A data writing method and a storage server

Abstract

The application relates to a data writing method and a storage server, wherein the data writing method comprises the following steps: receiving monitoring data collected by a data collection device in real time, and storing the monitoring data in a volatile storage medium; before a data writing operation, performing signature verification on a standard characteristic parameter set by using a hardware root of trust; after the signature verification passes, performing consistency comparison between the monitoring data and the standard characteristic parameter set by using a programmable logic circuit, so as to determine whether the monitoring data is abnormal; if the monitoring data is abnormal, destroying the abnormal monitoring data in the volatile storage medium by using the programmable logic circuit; if the monitoring data is normal, issuing a write enable signal to a storage controller by using the programmable logic circuit, and the storage controller writes the monitoring data from the volatile storage medium to a non-volatile storage medium in response to the write enable signal, so that the safety of data writing is improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data writing method and a storage server. Background Technology

[0002] In scenarios with high compliance requirements, various monitoring data, including production process parameters, need to be continuously generated and persistently stored for compliance traceability and regulatory verification. Current mainstream protection solutions largely rely on the operating system and upper-layer software to complete data verification and identification, which has the following technical shortcomings:

[0003] 1. Pure software relies on CPU scheduling to run, and cannot intervene in the physical transmission of the bus and the CPU microarchitecture instruction pipeline in a timely manner. It is vulnerable to process hijacking, driver tampering, and privilege escalation to bypass the protection logic.

[0004] 2. For non-volatile persistent media, conventional interception only stays at the logic layer or MMIO access level, and cannot achieve pure hardware isolation, low-level physical blocking, etc., leaving blind spots in protection;

[0005] 3. Abnormal data is only logically marked and deleted, but not destroyed. There is a risk that the abnormal monitoring data can be recovered, leaked, and tampered with for tracing.

[0006] 4. The standard feature parameter set is only verified once upon power-on, making it vulnerable to unauthorized rewriting during operation. Furthermore, it lacks an independent hardware trust anchor and cannot withstand firmware-level or physical side-channel attacks.

[0007] Therefore, there is an urgent need for a universal data security writing solution that features pure hardware isolation, low-level physical blocking, and protection against recovery and bypass. Summary of the Invention

[0008] Therefore, it is necessary to provide a data writing method and a storage server to address the aforementioned technical problems.

[0009] In a first aspect, embodiments of this application provide a data writing method applied to a storage server. The storage server is connected to a data acquisition device. The storage server includes a programmable logic circuit, a storage controller, a volatile storage medium, a non-volatile storage medium, a hardware root of trust module, and a read-only memory. The read-only memory is used to store a set of standard feature parameters. The method includes:

[0010] Receive monitoring data transmitted in real time by the data acquisition device and store the monitoring data in the volatile storage medium;

[0011] Before the data write operation, the hardware root of trust module is used to perform signature verification on the standard feature parameter set;

[0012] After the signature verification is successful, the programmable logic circuit is used to compare the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal.

[0013] If an anomaly is detected, the programmable logic circuit is used to destroy the anomaly monitoring data in the volatile storage medium.

[0014] If normal, the programmable logic circuit sends a write enable signal to the memory controller, and the memory controller responds to the write enable signal by writing the monitoring data from the volatile memory medium to the non-volatile memory medium.

[0015] In one embodiment, the read-only memory further stores a digital signature of the standard feature parameter set using a private key, and the hardware root trust module further stores a public key corresponding to the private key. The public key is burned into the hardware root trust module, and the signature verification of the standard feature parameter set using the hardware root trust module includes:

[0016] The hardware root of trust module is used to read the standard feature parameter set and the digital signature from the read-only memory.

[0017] The hardware root of trust module is used to perform a hash calculation on the standard feature parameter set to obtain a first hash value;

[0018] The digital signature is decrypted using the public key embedded within the hardware trust root module to obtain the second hash value;

[0019] If the first hash value matches the second hash value, the signature verification is successful.

[0020] In one embodiment, the monitoring data includes multiple operational status data, and the step of using the programmable logic circuit to perform a consistency comparison between the monitoring data and the standard feature parameter set to determine whether the monitoring data is abnormal includes:

[0021] Each of the aforementioned working status data is compared with the corresponding standard interval in the set of standard feature parameters. If it exceeds the standard interval, the corresponding monitoring data is determined to be abnormal; or...

[0022] Based on the aforementioned working status data, a monitoring vector is constructed; the distance between the monitoring vector and the standard vector in the standard feature parameter set is calculated, and if the distance exceeds a preset tolerance threshold, the corresponding monitoring data is determined to be abnormal.

[0023] In one embodiment, the working status data includes process execution status data, and the step of using the programmable logic circuit to perform a consistency comparison between the monitoring data and the standard feature parameter set to determine whether the monitoring data is abnormal includes:

[0024] The process execution status data is compared with the process execution status change sequence in the standard feature parameter set to determine whether each process execution status in the process execution status data appears within a preset time window, or whether the process execution status data conforms to a preset change sequence.

[0025] If not, the execution status data of the process is determined to be abnormal.

[0026] In one embodiment, the volatile storage medium is a dynamic random access memory, and the destruction of anomaly monitoring data in the volatile storage medium includes:

[0027] Determine the physical memory address corresponding to the anomaly monitoring data, and determine the storage unit corresponding to the anomaly monitoring data based on the physical memory address;

[0028] In a hardware-exclusive environment, at least two rounds of differential write are performed on the storage cell sequentially; and after performing at least two rounds of differential write, the residual charge of the storage cell is cleared.

[0029] In one embodiment, in a hardware-exclusive environment, at least two rounds of differential overwrite are sequentially performed on the storage unit, including:

[0030] In a hardware-exclusive environment, the storage unit is overwritten in three rounds: the first round is overwritten with random noise data, the second round is overwritten with all zero data, and the third round is overwritten with all one data.

[0031] In one embodiment, in a hardware-exclusive environment, clearing residual charge from the storage cell includes:

[0032] In a hardware-exclusive environment, multiple rounds of activation and pre-charge timing operations are performed on the memory cell; each round of activation and pre-charge timing operations includes: sending an activation command to open the target physical row corresponding to the memory cell, reading the data in the memory cell into the corresponding sensing amplifier and latching it; sending a pre-charge command to close the target physical row, and pre-charging the corresponding bit line to the reference voltage.

[0033] In one embodiment, the data write request is issued by the storage controller or the host CPU or DMA controller of the storage service server.

[0034] In one embodiment, the method further includes:

[0035] If the monitoring data is abnormal, the programmable logic circuitry is used to destroy the abnormal monitoring data copy in the storage controller, the host CPU, or the DMA controller.

[0036] If signature verification fails, the programmable logic circuit sends a lock signal to the storage controller, and the storage controller responds to the lock signal by closing the data write channel.

[0037] Secondly, embodiments of this application also provide a storage server, the storage server comprising: a programmable logic circuit, a storage controller, a volatile storage medium, a non-volatile storage medium, a hardware root of trust module, and a read-only memory;

[0038] The read-only memory is used to store a set of standard feature parameters;

[0039] The volatile storage medium is used to store monitoring data collected in real time by the data acquisition device;

[0040] The hardware root of trust module is used to perform signature verification on the standard feature parameter set before data write operations.

[0041] The programmable logic circuit is used to compare the monitoring data with the standard feature parameter set after the signature verification is passed, so as to determine whether the monitoring data is abnormal; if abnormal, the abnormal monitoring data in the volatile storage medium is destroyed; if normal, a write enable signal is sent to the storage controller.

[0042] The storage controller is configured to write the monitoring data from the volatile storage medium to the non-volatile storage medium in response to the write enable signal.

[0043] In one embodiment, the programmable logic circuit is a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), or an application-specific integrated circuit (ASIC).

[0044] The aforementioned data writing method and storage server receive monitoring data collected in real time by the data acquisition device and store the monitoring data in the volatile storage medium. Before the data writing operation, the hardware root of trust module performs signature verification on the standard feature parameter set. After the signature verification is successful, the programmable logic circuit compares the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal. If abnormal, the programmable logic circuit destroys the abnormal monitoring data in the volatile storage medium. If normal, the programmable logic circuit sends a write enable signal to the storage controller. The storage controller responds to the write enable signal and writes the monitoring data from the volatile storage medium to the non-volatile storage medium, achieving universal data security writing with pure hardware isolation, low-level physical blocking, and anti-recovery and anti-bypass capabilities.

[0045] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0046] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0047] Figure 1 This is a flowchart illustrating the data writing method in one embodiment;

[0048] Figure 2 This is a schematic diagram of the signature verification process in one embodiment;

[0049] Figure 3 This is a schematic diagram of the storage server structure in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0051] This application provides a data writing method applied to a storage server. The storage server is connected to a data acquisition device. The storage server includes a programmable logic circuit, a storage controller, a volatile storage medium, a non-volatile storage medium, a hardware root of trust module, and a read-only memory.

[0052] The programmable logic circuit is deployed within a programmable logic circuit such as an FPGA (Field-Programmable Gate Array), CPLD (Complex Programmable Logic Device), or ASIC (Application-Specific Integrated Circuit), operating independently of the host CPU and operating system, and directly connected to the physical I / O bus link. This circuit is physically connected in series between the I / O bus and the memory controller, performing pre-emptive and mandatory interception and screening of all write requests flowing to non-volatile storage media, without the need for upper-layer software intervention.

[0053] The programmable logic circuit also integrates an abnormal data physical destruction unit, which is used to perform memory overwrite, cache refresh and charge destruction operations in a hardware exclusive environment.

[0054] The read-only memory is composed of OTP (One-Time Programmable Memory) or hardware-isolated read-only flash memory, and is used to permanently store a set of standard feature parameters that have been digitally signed.

[0055] The hardware root of trust module is preferably implemented by the FPGA's internal security engine to provide the highest performance and tight coupling; alternatively, it may be composed of a standalone TPM chip or a Trusted Execution Environment (TEE) for signature verification of standard feature parameter sets and dynamic signature verification during runtime.

[0056] The storage server also includes a trusted evidence storage unit, which consists of an independent secure storage chip or a hardware security module (HSM), used to perform hash calculations on compliant data digests and abnormal event information, and to complete tamper-proof evidence storage.

[0057] Figure 1 This is a flowchart illustrating a data writing method provided in an embodiment of this application, as shown below. Figure 1 As shown, the method includes the following steps:

[0058] Step S201: Receive the monitoring data transmitted in real time by the data acquisition device and store the monitoring data in the volatile storage medium.

[0059] Specifically, the storage server receives monitoring data transmitted in real time from the data acquisition device via the I / O bus, and then stores the monitoring data in the volatile storage medium. For example, the volatile storage medium can be dynamic random access memory (DRAM).

[0060] The monitoring data can come from high-safety-demand scenarios such as food production, industrial manufacturing, and compliance supervision, and can be collected through data acquisition equipment.

[0061] Step S202: Before the data writing operation, the hardware root of trust module is used to perform signature verification on the standard feature parameter set.

[0062] The standard feature parameter set is stored in a read-only memory (ROM). This ROM is either an OTP (One-Time Programmable Memory) or a hardware-isolated read-only flash memory, used to permanently store the digitally signed standard feature parameter set. Before the storage server performs a data write operation, it uses the hardware root of trust module to read the digital signature from the ROM and verify the signature. Data writing can take various forms, including direct physical writing, log structure writing, copy-on-write, and background asynchronous disk flushing.

[0063] Specifically, signature verification is performed during the power-on phase or after parameter updates. The digital signature is read from the read-only memory using the hardware root of trust module, and asymmetric operations are used to perform full signature verification (such as RSA / ECC / SM2). This signature verification is performed once during the system power-on phase or after parameter updates to establish a root of trust.

[0064] This application provides a full-cycle dynamic signature verification mechanism based on an independent hardware root trust module (such as a TPM, security chip, or FPGA security engine). This mechanism ensures that the standard feature parameter set is asymmetrically signed before data writing operations, preventing parameters from being tampered with, thus ensuring the accuracy of the standard feature parameter set and forming a complete trust chain from startup to operation.

[0065] Step S203: After the signature verification is passed, the programmable logic circuit is used to compare the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal.

[0066] In a preferred embodiment, before each consistency comparison between the monitored data and the standard feature parameter set, the security engine inside the programmable logic circuit also uses a hardware root of trust module to perform a lightweight integrity re-verification (such as HMAC verification or hash comparison) on the standard feature parameter set to prevent runtime tampering.

[0067] Step S204: If an anomaly is detected, the programmable logic circuit is used to destroy the anomaly monitoring data in the volatile storage medium.

[0068] Step S205: If normal, a write enable signal is sent to the storage controller using the programmable logic circuit. In response to the write enable signal, the storage controller writes the monitoring data from the volatile storage medium to the non-volatile storage medium.

[0069] At the same time, the summary information, timestamp, and unique device number of normal monitoring data are hashed and written into hardware secure storage or encrypted audit logs to complete tamper-proof evidence archiving.

[0070] The data writing scheme provided in this application is a general data security processing architecture that can be adapted to various high-security regulatory scenarios such as food production, industrial manufacturing, pharmaceuticals, and financial compliance. It receives monitoring data collected in real time by the data acquisition device and stores the monitoring data in the volatile storage medium. Before the data writing operation, the hardware root of trust module performs signature verification on the standard feature parameter set. After successful signature verification, the programmable logic circuit compares the monitoring data with the standard feature parameter set to determine if the monitoring data is abnormal. If abnormal, the programmable logic circuit destroys the abnormal monitoring data in the volatile storage medium. If normal, the programmable logic circuit sends a write enable signal to the storage controller. The storage controller responds to the write enable signal and writes the monitoring data from the volatile storage medium to the non-volatile storage medium, achieving general data security writing with pure hardware isolation, low-level physical blocking, and protection against recovery and bypass.

[0071] In one embodiment, the read-only memory further stores a digital signature of the standard feature parameter set using a private key, and the hardware root of trust module further stores a public key corresponding to the private key. The public key is programmed and stored in a one-time programmable memory or electronic fuse within the hardware root of trust module, such as... Figure 2 As shown, the signature verification of the standard feature parameter set using the hardware root of trust module includes the following steps:

[0072] Step S301: Use the hardware root of trust module to read the standard feature parameter set and the digital signature from the read-only memory.

[0073] Step S302: Use the hardware trust root module to perform hash calculation on the standard feature parameter set to obtain the first hash value.

[0074] Step S303: Decrypt the digital signature using the public key embedded in the hardware trust root module to obtain the second hash value.

[0075] Step S304: If the first hash value is consistent with the second hash value, the signature verification is successful.

[0076] Specifically, the hardware root of trust module performs integrity verification on the pre-stored standard feature parameter set. This integrity verification employs an asymmetric encryption algorithm (including one or more of RSA, ECC, and SM2). The specific process includes: the standard feature parameter set is digitally signed using a private key during the production or deployment phase; the digital signature and the standard feature parameter set are then stored together in a read-only memory (OTP or hardware-isolated read-only flash memory); the hardware root of trust module internally stores the corresponding public key (burned into OTP or eFUSE, physically immutable); before any data write operation, the hardware root of trust module reads the standard feature parameter set and calculates its hash, simultaneously decrypting the signature using the public key to obtain another hash; if they match, the verification passes; otherwise, the verification fails.

[0077] If the verification passes, the standard feature parameter set can be used for subsequent consistency comparison; if the verification fails, the whole machine enters hardware lock mode, the programmable logic circuit closes the DMA channel, and directly pulls down the physical write enable signal of the storage controller through the GPIO pin, blocking all data write paths and triggering an independent hardware audible and visual alarm (which cannot be cleared by software reset). It can only be recovered by physical power off combined with a security key.

[0078] In one embodiment, the monitoring data includes multiple operating status data. The step of using the programmable logic circuit to perform a consistency comparison between the monitoring data and the standard feature parameter set to determine whether the monitoring data is abnormal includes the following: comparing each of the operating status data with the corresponding standard interval in the standard feature parameter set; if it exceeds the standard interval, the corresponding monitoring data is determined to be abnormal; or, based on each of the operating status data, constructing a monitoring vector; calculating the distance between the monitoring vector and the standard vector in the standard feature parameter set; if the distance exceeds a preset tolerance threshold, the corresponding monitoring data is determined to be abnormal.

[0079] In one embodiment, the working status data includes process execution status data. The step of using the programmable logic circuit to compare the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal includes the following: comparing the process execution status data with the process execution status change sequence in the standard feature parameter set, and determining whether each process execution status in the process execution status data appears within a preset time window, or whether the process execution status data conforms to a preset change sequence; if not, the process execution status data is determined to be abnormal.

[0080] In one specific embodiment, the monitoring data includes multiple operating status data: temperature data, weight data, current data, pressure data, process execution time data, and process execution status data. The programmable logic circuit performs a consistency comparison between the monitoring data and a locally fixed set of standard feature parameters. The consistency comparison method includes one or more of the following:

[0081] Numerical threshold comparison: Real-time values ​​such as temperature, weight, current, and pressure are compared with the upper / lower threshold values ​​in the standard feature parameter set. Values ​​exceeding the range are judged as abnormal.

[0082] Time-series interval matching: Match the process execution time data with the standard time interval in the standard feature parameter set. If the time interval is exceeded, it is judged as abnormal; its essence is the same as numerical threshold comparison.

[0083] Multimodal deviation calculation: A joint deviation model between multiple sensors is pre-stored in the standard feature parameter set. The programmable logic circuit constructs a vector from the real-time acquired multidimensional sensor numerical data (such as temperature, current, weight, and process execution time), calculates a weighted Euclidean distance (or Mahalanobis distance) with the standard vector, and determines an anomaly if the distance value exceeds a preset tolerance threshold. This calculation is executed in parallel in a hardware pipeline within the FPGA, completing one multiplication-accumulation operation per clock cycle and outputting the determination result within microseconds. The joint deviation calculation can capture cross-sensor correlated anomalies, such as when temperature and weight are within their respective tolerance ranges but both deviate significantly at the same time.

[0084] State Sequence Verification: The standard feature parameter set pre-stores the expected execution state change sequence of the equipment in the standard process flow, including time-strict (each state must appear within a preset time window) and sequential (only the order of state appearance is considered, without strict time constraints). Time-strict sequence: Each process execution state must appear within a preset time window. For example, t0~t1 is the "standby" state, t1~t2 is the "heating" state, and t2~t3 is the "stirring" state. Exceeding the time window is considered abnormal. Sequential sequence: Only the order of state appearance is considered, without strict time constraints. For example, the state must change in the order of "standby → heating → stirring → cooling → stop". Skipping or repeating the order is considered abnormal.

[0085] In one embodiment, the volatile storage medium is a dynamic random access memory, and the destruction of the anomaly monitoring data in the volatile storage medium includes the following steps:

[0086] Step S401: Determine the physical memory address corresponding to the anomaly monitoring data, and determine the storage unit corresponding to the anomaly monitoring data based on the physical memory address;

[0087] Step S402: Under a hardware-exclusive environment, perform at least two rounds of differential write operations on the storage cell; and after performing at least two rounds of differential write operations, clear the residual charge of the storage cell.

[0088] Specifically, the destruction operation is performed in a hardware-exclusive environment. This hardware-exclusive environment includes blocking external interrupts, isolating access permissions to the target memory address, and suspending DMA transfer requests from other bus master devices. Specifically: the programmable logic circuit configures the interrupt controller to block all external interrupt requests from the host CPU, timers, and peripherals; it configures the memory protection unit in the memory controller to set the physical memory address containing the abnormal data to exclusive access mode, preventing all bus master devices from accessing it; and it configures the bus arbiter or DMA controller to suspend or block DMA transfer requests from other bus master devices. In this hardware-exclusive environment, at least two rounds of differentiated overwriting are performed on the storage unit corresponding to the abnormal data (e.g., the first round with random noise data, and the second round with all 0s or all 1s). Then, the residual charge in the storage unit is cleared, significantly eliminating residual charge and destroying the physical characteristics of the data storage, making reverse recovery via cold-start attacks or electron microscopy extremely difficult or impossible.

[0089] In one embodiment, under hardware-exclusive conditions, the storage unit is subjected to three rounds of differentiated overwriting sequentially. For example, the first round is overwritten with random noise data, the second round with all-zero data, and the third round with all-one data. Here, the order of overwriting with random noise data, all-zero data, and all-one data can be adjusted. For example, the first round is overwritten with random noise data, the second round with all-one data, and the third round with all-zero data.

[0090] In one embodiment, in a hardware-exclusive environment, clearing residual charge from the memory cell includes the following: performing multiple rounds of activation and pre-charge timing operations on the memory cell; each round of activation and pre-charge timing operations includes: sending an activation command to open the target physical row corresponding to the memory cell, reading the data in the memory cell into the corresponding sensing amplifier and latching it; sending a pre-charge command to close the target physical row, and pre-charging the corresponding bit line to the reference voltage.

[0091] In this embodiment, multiple rounds of "activation and pre-charge" timing operations are performed on the memory storage cell: an "activation" command is sent to open the target physical row and read the data into the sensing amplifier; then a "pre-charge" command is sent to close the row, charge the bit line to the reference voltage, and clear the data in the sensing amplifier. This timing operation is executed continuously for multiple rounds, thereby significantly eliminating residual charge and destroying the physical characteristics of data storage, making reverse recovery via cold-start attacks or electron microscopy extremely difficult or infeasible. Performing the activation-pre-charge timing operation on the memory storage cell directly affects the DRAM physical cell, destroying residual charge characteristics through repeated charging and discharging processes, significantly increasing the difficulty of cold-start attacks and electron microscopy reverse analysis. Compared to existing solutions that only perform logical overwrite, the method of this application can achieve irreversible destruction at the physical level.

[0092] In one specific implementation, the destruction execution unit is an FPGA (Field-Programmable Gate Array), which directly operates the DRAM through the memory controller interface to execute the above steps. In another specific implementation, the destruction execution unit is a BMC (Baseboard Management Controller) on the server motherboard, which controls the destruction process through the SMBus / IPMI interface, including notifying the BIOS to pause DMA operations, sending a command to the DRAM SPD chip through SMBus to enter test mode to write overwrite data, triggering cache refresh through the CPU microcode update interface, and executing the activation-precharge sequence through the memory controller interface.

[0093] In one embodiment, the method further includes: if the monitoring data is abnormal, using the programmable logic circuit to destroy the abnormal monitoring data copy in the storage controller, the host CPU, or the DMA controller.

[0094] Since there may be copies of abnormal monitoring data in the storage controller, the host CPU, or the DMA controller, in addition to destroying the abnormal monitoring data in the volatile storage medium, this embodiment of the application also destroys the copies of abnormal monitoring data in the storage controller, the host CPU, or the DMA controller to achieve complete destruction of the abnormal monitoring data.

[0095] Specifically, the abnormal data destruction process includes the following steps:

[0096] 1. Under the hardware exclusive environment described above, which disables external interrupts and disables DMA access permissions, lock the physical memory address to which the abnormal data belongs;

[0097] 2. Perform three rounds of differential overwriting sequentially: the first round writes random noise data, the second round fills the entire field with all zeros, and the third round fills the entire field with all one data.

[0098] 3. The programmable logic circuit initiates CLFLUSH, CLWB, and WBINVD instructions through bus transactions to flush any remaining copies in the CPU L1 / L2 / L3 cache step by step, and issues the FLUSH CACHE instruction to clear the memory controller cache;

[0099] 4. Perform multiple rounds of "activation" and "pre-charge" timing operations on the memory storage unit to remove residual charge and destroy the physical characteristics of data storage, making it unrecoverable.

[0100] The above embodiments perform physical irreversible destruction of abnormal data in a hardware-exclusive environment. This method not only overwrites memory data in multiple rounds, but also destroys the physical charge characteristics of data storage by flushing the CPU and storage controller cache and executing the memory cell activation-precharge sequence, thus eliminating data recovery from the root.

[0101] It should be noted that the multi-level physical destruction method for abnormal data described in the above embodiments can be used as an independently implementable data destruction scheme. This method is not limited to execution within the programmable logic circuit; it can also be executed by other destruction execution units (such as the system management controller (BMC), independent security chips, etc.) to destroy any abnormal data temporarily stored in volatile memory.

[0102] In one embodiment, the method further includes: if the hardware root of trust module performs signature verification on the standard feature parameter set, then the programmable logic circuit sends a lock signal to the storage controller, and the storage controller responds to the lock signal by closing the data write channel.

[0103] Specifically, if a signature verification error occurs (including signature mismatch, parameter set tampering, untrusted source, etc.), the hardware root of trust immediately triggers a hardware write lock-up mechanism: that is, for all subsequent write commands from the CPU or DMA, the programmable logic circuit and memory controller will not execute or respond, and will simultaneously perform the following operations: retain a local, tamper-proof fault log; trigger an independent hardware audible and visual alarm (which cannot be cleared by software reset); and close all data write paths (DMA channel closed, write enable signal pulled low). The above lock-up state can only be recovered by physical power failure combined with a security key, and software reset is prohibited.

[0104] In one embodiment, the data write request is issued by the storage controller or the host CPU or DMA controller of the storage service server.

[0105] For example, when the CPU writes directly to persistent storage media (such as PMEM) via Store instructions, the CPU initiates a normal write instruction, but the programmable logic circuitry, without relying on virtual address mapping, intercepts it directly at the physical address level. This process is pushed down to the CPU microarchitecture level, where pre-judgment and screening are performed before the Memory Reorder Buffer (MOB) instruction is committed to the L1 data cache or memory controller. This intercepts all Store writes, persistent instruction interactions, and peripheral DMA direct writes to persistent storage physical addresses, achieving forced blocking before atomic write operations. If the write is deemed normal, the instruction is allowed to continue, and data is written normally; if it is deemed abnormal, the instruction is prevented from being committed.

[0106] In this embodiment of the application, regardless of whether the data write request is initiated by the host CPU, DMA controller, or storage controller itself, before the data to be written is prepared to be written to the non-volatile storage medium, the legality is determined by comparing the monitoring data with the standard feature parameter set to generate a normal flag or an abnormal flag: if the data is determined to be abnormal, the programmable logic circuit closes the DMA transmission channel and pulls down the physical write enable signal of the storage controller to block the physical writing of the data; if the data is determined to be normal, the DMA channel is opened and the write enable signal is enabled, allowing the data to be written to the non-volatile persistent storage.

[0107] This embodiment provides an alternative hardware architecture in which the programmable logic circuit is not connected in series with the main I / O bus, but instead implements write enable control of the memory controller through a sideband signal channel independent of the main data path. This reduces the physical intrusion into the main I / O bus and improves the adaptability to existing systems. The system hardware composition is as follows:

[0108] Programmable logic circuits: Deployed within FPGAs, CPLDs, or security chips, they operate independently of the host CPU and include data comparison engines and signature verification engines;

[0109] Data acquisition interface: Used to obtain the data stream to be written to the storage medium from the host system, and can be implemented in one of the following two ways:

[0110] Method 1 (Active DMA Read): The programmable logic circuit reads the data to be written from the specified buffer of the host memory via the PCIe interface in DMA mode;

[0111] Method 2 (bus listening): The programmable logic circuit is mounted on the IO bus to obtain a copy of the data packets on the bus in listening mode only, without blocking or delaying the main data path;

[0112] Read-only memory: Composed of OTP or hardware-isolated read-only flash memory, it stores a set of standard characteristic parameters that are digitally signed.

[0113] Sideband control interface: Connected between the programmable logic circuit and the memory controller, it uses a sideband signal channel (including but not limited to SMBus, I2C, PCIe sideband signals, GPIO) independent of the main data path to transmit write enable control signals;

[0114] Storage controller: Receives data write requests from the host I / O bus. Before performing a physical write operation, it needs to query the write enable signal status of the programmable logic circuit through the sideband control interface.

[0115] The workflow is as follows:

[0116] S1. After the system is powered on, the signature verification engine inside the programmable logic circuit performs integrity verification on the pre-stored standard feature parameter set. If the signature verification is successful, the parameter set is loaded into the comparison engine; if the signature verification fails, a write prohibition signal is continuously output through the sideband control interface.

[0117] S2. During operation, the programmable logic circuit acquires the data stream to be written in real time through the data acquisition interface. The internal comparison engine parses the multimodal feature values ​​and performs a consistency comparison with the standard feature parameter set to generate normal or abnormal flags.

[0118] S3. When the storage controller is ready to physically write data to the non-volatile storage medium, it queries the programmable logic circuit for the write enable signal status via the sideband control interface:

[0119] If the comparison result is normal, the programmable logic circuit outputs a "write enable valid" signal through the sideband control interface, and the memory controller performs a physical write.

[0120] If the comparison result is abnormal, the programmable logic circuit outputs a "write enable invalid" signal through the sideband control interface, and the memory controller blocks the write operation.

[0121] S4. The blocked abnormal data can be further destroyed by the programmable logic circuit: the host system is notified through the sideband control interface (such as by sending an interrupt signal) and the host performs memory page overwrite cleanup; or the programmable logic circuit directly writes the overwrite data to the memory address where the abnormal data is located via DMA.

[0122] In one implementation, the programmable logic circuit is implemented using an FPGA and connected to the write enable control logic of the NVMe storage controller via PCIe sideband signals (such as the PERST or WAKE pins). In another implementation, the programmable logic circuit communicates with the SATA controller via SMBus. Before performing a write operation, the SATA controller firmware reads the status register of the programmable logic circuit via SMBus and determines whether to perform a physical write based on the return value.

[0123] The technical advantages of this embodiment are as follows: while maintaining hardware-level security isolation (comparison and signature verification are completed within an independent hardware module), the main I / O bus data path has zero latency (the data flow does not pass through the hardware module), and the hardware modification cost is significantly reduced (only low-speed sideband signal connections need to be added, without modifying the high-speed main bus wiring), making it easier to deploy on existing equipment. Furthermore, this embodiment complements the main embodiment (serialized hardware interception) in terms of patent coverage, jointly covering two hardware implementation architectures: main path interception and bypass control.

[0124] Based on the same inventive concept, embodiments of this application also provide a storage server, such as... Figure 3 As shown, the storage server includes: a programmable logic circuit, a storage controller, a volatile storage medium, a non-volatile storage medium, a hardware root of trust module, and a read-only memory.

[0125] The read-only memory is used to store a standard feature parameter set. The volatile storage medium is used to store monitoring data collected in real time by the data acquisition device. The hardware root of trust module is used to perform signature verification on the standard feature parameter set before data write operations. The programmable logic circuit is used to compare the monitoring data with the standard feature parameter set after the signature verification is successful to determine whether the monitoring data is abnormal; if abnormal, the abnormal monitoring data in the volatile storage medium is destroyed; if normal, a write enable signal is sent to the storage controller. The storage controller is used to respond to the write enable signal to write the monitoring data from the volatile storage medium to the non-volatile storage medium.

[0126] Specifically, the programmable logic circuit does not occupy host system resources and does not depend on the host CPU and operating system. It intercepts physical I / O bus write paths for conventional storage and pushes the interception point down to the CPU microarchitecture level for persistent storage media directly written to by the CPU (Store instruction). When the CPU normally initiates a write instruction, the programmable logic circuit performs pre-judgment and screening in the CPU's internal memory order buffer (MOB) before the Store instruction is submitted to the L1 data cache (for conventional memory) or the memory controller (for PMEM). It intercepts all Store writes, persistent instruction interactions, and peripheral DMA direct writes to persistent storage physical addresses, achieving forced blocking before atomic write operations.

[0127] In one embodiment, programmable logic circuits are integrated and deployed inside the CXL Switch or CXL memory controller; TLP messages initiated by the CPU are parsed in real time to accurately identify write service packets pointing to persistent memory; normal messages are routed and forwarded, and abnormal messages are directly discarded by hardware, and the local overwrite destruction and alarm evidence storage process is triggered in conjunction with the process.

[0128] The hardware trust root module features an independent secure key partition, an immutable and permanently installed boot program, and a physically isolated operating environment from the host CPU. It integrates PUF (Physically Unclonable Function) and eFUSE (Electronic Fuse Secure Storage). Standard feature parameter sets are stored in OTP (One-Time Programmable Memory) or hardware read-only secure flash memory. To balance security and real-time performance, a complete signature verification can be performed once during power-on by the TPM / TEE. During operation, the FPGA's internal security engine preferably performs a lightweight integrity re-verification (such as HMAC verification) of the parameter set before each data comparison and verification is initiated to prevent tampering during runtime.

[0129] In one embodiment, the programmable logic circuit is a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), or an application-specific integrated circuit (ASIC).

[0130] The storage server uses an independent programmable logic circuit, physically connected in series between the host I / O bus and the storage controller. The overall hardware composition is as follows:

[0131] Programmable logic circuits: FPGA / CPLD / ASIC chips, connected in series between the physical I / O bus (such as PCIe, SATA, CXL) and the storage controller;

[0132] Volatile storage medium: Onboard DRAM, connected to programmable logic circuitry via a memory controller;

[0133] Hardware root of trust module: preferably the internal security engine of the FPGA, but can also be an independent TPM chip or security chip, which communicates with the programmable logic circuit through an internal bus and is powered independently;

[0134] Read-only memory: OTP or secure flash, access is controlled by a hardware trust anchor, and it can only be read and not written;

[0135] Storage controller: SATA / NVMe / PMEM / CXL controller, which receives the write enable signal from the programmable logic circuit and controls data writing;

[0136] Non-volatile storage media: such as hard disks;

[0137] Trusted Evidence Storage Unit: A secure storage chip or blockchain interface module that receives hash digests output by programmable logic circuits.

[0138] Example 1: Implementation of General-Purpose Non-Volatile Memory Hardware Interception

[0139] Programmable logic circuits are mounted on the motherboard's physical I / O bus to independently monitor process parameters and data streams in high-compliance scenarios. Before such data is written to non-volatile storage media (such as hard drives, solid-state drives, flash memory, etc.) in any form, it is compared with a fixed set of standard characteristic parameters in real time. Abnormal data is cut off from the bus transmission path by the programmable logic circuit, while compliant data is written to persistent storage normally.

[0140] Example 2: Implementation of Hardware Interception for CPU Direct Write (Store Instruction) to Persistent Storage Media

[0141] For persistent storage media (such as PMEM) directly written to by the CPU via Store instructions, the CPU initiates a write instruction normally, but the programmable logic circuitry, without relying on virtual address mapping, intercepts it directly at the physical address level. This process is pushed down to the CPU microarchitecture level, where pre-judgment and screening are performed before the Memory Reorder Buffer (MOB) instruction is committed to the L1 data cache or memory controller. All Store writes, persistent instruction interactions, and peripheral DMA direct writes to persistent storage physical addresses are intercepted, achieving forced blocking before atomic write operations. If the write is deemed normal, the instruction is allowed to continue, and data is written normally; if it is deemed abnormal, the instruction is blocked from being committed.

[0142] Example 3: Full-lifecycle protection implementation of hardware trust root module

[0143] During power-up, the hardware root trust module first receives a parameter verification request from a system hardware module (such as a programmable logic circuit or system management controller). The hardware root trust module independently retrieves a pre-stored set of standard feature parameters and performs asymmetric verification on the digital signature. If the verification passes, the hardware root trust module returns a "load allowed" signal to the system, and the parameter set can then be used for subsequent consistency comparison. If the verification fails (including signature mismatch, parameter set tampering, untrusted source, etc.), the hardware root trust module immediately triggers a hardware write deadlock mechanism: that is, for all subsequent write commands from the CPU or DMA, the programmable logic circuit and memory controller do not execute or respond, and simultaneously perform the following operations: retain a local, tamper-proof fault log; trigger an independent hardware audible and visual alarm (which cannot be cleared by software reset); and close all data write paths (DMA channel closed, write enable signal pulled low). The above deadlock state can only be recovered by physical power-off combined with a security key, and software reset is prohibited.

[0144] Furthermore, the parameter set is permanently stored in a hardware-isolated read-only area. During system operation, the FPGA's internal security engine preferably performs a lightweight integrity re-verification of the parameter set before each data comparison and verification is initiated, balancing security and real-time processing performance. The above mechanism constitutes a full-cycle dynamic signature verification: asymmetric signature verification during power-on ensures the reliability of the parameter set source, and dynamic re-verification before each round of verification during operation ensures that the parameter set has not been tampered with.

[0145] Example 4: CXL Extended Memory Architecture Adaptation Implementation

[0146] This embodiment is adapted to the next-generation Compute Express Link interconnect architecture, integrating programmable logic circuits within the CXL switch or CXL memory controller. When the system is deployed within the CXL switch or CXL memory controller, it includes the following functional modules:

[0147] TLP message parsing module: used to parse CXL.mem TLP messages from the CPU in real time, identify message type (read / write), destination address, and written data payload;

[0148] Address filtering module: It is configured with a protected persistent memory address range table to determine whether the destination address of a TLP packet falls into the protected area;

[0149] The comparison and judgment module communicates with the locally fixed standard feature parameter set, performs consistency comparison on the data payload written to the TLP that falls into the protected area, and generates a normal or abnormal flag.

[0150] Message processing module: If the comparison result is normal, the TLP message is routed and forwarded normally to the target CXL memory device; if the comparison result is abnormal, the TLP message is discarded directly, and an error response is returned to the host or an alarm is triggered.

[0151] The workflow is as follows: real-time parsing of TLP messages initiated by the CPU to accurately identify write service packets pointing to persistent memory; normal messages are routed and forwarded, while abnormal messages are directly discarded by hardware, and the local overwrite destruction and alarm evidence storage process is triggered in conjunction with this.

[0152] In an alternative implementation, the security screening logic is integrated into the front-end of the CXL memory controller within the CPU SoC. When the CPU initiates a Store instruction, the CXL memory controller queries its internal protected address range table before constructing the CXL.mem write TLP. If the address falls within the protected range, the data to be written is sent to the comparison engine for comparison. If an anomaly is detected, the memory controller directly returns a storage failure response to the MOB without generating an actual TLP message. The CPU instruction pipeline receives the anomaly and triggers an interrupt. This solution further decentralizes the interception point to within the CPU SoC, achieving a lower-level protection.

[0153] The beneficial effects of the embodiments of this application are as follows:

[0154] 1. Relying on pure hardware programmable circuits independent of the host CPU and operating system, protection is established from the physical bus and CPU microarchitecture level to eliminate the bypass risks caused by software simulation, permission tampering, and process hijacking;

[0155] 2. Fully covers all implementation scenarios including regular writes, log writes, and asynchronous disk flushing, blocking circumvention paths for differentiated storage architectures and ensuring a complete closed-loop protection boundary;

[0156] 3. By combining a multi-round overwrite, global cache refresh, memory charge clearing, and physical feature destruction mechanism, the ability to resist cold start attacks and perform microscopic reverse recovery is significantly improved, achieving physical-level irreversible destruction of abnormal data;

[0157] 4. By using hardware trust anchors, physically isolated read-only storage, power-on signature verification, and dynamic re-verification during operation, the standard feature parameter set is ensured to be trustworthy throughout the process, resisting firmware attacks and runtime tampering.

[0158] 5. It is compatible with multiple hardware forms such as traditional storage, PMEM persistent memory, and CXL next-generation extended memory, and achieves seamless verification by relying on the native performance advantages of CXL, combining technological foresight and practicality;

[0159] 6. It provides two alternative architectures: serial hardware interception and sideband control bypass interception, to adapt to different deployment scenarios and cost requirements, forming a complementary patent protection network;

[0160] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0161] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A data writing method applied to a storage server, the storage server being connected to a data acquisition device, the storage server comprising a programmable logic circuit, a storage controller, a volatile storage medium, a non-volatile storage medium, a hardware root of trust module, and a read-only memory, the read-only memory being used to store a standard feature parameter set, characterized in that, The method includes: Receive monitoring data transmitted in real time by the data acquisition device and store the monitoring data in the volatile storage medium; Before the data write operation, the hardware root of trust module is used to perform signature verification on the standard feature parameter set; After the signature verification is successful, the programmable logic circuit is used to compare the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal. If an anomaly is detected, the programmable logic circuit is used to destroy the anomaly monitoring data in the volatile storage medium. If normal, the programmable logic circuit sends a write enable signal to the memory controller, and the memory controller responds to the write enable signal by writing the monitoring data from the volatile memory medium to the non-volatile memory medium.

2. The method according to claim 1, characterized in that, The read-only memory also stores digital signatures of the standard feature parameter set using a private key. The hardware root of trust module also stores the public key corresponding to the private key. The public key is burned and solidified within the hardware root of trust module. Signature verification of the standard feature parameter set using the hardware root of trust module includes: The hardware root of trust module is used to read the standard feature parameter set and the digital signature from the read-only memory. The hardware root of trust module is used to perform a hash calculation on the standard feature parameter set to obtain a first hash value; The digital signature is decrypted using the public key embedded within the hardware trust root module to obtain the second hash value; If the first hash value matches the second hash value, the signature verification is successful.

3. The method according to claim 1, characterized in that, The monitoring data includes multiple operational status data. The programmable logic circuit is used to compare the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal, including: Each of the aforementioned working status data is compared with the corresponding standard interval in the set of standard feature parameters. If it exceeds the standard interval, the corresponding monitoring data is determined to be abnormal; or... Based on the aforementioned working status data, a monitoring vector is constructed; the distance between the monitoring vector and the standard vector in the standard feature parameter set is calculated, and if the distance exceeds a preset tolerance threshold, the corresponding monitoring data is determined to be abnormal.

4. The method according to claim 3, characterized in that, The work status data includes process execution status data. The programmable logic circuit is used to compare the monitoring data with the standard feature parameter set to determine whether the monitoring data is abnormal, including: The process execution status data is compared with the process execution status change sequence in the standard feature parameter set to determine whether each process execution status in the process execution status data appears within a preset time window, or whether the process execution status data conforms to a preset change sequence. If not, the execution status data of the process is determined to be abnormal.

5. The method according to claim 1, characterized in that, The volatile storage medium is a dynamic random access memory (DRAM). Destroying the anomaly monitoring data in the volatile storage medium includes: Determine the physical memory address corresponding to the anomaly monitoring data, and determine the storage unit corresponding to the anomaly monitoring data based on the physical memory address; In a hardware-exclusive environment, at least two rounds of differential write operations are performed on the storage cell sequentially; and after performing at least two rounds of differential write operations, the residual charge of the storage cell is cleared.

6. The method according to claim 5, characterized in that, In a hardware-exclusive environment, at least two rounds of differentiated overwrite are performed sequentially on the storage unit, including: In a hardware-exclusive environment, the storage unit is overwritten in three rounds: the first round is overwritten with random noise data, the second round is overwritten with all zero data, and the third round is overwritten with all one data.

7. The method according to claim 5, characterized in that, In a hardware-exclusive environment, the residual charge in the storage cell is cleared, including: In a hardware-exclusive environment, multiple rounds of activation and pre-charge timing operations are performed on the memory cell; each round of activation and pre-charge timing operations includes: sending an activation command to open the target physical row corresponding to the memory cell, reading the data in the memory cell into the corresponding sensing amplifier and latching it; sending a pre-charge command to close the target physical row, and pre-charging the corresponding bit line to the reference voltage.

8. The method according to claim 1, characterized in that, The data write request is issued by the storage controller or the host CPU or DMA controller of the storage service server.

9. The method according to claim 8, characterized in that, The method further includes: If the monitoring data is abnormal, the programmable logic circuitry is used to destroy the abnormal monitoring data copy in the storage controller, the host CPU, or the DMA controller. If signature verification fails, the programmable logic circuit sends a lock signal to the storage controller, and the storage controller responds to the lock signal by closing the data write channel.

10. A storage server, characterized in that, The storage server includes: programmable logic circuitry, a storage controller, volatile storage media, non-volatile storage media, a hardware root of trust module, and a read-only memory. The read-only memory is used to store a set of standard feature parameters; The volatile storage medium is used to store monitoring data collected in real time by the data acquisition device; The hardware root of trust module is used to perform signature verification on the standard feature parameter set before data write operations. The programmable logic circuit is used to compare the monitoring data with the standard feature parameter set after the signature verification is passed, so as to determine whether the monitoring data is abnormal; if abnormal, the abnormal monitoring data in the volatile storage medium is destroyed; if normal, a write enable signal is sent to the storage controller. The storage controller is configured to write the monitoring data from the volatile storage medium to the non-volatile storage medium in response to the write enable signal.

11. The storage server according to claim 10, characterized in that, The programmable logic circuit is a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), or an application-specific integrated circuit (ASIC).

Images