A security method and system for cloud server accessing solid state disk based on national secret

Abstract

This invention relates to the field of information security technology, and in particular provides a secure method and system for accessing solid-state drives (SSDs) from cloud servers based on Chinese national cryptographic standards. The method includes generating a pre-set public-private key pair using Chinese national cryptographic standards; generating a dynamic access token containing a timestamp and a random number based on an access request; signing the dynamic access token using the private key of the cloud management platform using Chinese national cryptographic standards; forwarding the received first signature information and access instruction to the SSD; encrypting the user's identity information and current state measurement value using the session key to obtain identity response data; and sending the identity response data carrying the second signature information to the cloud management platform. This invention features a dynamic key generation mechanism combined with mathematical optimization, achieving a leap from static access control to dynamic intelligent defense, and greatly improving the proactive security protection capabilities of cloud server storage systems.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a secure method and system for accessing solid-state drives from a cloud server based on Chinese cryptographic standards. Background Technology

[0002] With the deep integration of cloud computing, big data, and artificial intelligence technologies, data centers have become the foundation of the digital economy. Solid-state drives (SSDs), with their superior I / O performance, have become a core component of cloud server storage architectures. However, the openness, multi-tenant sharing, and separation of physical devices from logical resources inherent in cloud environments present unprecedented security challenges to stored data.

[0003] Prior art 1, Chinese Patent Application No. CN201010113701.8, discloses a method, device, and solid-state drive (SSD) for secure access control. The method includes: decrypting a stored session key based on a user-input password to obtain a decrypted session key, wherein the stored session key is a session key encrypted using the user's password against the original session key; converting the decrypted session key into a second irreversible ciphertext according to a preset encryption algorithm; determining that the user-input password is correct when the second irreversible ciphertext matches the stored first irreversible ciphertext, wherein the first irreversible ciphertext is the ciphertext encrypted using the preset encryption algorithm against the original session key. This invention effectively prevents attackers from obtaining the user's password and the SSD's session key during user authentication, ensuring the security and reliability of the SSD. Prior art two, Chinese patent application number CN201810465371.5, discloses a secure access control method based on a secure encrypted solid-state drive (SSD) and a BIOS chip. This method combines user roles, the secure encrypted SSD, and a PC. It protects SSD data at the firmware level through authorization authentication and records log information through a hidden area on the SSD. This log information cannot be manually modified, ensuring the traceability of data operations and strengthening control over data access. Furthermore, it updates the BIOS program by updating the BIOS upgrade program within the SSD instead of directly updating the BIOS bootloader, ensuring security and maintainability. All sensitive information and security controls are implemented at the firmware level of the SSD's main control chip, resulting in a higher level of security. This solution is suitable for extensive cooperation with BIOS manufacturers and can be extended to fields and industries with high data sensitivity. Prior art three, Chinese patent application number CN202210066352.1, discloses a security authentication method for a solid-state drive (SSD) and an SSD. The method includes: after detecting a connection with a terminal device, acquiring the current time value corresponding to locally recorded clock data to obtain a reference time value; generating at least two time values ​​of different sizes based on the reference time value; generating a verification reference value corresponding to each time value to obtain at least two verification reference values; if the received verification value generated by the terminal device is the same as one of the at least two verification reference values, then allowing the terminal device to access the SSD; Currently, existing technologies 1, 2, and 3 employ general encryption algorithms, failing to comply with national commercial cryptography management policies and thus failing to meet the compliance requirements of my country's Cryptography Law and the Cybersecurity Classified Protection 2.0 standard, which mandates the use of national cryptographic algorithms (SM2 / SM3 / SM4 / SM9, etc.) for critical information infrastructure. Secondly, passive defense is inadequate. Existing log recording and time verification mechanisms are essentially passive defense strategies, lacking real-time intelligent analysis capabilities for access behavior. In today's era of rampant Advanced Persistent Threats (APTs), attackers often exploit legitimate credentials for penetration, making it difficult for traditional rule-based or static matching-based defenses to identify such "malicious behavior disguised as legitimate." Finally, cloud-based collaborative security is insufficient. Existing technologies have not fully addressed the challenge of establishing a highly secure, dynamically encrypted channel between the cloud management platform and remote physical solid-state drives, particularly lacking forward-looking designs to resist quantum computing during key negotiation. Therefore, this invention provides a secure method and system for accessing solid-state drives from a cloud server based on national cryptographic standards. Summary of the Invention

[0004] To achieve the above objectives, the present invention adopts the following technical solution: One aspect of the present invention provides a secure method for accessing solid-state drives (SSDs) from a cloud server based on national cryptographic standards. This method is applied to the secure access control process in a cloud server system, which includes a cloud management platform, computing nodes, and SSDs mounted on the computing nodes. The method comprises the following steps: After power-on initialization, the solid-state drive generates a pre-set national cryptographic public-private key pair and stores the national cryptographic private key through the hardware security module HSM. At the same time, it sends the national cryptographic public key and a digital certificate containing the solid-state drive's unique identifier to the cloud management platform for registration. When an access request is received from a tenant, a dynamic access token containing a timestamp and a random number is generated based on the access request. The dynamic access token is then signed using the national cryptographic private key of the cloud management platform to obtain first signature information. The first signature information and the access instruction are then sent to the computing node. The received first signature information and access instruction are forwarded to the solid-state drive; The first signature information is verified using the pre-set national cryptographic public key of the cloud management platform. If the verification is successful, the dynamic access token is parsed, and the timestamp and random number in the token are verified to be within the preset valid range. If the verification passes, the solid-state drive generates a session key using the SM3 hash algorithm based on the dynamic access token and local hardware feature parameters, and uses the session key to encrypt its own identity information and current state metric to obtain identity response data; at the same time, the solid-state drive uses its own national cryptographic private key to perform digest signing on the identity response data to obtain second signature information, and sends the identity response data carrying the second signature information to the cloud management platform. The second signature information is verified using the national cryptographic public key of the registered solid-state drive. If the verification is successful and the identity information matches, two-way identity authentication is completed and an encrypted communication channel is established.

[0005] In one optional implementation, the digital certificate generation process includes: The solid-state drive uses the SM2 elliptic curve public-key cryptography algorithm to generate public-private key pairs. Construct a Certificate Signing Request (CSR) containing the solid-state drive serial number, manufacturer information, and public key; The cloud management platform receives the CSR and issues a digital certificate conforming to the X.509 standard based on the built-in root certificate. The issued digital certificate is then distributed to the solid-state drive and stored in a protected partition.

[0006] In one optional implementation, the specific process of generating a session key using the SM3 hash algorithm is as follows: Extract the timestamp, random number, and operation permission level from the dynamic access token; Read the hardware fingerprint generated by the Physically Unclonable Function (PUF) within the solid-state drive; The timestamp, random number, operation permission level, and hardware fingerprint are concatenated to form a key generation factor; The key generation factor is hashed using the SM3 algorithm, and the first 256 bits of the result are taken as the session key for this session.

[0007] In one optional implementation, verifying whether the timestamp and random number in the token are within a preset valid range specifically includes: Parse the dynamic access token to obtain the token generation timestamp; Get the current local time of the solid-state drive and calculate the time difference between the current local time and the token generation timestamp; Determine whether the time difference is less than a preset time threshold and whether the random number has not been used within a preset time window; If so, it is considered valid; otherwise, access is denied.

[0008] In an optional implementation, a data access control step is also included: The cloud management platform generates a corresponding access control list (ACL) based on the authentication result. The ACL contains the allowed logical block address (LBA) range and operation type. The cloud management platform uses the SM4 block cipher algorithm to encrypt the access control list with the session key and sends it to the solid-state drive; After the solid-state drive is decrypted, it will only respond to the access control list if the received read / write command satisfies the restrictions of the access control list. Abnormal behavior auditing steps: The solid-state drive monitors all access commands in real time and generates audit logs by recording illegal access commands, illegal tampering attempts, and authentication failures. The audit logs are encrypted and stored in a hidden partition of the solid-state drive using the SM4 algorithm; The encrypted audit logs are uploaded to the cloud management platform at regular intervals. The cloud management platform uses a dedicated audit key to decrypt and analyze potential security threats.

[0009] In one optional implementation, after establishing an encrypted communication channel, the data transmission process includes: The sender divides the data to be transmitted into fixed-length data blocks; Each data block is encrypted using the SM4 algorithm and a message authentication code based on the SM3 algorithm is added to each data block. After receiving the data, the receiver first uses the message authentication code to verify the integrity of the data, and then uses the session key to decrypt the data after the verification is successful. Key hot update mechanism: The cloud management platform monitors the communication duration or data transmission volume, and when the preset threshold is reached, it sends a key update request to the solid-state drive. A new session key is generated through negotiation, and the old session key is used to encrypt the transmission of the new session key; After the update is complete, destroy the old session key.

[0010] In one optional implementation, the AI ​​security analysis module calculates a risk probability value. The process specifically includes: Map the feature vector V to the token sequence of the model input. ; A multi-layer attention mechanism is used to capture long-range dependencies between data access requests, and a contextual feature representation H is calculated. The anomaly probability is output through the Sigmoid activation function and dynamically corrected by combining it with the time decay factor λ(t). The calculation formula is as follows: ,in, Here, W and b are the model weight parameters, and λ is the time sensitivity coefficient. The time of the last legal operation. The information entropy of the feature vector V is used to characterize the degree of randomness of the access pattern, and β is the weight adjustment coefficient. Session key The generation incorporates the real-time environmental entropy value output by the AI ​​analysis module to enhance resistance to replay attacks. The specific generation formula is as follows: ,in, This is the shared key calculated using the elliptic curve key exchange algorithm. and Random numbers generated by the cloud management platform and the solid-state drive, respectively. This is the hash value calculated by the AI ​​security analysis module for the current cloud environment context state. || represents a data concatenation operation. This is a national cryptographic hash algorithm.

[0011] Another aspect of the present invention provides a secure system for accessing solid-state drives from a cloud server based on Chinese cryptographic standards, characterized in that it includes a cloud server security management terminal, a network transmission link, and a solid-state drive terminal configured with a Chinese cryptographic security module. The cloud server security management terminal is used to deploy the national cryptographic SM2 algorithm key pair, and is responsible for initiating access requests, performing two-way identity authentication with the solid-state drive terminal based on the national cryptographic algorithm, and generating dynamic session keys through the key negotiation algorithm; The network transmission link is used to carry encrypted interactive data between the cloud server security management terminal and the solid-state drive terminal. All transmitted control commands and business data are encrypted and encapsulated based on the negotiated session key. The solid-state drive equipped with the national cryptographic security module is used to pre-set the national cryptographic SM2 hardware key and sensitive data protection zone, and is responsible for responding to access requests from the cloud server, verifying the integrity of instructions using the SM3 algorithm, encrypting and decrypting data using the SM4 algorithm, and establishing a trusted secure access channel after authentication.

[0012] In another aspect, the present invention provides an electronic device comprising: At least one memory stores computer-executable instructions non-transiently; At least one processor, configured to run the computer-executable instructions, The computer-executable instructions are executed by the processor to implement the aforementioned secure method for accessing a solid-state drive based on national cryptographic standards from a cloud server.

[0013] In another aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by at least one processor, implement the aforementioned secure method for accessing a solid-state drive based on national cryptographic standards from a cloud server. This invention generates a pre-set national cryptographic public-private key pair after the solid-state drive (SSD) is powered on and initialized. The private key is stored via a hardware security module (HSM), while the public key and a digital certificate containing the SSD's unique identifier are sent to the cloud management platform for registration. Upon receiving an access request from a tenant, a dynamic access token containing a timestamp and a random number is generated based on the request. The dynamic access token is then signed using the cloud management platform's national cryptographic private key to obtain first signature information. This first signature information and an access instruction are sent to the computing node. The received first signature information and access instruction are forwarded to the SSD. The first signature information is verified using the pre-set cloud management platform's national cryptographic public key. If verification is successful, the dynamic access token is parsed, and the timestamp and random number in the token are checked for being within a preset valid range. If the verification passes, the SSD executes the dynamic access request according to the specified parameters. The access token and local hardware characteristic parameters are used to generate a session key using the SM3 hash algorithm. This session key is then used to encrypt the user's identity information and current state metric to obtain identity response data. Simultaneously, the solid-state drive (SSD) uses its own national cryptographic private key to perform a digest signature on the identity response data, obtaining a second signature. The identity response data carrying the second signature is then sent to the cloud management platform. The registered national cryptographic public key of the SSD is used to verify the second signature. If the verification is successful and the identity information matches, two-way authentication is completed, and an encrypted communication channel is established. This invention introduces a national cryptographic algorithm system to ensure compliance and creatively incorporates an AI large-scale model for multi-dimensional risk assessment of access behavior. Combined with a mathematically optimized dynamic key generation mechanism, it achieves a leap from static access control to dynamic intelligent defense, greatly enhancing the proactive security protection capabilities of the cloud server storage system. Attached Figure Description

[0014] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a secure method for accessing a solid-state drive from a cloud server based on Chinese cryptographic standards, provided in Embodiment 1 of the present invention. Figure 2 This is a framework diagram of a secure system for accessing a solid-state drive from a cloud server based on Chinese cryptographic standards, provided in Embodiment 3 of the present invention. Figure 3 This is a block diagram of the electronic device provided in Embodiment 4 of the present invention; Figure 4 This is a block diagram of a computer-readable storage medium provided in Embodiment 4 of the present invention. Detailed Implementation

[0015] The technical solutions of the present invention will now be described with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0016] Hereinafter, the terms "first," "second," etc., are used for descriptive convenience only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0017] In this invention, unless otherwise explicitly specified and limited, the term "connection" should be interpreted broadly. For example, "connection" can be a fixed mechanical connection, a detachable mechanical connection, or an integral part; or, "connection" can be a direct connection or an indirect connection through an intermediate medium. Furthermore, unless otherwise explicitly specified and limited, the term "coupling" should be interpreted broadly. For example, "coupling" can be a direct electrical connection, such as physical contact and electrical conduction between two components; it can also be understood as an electrical connection between different components in a circuit structure through physical lines capable of transmitting electrical signals, such as copper foil or wires on a printed circuit board (PCB), to transmit electrical signals; or, "coupling" can be an indirect electrical connection between two components through an intermediate medium; or, "coupling" can be an electrical connection between two components in a non-contact manner, such as an electrical connection between two components using capacitive coupling to transmit electrical signals.

[0018] In this embodiment of the invention, directional terms such as "up," "down," "left," and "right" may be defined relative to the orientation of the components shown in the accompanying drawings. It should be understood that these directional terms can be relative concepts, used for relative description and clarification, and can change accordingly depending on the orientation of the components in the accompanying drawings. Example

[0019] like Figure 1As shown, this embodiment of the invention provides a secure method for accessing solid-state drives (SSDs) from a cloud server based on national cryptographic standards. This method is applied to the secure access control process in a cloud server system, which includes a cloud management platform, computing nodes, and SSDs mounted on the computing nodes. The method comprises the following steps: Step S100: After the solid-state drive is powered on and initialized, it generates a pre-set national cryptographic public and private key pair, stores the national cryptographic private key through the hardware security module HSM, and sends the national cryptographic public key and a digital certificate containing the unique identifier of the solid-state drive to the cloud management platform for registration. Step S200: When an access request is received from the tenant, a dynamic access token containing a timestamp and a random number is generated according to the access request, and the dynamic access token is signed using the national cryptographic private key of the cloud management platform to obtain the first signature information. The first signature information and the access instruction are then sent to the computing node. Step S300: Forward the received first signature information and access instruction to the solid-state drive; Step S400: Verify the first signature information using the preset national cryptographic public key of the cloud management platform. If the verification is successful, parse the dynamic access token and verify whether the timestamp and random number in the token are within the preset valid range. If the verification passes, the solid-state drive generates a session key using the SM3 hash algorithm based on the dynamic access token and local hardware feature parameters, and uses the session key to encrypt its own identity information and current state metric to obtain identity response data; at the same time, the solid-state drive uses its own national cryptographic private key to perform digest signing on the identity response data to obtain second signature information, and sends the identity response data carrying the second signature information to the cloud management platform. Step S500: Use the national cryptographic public key of the registered solid-state drive to verify the second signature information. If the verification is successful and the identity information matches, then two-way identity authentication is completed and an encrypted communication channel is established.

[0020] In the above embodiments, identity registration and trust root establishment are as follows: Solid-state drives (SSDs) are pre-installed with a public-private key pair (PKSSD, SKSSD) based on the SM2 algorithm at the factory, and the public key PKSSD and the device's unique identifier IDSSD are registered with the cloud management platform; the cloud management platform also deploys the national cryptographic SM2 server key pair. Two-way authentication and session key negotiation: The cloud management platform initiates an access request to the solid-state drive. Both parties perform two-way authentication based on the SM2 algorithm and the Elliptic Curve Diffie-Hellman Key Exchange Protocol (ECDH), and negotiate to generate a session key Ksession for encrypted data transmission. Data collection and preprocessing based on behavioral characteristics: When a solid-state drive receives a read / write command, it extracts an access feature vector V, which includes an operation timestamp, IP address, access frequency, data request size, and the correlation of historical operation context. The solid-state drive uses the session key Ksession to encrypt the feature vector V using the SM4 algorithm and then sends it to the AI ​​security analysis module. Risk assessment based on large AI models: The AI ​​security analysis module has a built-in large language behavior analysis model based on the Transformer architecture. This model receives the decrypted feature vector V and combines it with the historical knowledge base to calculate the risk probability value Prisk of the current access behavior. If the Prisk exceeds the preset security threshold δ, the access behavior is determined to be abnormal and a blocking command is generated; otherwise, a pass token is generated. Access control enforcement: The solid-state drive receives and verifies the command results returned by the AI ​​security analysis module. If it is a pass token, it performs read and write operations; if it is a blocking command, it locks the relevant logical partition and records the security audit log. Example

[0021] like Figure 1 As shown, based on Embodiment 1, the steps provided in this embodiment of the invention include the generation process of the digital certificate, which includes: The solid-state drive uses the SM2 elliptic curve public-key cryptography algorithm to generate public-private key pairs. Construct a Certificate Signing Request (CSR) containing the solid-state drive serial number, manufacturer information, and public key; The cloud management platform receives the CSR and issues a digital certificate conforming to the X.509 standard based on the built-in root certificate. The issued digital certificate is then distributed to the solid-state drive and stored in a protected partition.

[0022] In one optional implementation, the specific process of generating a session key using the SM3 hash algorithm is as follows: Extract the timestamp, random number, and operation permission level from the dynamic access token; Read the hardware fingerprint generated by the Physically Unclonable Function (PUF) within the solid-state drive; The timestamp, random number, operation permission level, and hardware fingerprint are concatenated to form a key generation factor; The key generation factor is hashed using the SM3 algorithm, and the first 256 bits of the result are taken as the session key for this session.

[0023] In one optional implementation, verifying whether the timestamp and random number in the token are within a preset valid range specifically includes: Parse the dynamic access token to obtain the token generation timestamp; Get the current local time of the solid-state drive and calculate the time difference between the current local time and the token generation timestamp; Determine whether the time difference is less than a preset time threshold and whether the random number has not been used within a preset time window; If so, it is considered valid; otherwise, access is denied.

[0024] In an optional implementation, a data access control step is also included: The cloud management platform generates a corresponding access control list (ACL) based on the authentication result. The ACL contains the allowed logical block address (LBA) range and operation type. The cloud management platform uses the SM4 block cipher algorithm to encrypt the access control list with the session key and sends it to the solid-state drive; After the solid-state drive is decrypted, it will only respond to the access control list if the received read / write command satisfies the restrictions of the access control list. Abnormal behavior auditing steps: The solid-state drive monitors all access commands in real time and generates audit logs by recording illegal access commands, illegal tampering attempts, and authentication failures. The audit logs are encrypted and stored in a hidden partition of the solid-state drive using the SM4 algorithm; The encrypted audit logs are uploaded to the cloud management platform at regular intervals. The cloud management platform uses a dedicated audit key to decrypt and analyze potential security threats.

[0025] In one optional implementation, after establishing an encrypted communication channel, the data transmission process includes: The sender divides the data to be transmitted into fixed-length data blocks; Each data block is encrypted using the SM4 algorithm and a message authentication code based on the SM3 algorithm is added to each data block. After receiving the data, the receiver first uses the message authentication code to verify the integrity of the data, and then uses the session key to decrypt the data after the verification is successful. Key hot update mechanism: The cloud management platform monitors the communication duration or data transmission volume, and when the preset threshold is reached, it sends a key update request to the solid-state drive. A new session key is generated through negotiation, and the old session key is used to encrypt the transmission of the new session key; After the update is complete, destroy the old session key.

[0026] In one optional implementation, the AI ​​security analysis module calculates a risk probability value. The process specifically includes: Map the feature vector V to the token sequence of the model input. ; A multi-layer attention mechanism is used to capture long-range dependencies between data access requests, and a contextual feature representation H is calculated. The anomaly probability is output through the Sigmoid activation function and dynamically corrected by combining it with the time decay factor λ(t). The calculation formula is as follows:

[0027] in, Here, W and b are the model weight parameters, and λ is the time sensitivity coefficient. The time of the last legal operation. The information entropy of the feature vector V is used to characterize the degree of randomness of the access pattern, and β is the weight adjustment coefficient. Session key The generation incorporates the real-time environmental entropy value output by the AI ​​analysis module to enhance resistance to replay attacks. The specific generation formula is as follows: ,in, This is the shared key calculated using the elliptic curve key exchange algorithm. and Random numbers generated by the cloud management platform and the solid-state drive, respectively. This is the hash value calculated by the AI ​​security analysis module for the current cloud environment context state. || represents a data concatenation operation. This is a national cryptographic hash algorithm.

[0028] In the above embodiments, the cloud server is equipped with a national cryptographic security gateway, and the solid-state drive is integrated with a hardware encryption chip that supports national cryptographic algorithms (with built-in SM2, SM3, and SM4 algorithm engines).

[0029] The method specifically includes the following steps: Step S1: Identity registration and pre-configuration, During the manufacturing or initialization phase of the solid-state drive (SSD), an SM2 public-private key pair (PKSSD, SKSSD) is generated using the SSD's internal true random number generator. The private key SKSSD is securely stored within the SSD's encryption chip protection zone and cannot be read externally; the public key PKSSD is stored in a trust store on the cloud server via a digital certificate. Simultaneously, the cloud server also generates its own SM2 key pair (PKCloud, SKCloud), thereby establishing an asymmetric encryption trust foundation based on the Chinese national standard SM2.

[0030] Step S2: Initiate an access request and challenge. When the cloud server needs to access data on the solid-state drive, the cloud server generates a high-strength random number R1 (e.g., 128 bits) and records the current timestamp T1. The cloud server then uses its private key SKCloud to perform an SM2 digital signature on (R1, T1) to generate a signature value Sig1.

[0031] Subsequently, the cloud server sends the access request packet to the solid-state drive. The access request packet includes PKCloud, R1, T1, and Sig1.

[0032] Step S3: Solid State Drive Authentication and Response After receiving the request packet, the solid-state drive first performs a time validity verification: it checks if |Tcurrent−T1|≤ΔT| (where ΔT is the preset maximum allowed time deviation, such as 5 minutes), to prevent replay attacks.

[0033] If the time verification passes, the SSD uses the pre-stored PKCloud to verify the legitimacy of the signature Sig1. If the verification passes, the other party is confirmed to be a legitimate cloud server.

[0034] Subsequently, the solid-state drive generates a random number R2 and uses its own private key SKSSDD to perform an SM2 signature on (R1,R2) to generate a signature value Sig2.

[0035] The solid-state drive calculates the session key negotiation parameters and sends a response packet back to the cloud server. The response packet includes: R2, Sig2, and PKSSD (if the cloud server has not pre-stored them).

[0036] Step S4: Two-way authentication and session key generation. After receiving the response packet, the cloud server verifies the signature Sig2 using the stored PKSSD. If the verification passes, the cloud server confirms the SSD's legitimacy.

[0037] At this point, both parties have completed two-way authentication. Next, the symmetric key for this session will be derived using the random numbers generated by both parties.

[0038] Specifically, both parties calculate the key derivation factor: Kfactor=SM3(R1∥R2), where ∥ represents data concatenation.

[0039] Then, the first 128 bits of Kfactor are extracted as the session key Ksession for the SM4 algorithm.

[0040] That is: $$K_{session}=\text{Truncate}_{128}(SM3(R_1|R_2))$$ Since R1 and R2 are unique for each session, the generated Ksession is random and one-time (one-time pad), which greatly improves security.

[0041] Step S5: Secure data transmission based on SM4 After establishing the session key, the data interaction phase begins.

[0042] Data writing process: The cloud server encrypts the data to be written, Data, using the SM4 algorithm and the key Ksession, resulting in ciphertext C = SM4_Enc(Ksession, Data); simultaneously, it calculates the data integrity check code MAC = SM3(C). The cloud server sends (C, MAC) to the solid-state drive. Upon receiving the data, the solid-state drive first calculates MAC′ and compares it with the MAC to verify data integrity, then stores the ciphertext C.

[0043] Data reading process: The solid-state drive reads the stored ciphertext C, calculates the MAC address, and sends it to the cloud server. After verifying that the MAC address is correct, the cloud server uses Ksession to decrypt C, obtaining the plaintext data Data=SM4_Dec(Ksession,C).

[0044] Example 3: like Figure 2 As shown, based on Embodiment 1, this embodiment of the invention provides a secure system for cloud server access to solid-state drives based on national cryptographic standards, characterized in that it includes a cloud server security management terminal, a network transmission link, and a solid-state drive terminal configured with a national cryptographic security module. The cloud server security management terminal is used to deploy the national cryptographic SM2 algorithm key pair, and is responsible for initiating access requests, performing two-way identity authentication with the solid-state drive terminal based on the national cryptographic algorithm, and generating dynamic session keys through the key negotiation algorithm; The network transmission link is used to carry encrypted interactive data between the cloud server security management terminal and the solid-state drive terminal. All transmitted control commands and business data are encrypted and encapsulated based on the negotiated session key. The solid-state drive equipped with the national cryptographic security module is used to pre-set the national cryptographic SM2 hardware key and sensitive data protection zone, and is responsible for responding to access requests from the cloud server, verifying the integrity of instructions using the SM3 algorithm, encrypting and decrypting data using the SM4 algorithm, and establishing a trusted secure access channel after authentication.

[0045] The two-way authentication and key negotiation process between the cloud server security management terminal and the solid-state drive terminal specifically includes: The cloud server security management terminal generates a random number and uses its own private key to perform an SM2 signature on R1 and the timestamp T. The signature result and its own public key are then shared. Send to the solid-state drive; The solid-state drive verifies the validity of the signature and timestamp. If the verification is successful, it generates a random number and signs it using its own private key, returning it to the cloud server's security management terminal. Based on the exchanged random number, both parties derive and generate a session key using the SM3 hash algorithm. The session key is used for SM4 encryption operations on subsequent data transmissions.

[0046] The data storage and anti-tampering mechanisms on the solid-state drive include: The national cryptographic security module has an independent storage area for storing encryption keys for user data; When the cloud server initiates a write operation, the solid-state drive uses the session key to decrypt the received data, calculates the SM3 hash value of the data, and stores the hash value together with the encrypted data. When the cloud server initiates a read operation, the solid-state drive reads the encrypted data and recalculates the hash value, comparing it with the stored hash value. If they match, the data is returned after encryption; otherwise, access is denied and a security alert is reported.

[0047] The system also includes a unified identity identification subsystem based on the national cryptographic algorithm SM9; The cloud server security management terminal acts as a key generation center (KGC) to distribute private keys based on identity identifiers to the solid-state drive terminal; When the solid-state drive accesses the network, it uses the SM9 private key to sign the device identity identifier (such as the device serial number), thereby achieving fast access authentication without a certificate and simplifying the key management complexity of massive cloud storage devices.

[0048] Example 4: Figure 3 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present invention is shown.

[0049] The electronic device may include a central processing unit / microprocessor / main control chip, etc. 4; and a storage medium 5, coupled to the central processing unit / microprocessor / main control chip, etc. 4, and storing computer-executable instructions therein for performing the steps of various methods of embodiments of the present invention when executed by the processor.

[0050] The central processing unit / microprocessor / main control chip, etc., can include, but are not limited to, one or more processors or microprocessors.

[0051] Storage medium 5 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (e.g., hard disk, floppy disk, solid-state drive, removable disk, CD-ROM, DVD-ROM, Blu-ray disc, etc.).

[0052] In addition, the electronic device may also include (but is not limited to) a data bus 6, an input / output bus / external bus / device bus 7, a display 8, and input / output devices 9 (e.g., keyboard, mouse, speaker, etc.).

[0053] The central processing unit / microprocessor / main control chip, etc. 4 can communicate with external devices (8, 9, etc.) via I / O bus 7 through wired or wireless network (not shown).

[0054] The storage medium 5 may also store at least one computer-executable instruction for performing the steps of various functions and / or methods in the embodiments described herein when the central processing unit / microprocessor / main control chip, etc., 4 is running.

[0055] In one embodiment, the at least one computer-executable instruction may also be compiled into or comprise a software product, wherein one or more computer-executable instructions are executed by a processor to perform the steps of the various functions and / or methods in the embodiments described herein.

[0056] Figure 4 A schematic diagram of a computer-readable storage medium according to an embodiment of the present invention is shown.

[0057] like Figure 4As shown, the non-transitory computer-readable storage medium 11 stores instructions, such as computer-readable instructions 10. When the computer-readable instructions 10 are executed by a processor, the various methods described above can be performed. The non-transitory computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-transitory non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. For example, the non-transitory computer-readable storage medium 11 can be connected to a computing device such as a computer, and then, when the computing device executes the computer-readable instructions 10 stored on the computer-readable storage medium 11, the various methods described above can be performed.

[0058] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0059] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0060] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0061] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for executing all or part of the steps of the methods of the various embodiments of this invention through a computer device (which may be a personal computer, server, or network device, etc.). The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0062] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security method for a cloud server accessing a solid state disk based on a national secret, applied to a security access control process in a cloud server system, the cloud server system comprising a cloud management platform, a computing node, and a solid state disk mounted on the computing node, characterized in that, Includes the following steps: After power-on initialization, the solid-state drive generates a pre-set national cryptographic public-private key pair and stores the national cryptographic private key through the hardware security module HSM. At the same time, it sends the national cryptographic public key and a digital certificate containing the solid-state drive's unique identifier to the cloud management platform for registration. When an access request is received from a tenant, a dynamic access token containing a timestamp and a random number is generated based on the access request. The dynamic access token is then signed using the national cryptographic private key of the cloud management platform to obtain first signature information. The first signature information and the access instruction are then sent to the computing node. The received first signature information and access instruction are forwarded to the solid-state drive; The first signature information is verified using the pre-set national cryptographic public key of the cloud management platform. If the verification is successful, the dynamic access token is parsed, and the timestamp and random number in the token are verified to be within the preset valid range. If the verification passes, the solid-state drive generates a session key using the SM3 hash algorithm based on the dynamic access token and local hardware feature parameters, and uses the session key to encrypt its own identity information and current state metric to obtain identity response data; at the same time, the solid-state drive uses its own national cryptographic private key to perform digest signing on the identity response data to obtain second signature information, and sends the identity response data carrying the second signature information to the cloud management platform. The second signature information is verified using the national cryptographic public key of the registered solid-state drive. If the verification is successful and the identity information matches, two-way identity authentication is completed and an encrypted communication channel is established.

2. The security method for accessing a solid state disk of a cloud server based on a national secret according to claim 1, characterized in that, The process of generating the digital certificate includes: The solid-state drive uses the SM2 elliptic curve public-key cryptography algorithm to generate public-private key pairs. Construct a Certificate Signing Request (CSR) containing the solid-state drive serial number, manufacturer information, and public key; The cloud management platform receives the CSR and issues a digital certificate conforming to the X.509 standard based on the built-in root certificate. The issued digital certificate is then distributed to the solid-state drive and stored in a protected partition.

3. The security method for accessing a solid state disk of a cloud server based on a national secret according to claim 1, characterized in that, The specific process of generating a session key using the SM3 hash algorithm is as follows: Extract the timestamp, random number, and operation permission level from the dynamic access token; Read the hardware fingerprint generated by the Physically Unclonable Function (PUF) within the solid-state drive; The timestamp, random number, operation permission level, and hardware fingerprint are concatenated to form a key generation factor; The key generation factor is hashed using the SM3 algorithm, and the first 256 bits of the result are taken as the session key for this session.

4. The security method for accessing a solid state disk of a cloud server based on a national secret according to claim 1, characterized in that, Verify whether the timestamp and random number in the token are within a preset valid range, specifically including: Parse the dynamic access token to obtain the token generation timestamp; Get the current local time of the solid-state drive and calculate the time difference between the current local time and the token generation timestamp; Determine whether the time difference is less than a preset time threshold and whether the random number has not been used within a preset time window; If so, it is considered valid; otherwise, access is denied.

5. The security method for accessing a solid state disk of a cloud server based on a national secret according to claim 1, characterized in that, It also includes data access control steps: The cloud management platform generates a corresponding access control list (ACL) based on the authentication result. The ACL contains the allowed logical block address (LBA) range and operation type. The cloud management platform uses the SM4 block cipher algorithm to encrypt the access control list with the session key and sends it to the solid-state drive; After the solid-state drive is decrypted, it will only respond to the access control list if the received read / write command satisfies the restrictions of the access control list. Abnormal behavior auditing steps: The solid-state drive monitors all access commands in real time and generates audit logs by recording illegal access commands, illegal tampering attempts, and authentication failures. The audit logs are encrypted and stored in a hidden partition of the solid-state drive using the SM4 algorithm; The encrypted audit logs are uploaded to the cloud management platform at regular intervals. The cloud management platform uses a dedicated audit key to decrypt and analyze potential security threats.

6. The security method for accessing a solid state disk of a cloud server based on a national secret according to claim 1, wherein, After establishing an encrypted communication channel, the data transmission process includes: The sender divides the data to be transmitted into fixed-length data blocks; Each data block is encrypted using the SM4 algorithm and a message authentication code based on the SM3 algorithm is added to each data block. After receiving the data, the receiver first uses the message authentication code to verify the integrity of the data, and then uses the session key to decrypt the data after the verification is successful. Key hot update mechanism: The cloud management platform monitors the communication duration or data transmission volume, and when the preset threshold is reached, it sends a key update request to the solid-state drive. A new session key is generated through negotiation, and the old session key is used to encrypt the transmission of the new session key; After the update is complete, destroy the old session key.

7. A secure method for accessing a solid-state drive from a cloud server based on national cryptographic standards, as described in claim 1, characterized in that... The AI security analysis module calculates a risk probability value The process specifically includes: mapping the feature vector V to a sequence of tokens X={} ; A multi-layer attention mechanism is used to capture long-range dependencies between data access requests, and a contextual feature representation H is calculated. The anomaly probability is output through the Sigmoid activation function and dynamically corrected by combining it with the time decay factor λ(t). The calculation formula is as follows: ,in, Here, W and b are the model weight parameters, and λ is the time sensitivity coefficient. The time of the last legal operation. The information entropy of the feature vector V is used to characterize the degree of randomness of the access pattern, and β is the weight adjustment coefficient. Session key The generation incorporates the real-time environmental entropy value output by the AI ​​analysis module to enhance resistance to replay attacks. The specific generation formula is as follows: ,in, This is the shared key calculated using the elliptic curve key exchange algorithm. and Random numbers generated by the cloud management platform and the solid-state drive, respectively. This is the hash value calculated by the AI ​​security analysis module for the current cloud environment context state. || represents a data concatenation operation. This is a national cryptographic hash algorithm.

8. A secure system for accessing a solid-state drive (SSD) from a cloud server based on national cryptographic standards, as described in any one of claims 1 to 7, characterized in that... This includes the cloud server security management terminal, network transmission links, and solid-state drives configured with national cryptographic security modules; The cloud server security management terminal is used to deploy the national cryptographic SM2 algorithm key pair, and is responsible for initiating access requests, performing two-way identity authentication with the solid-state drive terminal based on the national cryptographic algorithm, and generating dynamic session keys through the key negotiation algorithm; The network transmission link is used to carry encrypted interactive data between the cloud server security management terminal and the solid-state drive terminal. All transmitted control commands and business data are encrypted and encapsulated based on the negotiated session key. The solid-state drive equipped with the national cryptographic security module is used to pre-set the national cryptographic SM2 hardware key and sensitive data protection zone, and is responsible for responding to access requests from the cloud server, verifying the integrity of instructions using the SM3 algorithm, encrypting and decrypting data using the SM4 algorithm, and establishing a trusted secure access channel after authentication.

9. An electronic device, comprising: At least one memory stores computer-executable instructions non-transiently; At least one processor, configured to run the computer-executable instructions, The computer-executable instructions are executed by the processor at runtime, as described in any one of claims 1-7, regarding a secure method for accessing a solid-state drive based on national cryptographic standards from a cloud server.

10. A computer-readable storage medium, wherein, The computer-readable storage medium stores computer-executable instructions, which, when executed by at least one processor, implement a secure method for accessing a solid-state drive based on national cryptographic standards for a cloud server, as described in any one of claims 1-7.

Images