish partition identifiers and access policies, which include at least partition type identifiers, visibility policies, access control policies, and partition key field identifiers, and divide the storage space into at least a normal area and at least one encrypted area; When at least one triggering condition for the encrypted area is detected, the national cryptographic security chip is triggered to perform fingerprint comparison authentication or password authentication in a closed loop within the chip. The triggering conditions include at least: the host requests to enumerate / mount the encrypted area, the host initiates read / write operations on the encrypted area, or the management call requests to open the encrypted area. Upon successful authentication, the national cryptographic security chip generates session authorization information and generates or selects an SM4 data key or key identifier / version corresponding to the encrypted area based on the session authorization information and the partition key field identifier, and provides the USB storage controller with key-related information for controlled use. Only when the session authorization information is valid and the authorization scope covers the target partition, the enumeration / mounting and read / write paths of the encrypted zone are opened, and online bidirectional SM4 processing is performed on the data belonging to the encrypted zone on the data path between the USB storage controller and the storage medium. This includes: the write path encrypts the written data with SM4 and writes it to the storage medium, and the read path decrypts the ciphertext read from the storage medium with SM4 and returns it to the host, so that the data written to the disk in the encrypted zone is ciphertext. When a session authorization is revoked, a session times out, or a device is unplugged, the mapping of the encrypted area is turned off and the encrypted area is prevented from being enumerated / displayed. At the same time, the session-related key context is cleared, and the encrypted area is restored to an unauthorized and unavailable state. Specifically, data access to the ordinary area does not enter the online bidirectional SM4 processing flow.

8. The encryption method based on national cryptographic security chip and fingerprint authentication according to claim 7, characterized in that, The "preventing the encrypted zone from being enumerated / displayed" includes implementing logical unit set gating during the USB mass storage enumeration phase: when responding to a Get Max LUN-specific request when session authorization information is invalid, returning the largest logical unit number that does not contain the logical unit number corresponding to the encrypted zone, and returning CHECK CONDITION with additional awareness code information representing "LOGICAL UNIT NOT SUPPORTED" or "LOGICAL UNIT NOTREADY" to SCSI transparent commands initiated by the host for logical unit numbers that have not been reported; triggering re-enumeration or Bulk-Only Mass Storage Reset when session authorization information changes from invalid to valid or from valid to invalid, and establishing Unit Attention with additional awareness code "REPORTED LUNS DATA HAS CHANGED" after rediscovery, so as to prompt the host to refresh the logical unit list before presenting or hiding the encrypted zone.

9. The encryption method based on national cryptographic security chip and fingerprint authentication according to claim 7, characterized in that, The session authorization information is constructed into a session authorization token, which includes at least one of a session identifier, authorization scope, validity period information, and a random challenge value or a monotonically increasing counter. The national cryptographic security chip performs SM2 signature or SM4-based message authentication code calculation on the session authorization token. Before enumerating / mounting the open encrypted zone, establishing an SM4 encryption context, or processing encrypted zone read / write operations, the USB storage controller verifies the authenticity and freshness of the session authorization token. Subsequently, it carries the session authorization token or derived session key in each sensitive control command related to unlocking, key loading, authorization revocation, or policy adjustment for verification to reject replay or bypass injection control messages.

10. The encryption method based on national cryptographic security chip and fingerprint authentication according to any one of claims 7-9, characterized in that, The "online bidirectional SM4 processing" performs sector-level encryption and decryption in the encrypted area using sectors as data units, and generates an initialization vector or adjustable parameter associated with the logical block address (LBA) when performing SM4 encryption and decryption on each sector. The initialization vector or adjustable parameter is determined by at least two of the LBA, partition key field identifier, key version number, and session identifier. The national cryptographic security chip maintains the key version number according to the partition key field identifier and supports rotating the key version under session switching or preset conditions. The USB storage controller clears the encryption context corresponding to the session identifier or key version number when the authorization is revoked.

Images