Setup program, and encrypted solid-state-disk system

Abstract

Disclosed in the present invention are a setup program (112), and an encrypted solid-state-disk system (300). The setup program (112) can be executed in an operating system (111) of a computer (100). When an encrypted solid-state disk (200) is connected to the computer (100) by means a USB port (12) and when a user enters a correct hard disk password via an operation interface (113) of the setup program (112), the setup program (112) performs hash processing on the hard disk password and hard disk information, so as to generate password data (A1); and the setup program (112) transmits an IF-SEND command (A) which contains the password data to a self-encryption driver (21) of the encrypted solid-state disk (200), and the self-encryption driver (21) can then perform an AES unlocking operation according to a TCG OPAL 2.0 standard by using the password data (A1), and return an IF-RECV command (B) to the setup program (112). If the setup program (112) determines according to the IF-RECV command (B) that the encrypted solid-state disk (200) has been successfully unlocked, the setup program (112) mounts the encrypted solid-state disk (200) to the operating system (111) by means of the operating system (111). (FIG. 1)

Description

Configure and encrypt the SSD system Technical Field

[0001] The present invention relates to a setting program and an encrypted solid-state hard disk system, and more particularly to a setting program for setting an encrypted solid-state hard disk that complies with the TCG OPAL standard, and an encrypted solid-state hard disk system including the setting program. Background Art

[0002] In the prior art, users connect a TCG OPAL 2.0-compliant encrypted SSD to a computer after the computer is already running an operating system. In the operating system, the user will see the encrypted SSD as uninitialized, and will be unable to access data on the encrypted SSD.

[0003] In this case, if the user wants to access the data on the encrypted SSD, the user must follow several steps: shut down the computer; connect the encrypted SSD to the computer via the computer's SATA port; restart the computer and enter the computer's BIOS system, and select the encrypted SSD. The BIOS system will then enter the encrypted SSD's PBA (Pre-Boot Authentication) system, and the PBA system will require the user to enter the encrypted SSD's password. The user must enter the correct password in the PBA system (the manufacturer pre-sets the password when the encrypted SSD is shipped) before the encrypted SSD is unlocked. After the encrypted SSD is unlocked, the user can restart and access the encrypted SSD in the operating system.

[0004] According to the current TCG OPAL 2.0 standard, after a user enters the correct password in the computer's BIOS system to unlock the data on the encrypted SSD, if the user unplugs the cable connecting the encrypted SSD to the computer, the encrypted SSD will become encrypted again, and the user must use the computer's BIOS system again to unlock the data on the encrypted SSD.

[0005] That is, in the prior art, after a user unlocks an encrypted SSD using the computer's BIOS, they must directly reboot the computer in the BIOS and remain connected to the encrypted SSD. This allows the user to access the encrypted SSD only after rebooting and entering the operating system. The encrypted SSD can then be viewed on the relevant disk management page.

[0006] In addition, since the interface designs of the BIOS systems of various computer manufacturers are not exactly the same, and ordinary users rarely use the computer's BIOS system, when users want to unlock an encrypted solid-state drive that complies with the TCG OPAL 2.0 standard and enter the computer's BIOS system, it usually takes some time to successfully enter the encrypted solid-state drive's PBA system.

[0007] As mentioned above, existing encrypted solid-state drives that comply with the TCG OPAL 2.0 standard cause many inconveniences for users.

[0008] Summary of the Invention

[0009] The present invention discloses a setting program and an encrypted solid-state hard disk system, which are mainly used to improve the inconvenience of using existing encrypted solid-state hard disks that comply with the TCG OPAL standard.

[0010] One embodiment of the present invention discloses a configuration program that can be executed on an operating system of a computer. The operating system is executed by a processor of the computer. The configuration program includes an operation interface for providing user operations so that the configuration program can be used to connect to a TCG-compliant computer. An encrypted solid-state drive according to the OPAL standard is set up; when the setting program is executed in the operating system, the setting program can obtain port information through the operating system; if the setting program determines that the encrypted solid-state drive is connected to the computer through the USB port of the computer based on the port information, the setting program will display an unlock option in the operation interface; wherein, when the unlock option is selected and a hard disk password is entered in the operation interface, the setting program can successively execute a hashing program and a transmission program, in which the setting program obtains at least one hard disk data corresponding to the encrypted solid-state drive through the operating system, and uses the hard disk data and the hard disk password to perform hash processing to generate a password data; in the transmission program, the setting program will transmit an IF-SEND command to a self-encrypting drive (SED) of the encrypted solid-state drive through the USB port of the operating system, and the password data is included in the IF-SEND command; the self-encrypting drive (SED) receives the IF-SEND command and will follow the TCG The OPAL standard utilizes password data to perform an AES unlocking operation and returns an IF-RECV command to the setup program. After receiving the IF-RECV command, the setup program parses the result data contained in the IF-RECV command. If the setup program determines that the encrypted SSD has been successfully unlocked based on the result data, the setup program notifies the operating system, allowing the encrypted SSD to be mounted on the operating system. The user can then view the encrypted SSD as mounted and accessible on the operating system.

[0011] Preferably, the setting program can display a hard disk list on the operation interface, in which multiple hard disk options are displayed, and each hard disk option represents one of the hard disks currently connected to the computer; before displaying the hard disk list, the setting program first executes the following procedures: a hard disk data acquisition step: through the operating system, obtain the hard disk information corresponding to all the hard disks currently connected to the computer; a hard disk information judgment step: judge whether each hard disk information contains a manufacturer default data; if it is determined that the hard disk information contains the manufacturer default data, the hard disk corresponding to the hard disk information is used as one of the hard disk options in the hard disk list.

[0012] Preferably, when one of the hard disk options in the hard disk list is selected, the operation interface will display the corresponding hard disk information in a hard disk information field of the operation interface, and the setting program will determine whether the corresponding hard disk supports TCG OPAL based on the hard disk information corresponding to the selected hard disk option. If the setting program determines that the hard disk corresponding to the hard disk option selected in the hard disk menu supports TCG OPAL, and the setting program determines that the hard disk corresponding to the selected hard disk option is connected to the computer via a USB port, the setting program will make the unlock option appear to be selectable; if the setting program determines that the hard disk corresponding to the hard disk option selected in the hard disk menu does not support TCG OPAL, the setting program will display the unlock option as disabled.

[0013] Preferably, the operation interface of the configuration program further includes a hard disk password setting input box, which is used to allow the user to set a hard disk password. When the user enters the hard disk password in the hard disk password setting input box and a corresponding password confirmation option in the operation interface is selected, the configuration program will use the hard disk password and at least one hard disk data corresponding to the encrypted solid-state drive to perform a hash process to generate a set password data. The configuration program will also transmit an IF-SEND command to the encrypted solid-state drive through the USB port of the operating system, and the IF-SEND command includes the set password data. After receiving the IF-SEND command, the self-encrypting drive of the encrypted solid-state drive will use the set password data to perform an AES encryption operation on the data in the encrypted solid-state drive in accordance with the TCG OPAL standard and return an IF-RECV command to the configuration program.

[0014] Preferably, when the configuration program executes a judgment procedure and determines, based on the port information, that the encrypted solid-state drive is not connected to the computer via a USB interface, the configuration program will disable the unlock option in the operation interface and display an image file loading option in the operation interface; when the image file loading option is selected, the configuration program will execute an image file loading procedure: a pre-boot authentication image file (PBA image) stored in a default path of the computer is stored in a shadow MBR region (Shadow MBR Region) of the self-encrypting drive of the encrypted solid-state drive.

[0015] Preferably, before the setting program executes the image file loading program, the setting program will first execute an identity authentication program. When the setting program executes the identity authentication program, the following steps will be executed: a password input requirement step: in the operation interface, the user is required to enter the hard disk password; a judgment step: judging whether the hard disk password entered by the user is correct; if it is determined that the hard disk password entered by the user is correct, the image file loading program will be executed; if it is determined that the password entered by the user is incorrect, the image file loading program will not be executed.

[0016] Preferably, when the setting program is executed in the operating system for the first time, the setting program will require the user to enter an initialization password in the operation interface; when the initialization password is entered in the initialization password input box and a corresponding password confirmation option in the operation interface is selected, the setting program will determine that the initialization password is correct, and then the setting program will transmit an initialization instruction to the self-encrypting drive in accordance with the TCG OPAL standard, so that the self-encrypting drive completes the initialization setting in the TCG OPAL standard; after the self-encrypting drive completes the initialization setting in the TCG OPAL standard, the setting program can provide the user with the ability to set a SID password and a hard disk password; after the SID password is set, the setting program can transmit a delete setting instruction to the self-encrypting drive in accordance with the TCG OPAL standard after the user enters the correct SID password in the operation interface, so that the self-encrypting drive clears the initialization setting, and the encrypted solid-state drive will appear in an unencrypted state; the setting program can provide the user with the ability to set a hard disk lock area during the process of setting the hard disk password; after the hard disk password and the hard disk lock area are set, the setting program will The OPAL standard transmits a setting instruction to the self-encrypting drive, so that the self-encrypting drive encrypts at least a portion of the disk area of ​​the encrypted solid-state drive according to the password data and the hard disk lock driver.

[0017] One embodiment of the present invention discloses an encrypted solid-state drive system, comprising: a configuration program of the present invention and an encrypted solid-state drive that complies with the TCG OPAL standard. When the encrypted solid-state drive leaves the factory, a pre-boot authentication image (PBA image) is not stored in a shadow MBR region of a self-encrypting drive (SED) of the encrypted solid-state drive, and the encrypted solid-state drive can be connected to a computer via a USB port.

[0018] In summary, the configuration program and encrypted SSD system of the present invention allow a user, while a computer is running an operating system, to directly use the configuration program to encrypt or unlock a TCG OPAL-compliant encrypted SSD connected to the computer via a USB port. After the user completes the configuration (encryption or unlocking) of the TCG OPAL-compliant encrypted SSD using the configuration program, the user can directly access data on the encrypted SSD within the operating system.

[0019] To further understand the features and technical contents of the present invention, please refer to the following detailed description and drawings of the present invention. However, such description and drawings are only used to illustrate the present invention and are not intended to limit the scope of protection of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] FIG1 is a block diagram of a computer and an encrypted solid-state drive installed with the configuration program of the present invention.

[0021] FIG. 2 is a schematic diagram of an operation interface of a setting program of the present invention.

[0022] FIG. 3 is a schematic diagram showing a hard disk password authentication window displayed on the operation interface of the setting program of the present invention.

[0023] FIG4 is a block diagram of an encrypted solid-state drive system according to the present invention.

[0024] FIG. 5 is a schematic diagram of an operation interface of a setting program of the encrypted solid-state hard disk system of the present invention.

[0025] FIG6 is a schematic diagram of another embodiment of the operation interface of the encrypted solid-state drive system of the present invention. DETAILED DESCRIPTION

[0026] In the following description, if it is indicated to refer to a specific figure or as shown in a specific figure, it is only used to emphasize that most of the relevant content described in the subsequent description appears in the specific figure, but it does not limit the subsequent description to only referring to the specific figure.

[0027] Please refer to Figures 1 to 3. Figure 1 is a block diagram of a computer and an encrypted solid-state drive installed with the configuration program of the present invention. Figure 2 is a schematic diagram of the configuration program's user interface. Figure 3 is a schematic diagram of the configuration program's user interface displaying a hard drive password authentication window. The following description uses the TCG OPAL 2.0 standard for illustration, but the present invention is not limited to application to the TCG OPAL 2.0 standard. If TCG OPAL proposes a new standard, as long as the updated standard still includes the relevant command transmission functions, password setting functions, initialization settings functions, and factory reset functions described below, the present invention can still be applied to the updated TCG OPAL standard. Similarly, the present invention is also generally applicable to the TCG OPAL 1.0 standard.

[0028] The configuration program 112 of the present invention can be executed on an operating system 111 of a computer 100. The operating system 111 is executed by a processor 11 of the computer 100. In practical applications, the operating system 111 is, for example, a Windows operating system or a Linux operating system; the computer 100 is, for example, a desktop computer or a laptop computer; and the processor 11 is the central processing unit (CPU) of the computer 100. In practice, a user can download the configuration program 112 of the present invention from the official website of the manufacturer that developed the configuration program 112 of the present invention using various web browsers in a Windows operating system or a Linux operating system, and then install the configuration program 112 in the Windows operating system or the Linux operating system.

[0029] The configuration program 112 of the present invention includes an operation interface 113 for providing user operations so that the configuration program 112 can configure an encrypted solid-state drive 200 that complies with the TCG OPAL 2.0 standard and is connected to the computer 100 (for example, performing AES encryption, AES unlocking, data erasure, etc. on the encrypted solid-state drive 200).

[0030] When the configuration program 112 is executed in the operating system 111, the configuration program 112 will execute a determination procedure: obtaining port information from the operating system 111 and, based on the port information, determining whether the encrypted solid-state drive 200 is connected to the computer 100 via a USB port 12 of the computer 100. If the configuration program 112 determines, based on the port information, that the encrypted solid-state drive 200 is connected to the computer 100 via the USB port 12 of the computer 100, the configuration program 112 will display an unlock option 1131 on the operation interface 113. In one embodiment, if the configuration program 112 is installed in the Windows operating system, the configuration program 112 may obtain the port information via the Windows Socket API during the determination step, for example.

[0031] In one embodiment, the setting program 112 may display a prompt message 1132 in the operation interface 113 to prompt the user whether the currently selected hard disk is connected to the computer 100 via the USB port 12 .

[0032] On the contrary, if the configuration program 112 determines based on the port information that the encrypted SSD 200 is not connected to the computer 100 via the USB port 12 of the computer 100 (for example, the encrypted SSD 200 is connected to the computer 100 via the SATA port 13), the configuration program 112 will disable the unlock option 1131 in the operation interface 113, and the user cannot click the unlock option 1131 in the operation interface 113.

[0033] As shown in Figures 2 and 3, when the unlock option 1131 is selected, the setup program 112 will display a hard disk password authentication window 1133. The hard disk password authentication window 1133 includes a hard disk password input box 11331 and a password confirmation option 11332. When the user enters a hard disk password in the hard disk password input box 11331 and the password confirmation option 11332 is selected on the operation interface 113, the setup program 112 will execute a hashing process and a transmission process. The hashing process is that the setup program 112 obtains at least one piece of hard disk data corresponding to the encrypted solid-state drive 200 (e.g., the encrypted solid-state drive's Model Name) through the operating system 111 and performs a hashing process using the hard disk data and the hard disk password in the hard disk information to generate password data A1. The transmission process is that the setup program 112 transmits an IF-SEND command A to a self-encrypting drive (SED) 21 of the encrypted solid-state drive 200 through the USB port 12 of the operating system 111. The IF-SEND command A includes the password data A1. The self-encrypting drive 21 is connected to the multiple memories 22 in the encrypted solid-state drive 200. The detailed connection and operation of the self-encrypting drive 21 and the memories 22 are designed in accordance with the TCG OPAL 2.0 standard and will not be repeated here.

[0034] In actual applications, the configuration program 112 can obtain hard disk information corresponding to the encrypted solid-state drive 200 through the operating system 111. The hard disk information can include multiple hard disk data, such as the model name, serial name, firmware version, TCG feature support, etc. The configuration program 112 can, for example, use the hard disk data with unique characteristics in the hard disk information (such as the serial name) and the hard disk password to perform a hash process to generate unique password data A1.

[0035] Through the design of the above-mentioned hashing procedure, even if an ill-intentioned person extracts the IF-SEND command A transmitted by the setting program 112 to the encrypted solid-state drive 200 when the setting program 112 executes the transmission procedure and obtains the password data A1 in the IF-SEND command A, it is still difficult for the ill-intentioned person to know the hard disk password entered by the user in the hard disk password setting field 1134.

[0036] After receiving the IF-SEND command A, the self-encrypting drive 21 of the encrypted solid-state drive 200 compliant with the TCG OPAL 2.0 standard will perform an AES decryption operation on the data in the memory 22 using the cryptographic data A1 in accordance with the TCG OPAL 2.0 standard and return an IF-RECV command B to the setup program 112. Specifically, after receiving the IF-SEND command A, the self-encrypting drive 21 will use the cryptographic data A1 as the authentication key and utilize a KDF (Key Derivation Function) to generate a KEK (Key Encryption Key). The KEK is then used to decrypt the MEK (Media Encryption Key), which is then used by the AES engine to decrypt the data in the memory 22 using the MEK. The relevant operation procedures for the authentication key, KDF, KEK, MEK, and AES engine, as well as their actual execution, are designed in accordance with the TCG OPAL 2.0 standard and will not be further described here. After the self-encrypting drive 21 completes the AES unlocking (or encryption) operation on the data in the memory 22 of the encrypted solid state drive 200 using the password data A1 , the self-encrypting drive 21 returns the IF-RECV command B to the setup program 112 via the USB port 12 .

[0037] After receiving IF-RECV command B, configuration program 112 parses result data B1 contained in IF-RECV command B. If configuration program 112 determines, based on result data B1, that the encrypted SSD 200 has been successfully unlocked, configuration program 112 notifies operating system 111, causing encrypted SSD 200 to be mounted on operating system 111. This allows the user to view the mounted, accessible encrypted SSD 200 on operating system 111. The specific content of result data B1 can be designed in accordance with the TCG OPAL 2.0 standard and is not limited herein. More specifically, when the configuration program 112 determines that the encrypted SSD 200 has been successfully unlocked based on the result data B1, the configuration program 112 written in C# can send a notification to the Windows window through a function such as WM_DEVICECHANGE. Then, the Windows PNP (Plug and Play) will rescan the hardware devices in the system and display the unlocked encrypted SSD 200 in the file explorer. In this way, the user can view the encrypted SSD 200 as unlocked and accessible on pages such as the file explorer.

[0038] Specifically, when a user connects an encrypted solid-state drive 200 (i.e., the user has set a hard disk password, or the encrypted solid-state drive has a default hard disk password when it leaves the factory) on a computer 100 running an operating system 111, the user will see prompt text such as "This hard drive is not initialized" on the relevant disk management page of the operating system 111 (such as My Computer in the Windows operating system). At this time, the user cannot access any data in the encrypted solid-state drive 200.

[0039] If the user sees a prompt such as "This hard disk is not initialized" on the relevant disk management page of the operating system 111, the user can open the setting program 112 of the present invention in the operating system 111. When the encrypted solid-state drive 200 is connected to the computer 100 via the USB port 12, the user can select the unlock option 1131 in the operation interface 113. In this way, the setting program 112 will execute the aforementioned hashing process and transfer process. If the user selects the unlock option 1131 and enters the correct hard disk password, the setting program 112 will unlock the encrypted solid-state drive 200, and the user can access the encrypted solid-state drive 200 on the relevant disk management page of the operating system 111 of the computer 100.

[0040] As shown in FIG2 , in actual use, the operation interface 113 of the configuration program 112 may further include a password setting field 1134. The password setting field 1134 includes a password setting input box 11341, a password confirmation option 11342, and a password option 11343. Password option 11343 may include, for example, three options: an initialization password, a SID password, and a hard drive password. When the encrypted solid-state drive 200 is connected to the computer 100 for the first time via the USB port 12 of the computer 100, and the encrypted solid-state drive 200 is unencrypted and uninitialized, the user may first select the initialization password option in password option 11343, then enter an initialization password in password setting input box 11341, and finally select password confirmation option 11342. The setup program 112 will then determine whether the initialization password is correct. If the setup program 112 determines that the initialization password is correct, the setup program 112 will transmit an initialization command to the self-encrypting drive 21 via the USB port 12 in accordance with the TCG OPAL 2.0 standard, so that the self-encrypting drive 21 completes the initialization settings in accordance with the TCG OPAL 2.0 standard. After the self-encrypting drive 21 completes the initialization settings in accordance with the TCG OPAL 2.0 standard, the self-encrypting drive 21 will return relevant information to the setup program 112 via the USB port 12. The detailed process of transmitting the command to the self-encrypting drive 21 to complete the initialization settings is a standard process specified in the TCG OPAL 2.0 standard and will not be repeated here. The initialization password refers to the factory default password of the encrypted solid-state drive 200 (usually recorded in the operating manual / instruction manual of the encrypted solid-state drive published by the manufacturer).

[0041] It should be noted that if the encrypted SSD 200 has not been initialized and configured in accordance with the TCG OPAL 2.0 standard, the user cannot directly set an encryption password for the encrypted SSD 200. Furthermore, the user cannot access the encrypted SSD 200 or set a hard drive password for the encrypted SSD 200 in the Windows operating system of the computer without using the setup program 112.

[0042] When the configuration program 112 receives the relevant information returned by the self-encrypting drive 21 after completing the initialization configuration, the state of the encrypted solid-state drive 200 will be converted to a state in which a hard disk password can be set. At this time, the user can first select the hard disk password option in the password option in the password setting field 1134 in the operation interface 113, then enter the hard disk password in the password setting input box 11341, and finally click the password confirmation option 11342. Then, the configuration program 112 will use the hard disk password and at least one hard disk data in the hard disk information corresponding to the encrypted solid-state drive 200 to perform a hash process to generate a set password data. The configuration program 112 will also transmit an IF-SEND command to the encrypted solid-state drive 200 through the USB port 12 of the operating system 111, and the IF-SEND command includes the set password data. After receiving the IF-SEND command, the self-encrypting drive 21 of the encrypted solid-state drive 200 will use the set password data to perform an AES encryption operation on the data of the encrypted solid-state drive 200 in accordance with the TCG OPAL 2.0 standard to complete the initialization operation of the encrypted solid-state drive 200. The self-encrypting drive 21 will then return an IF-RECV command to the setup program 112.

[0043] Continuing with the above, after the configuration program 112 receives the IF-RECV command sent back from the encryption driver 21, the configuration program 112 may, for example, display a prompt window or a prompt message such as "The encrypted solid-state drive has been encrypted using the entered hard disk password" on the operation interface 113 to inform the user that the encryption of the encrypted solid-state drive 200 has been completed. After the encrypted encrypted solid-state drive 200 is powered on again and connected to the computer 100 via the USB port 12 of the computer 100, the user must select the unlock option 1131 in the configuration program 112 and enter the correct hard disk password to unlock the encrypted solid-state drive 200.

[0044] As shown in FIG2 , in actual application, after the user completes setting the hard disk password in the password setting field 1134, the setting program 112 may also first require the user to set the password in a lock area setting field 1135 of the operation interface 113. After the user completes setting the lock area setting field 1135, the setting program 112 executes the aforementioned subsequent procedures such as generating the setting password data.

[0045] Lock area setting field 1135 may include a lock area selection option 11351, three status options 11352, two sector input boxes 11353, and a confirmation option 11354. Lock area selection option 11351 may include two options, 0 and 1, and the three status options 11352 may be Unencrypted (Unlock), Read Only (ReadOnly), and Encrypted (Lock), respectively. When using a Windows operating system, the user may first select option 0 in lock area selection option 11351, then select Unencrypted (Unlock), Read Only (ReadOnly), or Encrypted (Lock) as needed, and finally click confirmation option 11354. Conversely, when using a Linux operating system, the user may select option 1 in lock area selection option 11351, then select Unencrypted (Unlock), Read Only (ReadOnly), or Encrypted (Lock) as needed, and then enter the start and end locations of the disk in the two sector setting boxes 11353 as needed.

[0046] As described above, after the user completes the hard disk password setting in the password setting field 1134 and completes the relevant settings in the lock area setting field 1135 as needed, when the user clicks the confirmation option 11354, the configuration program 112 will execute the aforementioned process to generate the set password data. The configuration program 112 will also include the relevant data set by the user in the lock area setting field 1135 in the IF-SEND command transmitted to the encrypted solid-state drive 200 (the content and format of this data comply with the TCG OPAL 2.0 standard and will not be further described here). When the self-encrypting drive 21 receives the IF-SEND command, it will encrypt the corresponding sector based on the set password data and the relevant disk area configuration data contained in the IF-SEND command. For example, if the user, in a Windows operating system, selects option 0 in the locked area selection option 11351 and selects Lock in the locked area setting field 1135, the self-encrypting drive 21 will encrypt the entire encrypted solid-state drive 200. In another example, if the user, in a Linux system, selects option 1 in the locked area selection option 11351 and selects Lock in the locked area setting field 1135, and enters the start and end positions of the disk in the sector input box 11353, the self-encrypting drive 21 will encrypt the encrypted solid-state drive 200 from the start position to the end position of the specified disk.

[0047] As shown in Figure 2, it is worth mentioning that in one of the variant embodiments, when the setting program 112 is executed in the operating system 111, the setting program 112 can display a hard disk list 1137 in the operation interface 113, and the hard disk list 1137 displays multiple hard disk options 11371, each hard disk option 11371 represents one of the hard disks currently connected to the computer 100.

[0048] When one of the hard drive options 11371 in the hard drive list 1137 is selected, the operation interface 113 will display the corresponding hard drive information in a hard drive information field 1138 of the operation interface 113. The configuration program 112 will determine whether the corresponding hard drive supports TCG OPAL 2.0 based on the hard drive information corresponding to the selected hard drive option 11371. If the configuration program 112 determines that the hard drive corresponding to the hard drive option 11371 selected in the hard drive menu supports TCG OPAL 2.0, and the configuration program 112 determines that the hard drive is connected to the computer via a USB port, the configuration program 112 will display the unlock option 1131 as selectable. If the configuration program 112 determines that the hard drive corresponding to the hard drive option 11371 selected in the hard drive menu does not support TCG OPAL 2.0, the configuration program 112 will display the unlock option 1131 as disabled.

[0049] More specifically, the configuration program 112 executes the following procedures before displaying the hard disk list 1137:

[0050] A hard disk data acquisition step: obtaining hard disk information corresponding to all hard disks currently connected to the computer 100 through the operating system 111;

[0051] A hard disk information determination step: determining whether each hard disk information contains a manufacturer default data; if it is determined that the hard disk information contains the manufacturer default data, the hard disk corresponding to the hard disk information is used as one of the hard disk options 11371 in the hard disk list 1137.

[0052] Through the above-mentioned hard drive list 1137 and other designs, users can only use the configuration program 112 to configure the encrypted SSD 200 produced by a specific manufacturer. In other words, if the user purchases an encrypted SSD produced by another manufacturer, the user must still use traditional operations to connect the encrypted SSD to the computer via the SATA port and configure the encrypted SSD through the BIOS system.

[0053] In summary, the configuration program 112 of the present invention allows the user to encrypt or unlock the encrypted SSD 200 directly through the configuration program 112 when the computer is already running the operating system and the encrypted SSD 200 is connected to the computer 100 via the USB port 12 of the computer 100 .

[0054] Please refer to Figures 4 and 5 . Figure 4 is a block diagram of the encrypted solid-state drive system of the present invention, and Figure 5 is a diagram of the user interface of the configuration program of the encrypted solid-state drive system of the present invention. The encrypted solid-state drive system 300 of the present invention includes the configuration program 112 of the present invention and an encrypted solid-state drive 200 that complies with the TCG OPAL 2.0 standard.

[0055] When the encrypted SSD 200 leaves the factory, a pre-boot authentication image (PBA Image) C is not stored in a shadow MBR region (Shadow MBR Region) 211 of the self-encrypting drive (SED) of the encrypted SSD 200, and the encrypted SSD 200 can be connected to the computer 100 via the USB port 12. In one embodiment, the encrypted SSD 200 itself may not have a USB interface. Instead, the encrypted SSD 200 may use a USB adapter card to convert the original SATA interface of the encrypted SSD 200 into a USB interface, and then connect to the USB port 12 of the computer 100 via the USB interface.

[0056] The encrypted SSD 200 of the encrypted SSD system 300 of the present invention does not store the pre-boot authentication image file C when it leaves the factory. Therefore, after a user purchases the encrypted SSD 200 and connects the encrypted SSD 200 to the computer 100 via the SATA port 13 of the computer 100, the user will not be able to configure the encrypted SSD 200 in the BIOS system of the computer 100 because the pre-boot authentication image file C is not stored in the encrypted SSD 200.

[0057] It is important to note that all commonly available encrypted SSDs that comply with the TCG OPAL 2.0 standard have a pre-boot authentication image (PBA Image) stored in their internal Shadow MBR Region when they leave the factory. After purchasing this encrypted SSD, consumers must use their computer's BIOS to activate the pre-stored PBA Image in the encrypted SSD to enter the PBA (Pre-Boot Authentication) system and configure the encrypted SSD.

[0058] The configuration program 112 described in this embodiment can execute all the procedures of the aforementioned embodiments. Furthermore, when the configuration program 112 of this embodiment executes the aforementioned determination procedure, if, based on the port information, it is determined that the encrypted solid-state drive 200 is not connected to the computer 100 via a USB interface, the configuration program 112 will disable the unlock option 1131 on the operation interface 113 and display a pre-boot authentication field 1139 on the operation interface 113. The pre-boot authentication field 1139 includes an image file selection input box 11391, an image file load option 11392, and a path selection option 11393.

[0059] When a default path is entered into image file selection input box 11391 and image file loading option 11392 is selected, configuration program 112 executes an image file loading process: a pre-boot authentication image file C stored in the default path of computer 100 is stored in the shadow MBR area 211 of the self-encrypting drive (SED) of encrypted solid-state drive 200. The specific implementation method of configuration program 112 for storing pre-boot authentication image file C in the shadow MBR area 211 of the self-encrypting drive 21 of encrypted solid-state drive 200 via SATA port 13 of computer 100 is designed in accordance with the TCG OPAL 2.0 specification and will not be further described herein.

[0060] In actual application, the user can also click the path selection option 11393 to cause the setting program 112 to display a file selection window (for example, a file selection folder of Windows), and the user can operate the file selection window to select the pre-boot authentication image file C that has been stored in Windows; after the user operates the file selection window and selects a specific pre-boot authentication image file C, the setting program 112 will be able to obtain the path of the pre-boot authentication image file C stored in the operating system 111, and use the path as the default path.

[0061] After the configuration program 112 stores the pre-boot authentication image file C in the shadow MBR area 211 of the encrypted solid-state drive 200, the configuration program 112 may, for example, display a prompt window, and the user may see a prompt such as "Please restart the computer and execute the pre-boot authentication image file in the BIOS system to enter the PBA system" in the prompt window. After the user restarts the computer and enters the PBA system of the encrypted solid-state drive 200 through the computer's BIOS system, the user can then configure the encrypted solid-state drive 200 in the PBA system. For example, the user can configure the PBA system to use the encrypted solid-state drive 200 as a system drive (i.e., the encrypted solid-state drive stores an operating system).

[0062] It is worth mentioning that after the user stores the pre-boot authentication image file C in the shadow MBR area 211 of the encrypted solid-state drive 200 through the setup program 112, when the user uses the computer's BIOS system to enter the PBA system of the encrypted solid-state drive 200, the PBA system will require the user to enter the hard disk password. If the user enters the hard disk password correctly, the user can use the PBA system to make relevant settings for the data in the encrypted solid-state drive 200. It should be noted that the hard disk password required by the PBA system is the password entered by the user in the hard disk password setting input box 11341 through the setup program 112, or the original default hard disk password of the encrypted solid-state drive 200.

[0063] In actual application, when the image file loading option 11392 is selected, the setting program 112 may first execute an identity authentication procedure before executing the image file loading procedure. When the setting program 112 executes the identity authentication procedure, the following steps are performed:

[0064] A password input request step: In the operation interface 113, the user is required to enter the hard disk password;

[0065] A judgment step: judging whether the hard disk password input by the user is correct; if it is determined that the hard disk password input by the user is correct, executing the image file loading program; if it is determined that the password input by the user is incorrect, not executing the image file loading program.

[0066] That is, the user must first enter the correct hard disk password before the configuration program 112 will execute the image file loading procedure and store the pre-boot authentication image file C in the user-specified default path in the shadow MBR area 211 of the encrypted solid-state drive 200. Otherwise, the configuration program 112 will not store the pre-boot authentication image file C in the shadow MBR area 211 of the encrypted solid-state drive 200. This design ensures that only users with the hard disk password can load the pre-boot authentication image file C into the encrypted solid-state drive 200, while users without the hard disk password will not be able to load the pre-boot authentication image file C into the encrypted solid-state drive 200.

[0067] It is worth noting that when the configuration program 112 of this embodiment is executed in the operating system 111, the configuration program 112 will initially display the aforementioned hard disk list 1137 on the operation interface 113. For a description of the hard disk list 1137, please refer to the previous embodiment and will not be repeated here. By utilizing the design of the hard disk list 1137 and other features, the user can only use the configuration program 112 to load an image file from an encrypted solid-state drive 200 manufactured by a specific manufacturer. This prevents the user from accidentally storing the pre-boot authentication image file C via the configuration program 112 into an encrypted solid-state drive manufactured by another manufacturer, which could potentially cause errors in the encrypted solid-state drive.

[0068] Please refer to Figure 6, which is a schematic diagram of another embodiment of the user interface of the encrypted solid-state drive system of the present invention. In actual applications, the user interface 113 may also include a reset field 1140. Reset field 1140 may include a password input box 11401, a reset option 11402, and an OK option 11403. Reset option 11402 may, for example, be a drop-down menu containing three options: PSID (Physical Security ID), Clear Password Settings, and Restore Factory Settings. If the user forgets the hard disk password and wishes to restore the encrypted SSD 200 to its factory default state, the user can select the PSID option in the reset option 11402 and enter the PSID (Physical Security ID) of the encrypted SSD 200 in the password input box 11401. The configuration program 112 can then send an IF-SEND command to the self-encrypting drive 21. The IF-SEND command includes the PSID and a factory reset message. Upon receiving the command, the self-encrypting drive 21 will restore the encrypted SSD 200 to its factory default state. In other words, all data in the encrypted SSD 200 will be deleted and the hard disk password of the encrypted SSD 200 will be reset to the factory default state. Generally, the PSID of the encrypted SSD 200 is usually printed on the label or casing of the encrypted SSD 200, and the default hard disk password of the encrypted SSD 200 is usually displayed in the manual or on the label or casing of the encrypted SSD 200. The specific contents of restoring factory settings follow the TCG OPAL 2.0 standard and will not be elaborated here.

[0069] In the case where the user remembers the hard disk password but wants to delete the password setting in the encrypted solid-state hard disk 200 and retain the data, the user can, for example, select the "Clear password setting" option in the reset option 11402 and enter the hard disk password in the password input box 11401. The setting program 112 will send an IF-SEND instruction to the self-encrypting drive 21. The IF-SEND instruction to the self-encrypting drive 21 will include a clear password data. After receiving the instruction, the self-encrypting drive 21 will delete the password setting in the encrypted solid-state hard disk 200, but will not delete the data in the memory. Then, the user can use the setting program 112 to re-set the hard disk password for the encrypted solid-state hard disk 200.

[0070] Referring back to FIG2 , in actual use, within the password setting field 1134 of the operation interface 113, the user can first select the SID password option in the password option 11343, then enter a SID password (the user's own password) in the password setting input box 11341, and finally click the password confirmation option 11342. The configuration program 112 will then save the user-entered SID password. As shown in FIG6 , if the user wishes to restore the encrypted SSD 200 to factory settings and has already set a SID password, the user can select the "Restore Factory Settings" option in the reset option 11402 and enter the SID password in the password input box 11401. The configuration program 112 will then send a corresponding IF-SEND command to the self-encrypting drive 21. Upon receiving the IF-SEND command, the self-encrypting drive 21 will restore the encrypted SSD 200 to factory settings.

[0071] As described above, when the user wants to restore the encrypted SSD 200 to factory settings, the user can select the corresponding reset option 11402 in the reset field 1140 of the operation interface 113 of the setting program 112 according to the needs, and enter the corresponding password in the password input box 11401.

[0072] In summary, the encrypted SSD system of the present invention, through the configuration program and the design of the encrypted SSD, allows users to purchase an encrypted SSD and, whether using it as a system drive or a data drive, simply connect the encrypted SSD to the computer through a port while running an operating system. The user can then directly use the configuration program to set a hard drive password for the encrypted SSD. This design allows users to easily complete the configuration of the encrypted SSD.

[0073] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Therefore, any equivalent technical changes made using the contents of the present invention description and drawings are included in the protection scope of the present invention.

Claims

1. A setting program, characterized in that: The setting program can be executed in an operating system of a computer, and the operating system is executed by a processor of the computer. The setting program includes an operation interface, and the operation interface is used to provide user operations so that the setting program can set an encrypted solid-state hard disk that complies with the TCG OPAL standard and is connected to the computer; when the setting program is executed in the operating system, the setting program can obtain port information through the operating system; if the setting program determines that the encrypted solid-state hard disk is connected to the computer through the USB port of the computer based on the port information, the setting program will display an unlock option in the operation interface; When the unlock option is selected and a hard disk password is input into the operation interface, the setting program can successively execute a hashing program and a transmission program. In the hashing program, the setting program obtains at least one hard disk data corresponding to the encrypted solid state drive through the operating system, and performs hashing processing using the hard disk data and the hard disk password to generate a password data; in the transmission program, the setting program transmits an IF-SEND command to a self-encrypting drive of the encrypted solid state drive through the USB port of the operating system, and the password data is included in the IF-SEND command; the self-encrypting drive receives the IF-SEND command, and performs an AES unlocking operation using the password data in accordance with the TCG OPAL standard, and returns an IF-RECV command to the setting program; After receiving the IF-RECV instruction, the setting program will parse the result data contained in the IF-RECV instruction; if the setting program determines that the encrypted solid-state drive has been successfully unlocked based on the result data, the setting program will notify the operating system so that the encrypted solid-state drive is mounted on the operating system, and the user can view the encrypted solid-state drive that has been mounted and can access data in the operating system.

2. The setting program according to claim 1, characterized in that: The setting program can display a hard disk list on the operation interface, wherein the hard disk list displays a plurality of hard disk options, each of which represents one of the hard disks currently connected to the computer; before displaying the hard disk list, the setting program first executes the following procedures: A hard disk data acquisition step: obtaining hard disk information corresponding to all hard disks currently connected to the computer through the operating system; A hard disk information determination step: determining whether each of the hard disk information contains a manufacturer default data; if it is determined that the hard disk information contains the manufacturer default data, the hard disk corresponding to the hard disk information is used as the hard disk list; One of the hard drive options described in the table.

3. The setting program according to claim 2, characterized in that: When one of the hard disk options in the hard disk list is selected, the operation interface will display the corresponding hard disk information in a hard disk information field of the operation interface, and the setting program will determine whether the corresponding hard disk supports TCG OPAL based on the hard disk information corresponding to the selected hard disk option. If the setting program determines that the hard disk corresponding to the hard disk option selected in the hard disk menu supports the TCG OPAL, and the setting program determines that the hard disk corresponding to the selected hard disk option is connected to the computer through the USB port, the setting program will make the unlock option appear to be selectable; if the setting program determines that the hard disk corresponding to the hard disk option selected in the hard disk menu does not support the TCG OPAL, the setting program will display the unlock option as disabled.

4. The setting program according to claim 1, characterized in that: The operation interface of the setting program further includes a hard disk password setting input box, and the hard disk password setting input box is used to provide the user with the hard disk password; when the hard disk password setting input box is input by the user and a password confirmation option corresponding to the operation interface is selected, the setting program will use the hard disk password and at least one hard disk data corresponding to the encrypted solid-state hard disk to perform hash processing to generate a setting password data, and the setting program will transmit an IF-SEND command to the encrypted solid-state hard disk through the USB port of the operating system, and the IF-SEND command includes the setting password data; after the self-encrypting drive of the encrypted solid-state hard disk receives the IF-SEND command, it will follow the TCG OPAL standard and use the setting password data to perform AES encryption on the data in the encrypted solid-state hard disk, and return an IF-RECV command to the setting program.

5. The setting program according to claim 4, characterized in that: The setting program executes the judgment program, and when it is determined, based on the port information, that the encrypted solid-state drive is not connected to the computer via a USB interface, the setting program will disable the unlock option in the operation interface and display an image file loading option in the operation interface; when the image file loading option is selected, the setting program will execute an image file loading program: a pre-boot identity authentication image file stored in a default path of the computer is stored in a shadow MBR area of ​​the self-encrypting drive of the encrypted solid-state drive.

6. The setting program according to claim 5, characterized in that: Before the configuration program executes the image file loading program, the configuration program will first execute an identity authentication program. When the configuration program executes the identity authentication program, the following steps will be performed: A password input request step: in the operation interface, the user is required to input the hard disk password; A judgment step: judging whether the hard disk password input by the user is correct; if the hard disk password input by the user is correct, If the password input by the user is correct, the image file loading program is executed; if it is determined that the password input by the user is incorrect, the image file loading program is not executed.

7. The setting program according to claim 1, characterized in that: When the setting program is executed in the operating system for the first time, the setting program will require the user to enter an initialization password in the operation interface; when the initialization password is entered in the initialization password input box and a password confirmation option corresponding to the operation interface is selected, the setting program determines that the initialization password is correct, and then the setting program transmits an initialization instruction to the self-encrypting drive in accordance with the TCG OPAL standard, so that the self-encrypting drive completes the initialization setting in the TCG OPAL standard; after the self-encrypting drive completes the initialization setting in the TCG OPAL standard, the setting program can provide the user with a SID password and the hard disk password; after the SID password is set, the setting program can transmit a delete setting instruction to the self-encrypting drive in accordance with the TCG OPAL standard after the user enters the correct SID password in the operation interface, so that the self-encrypting drive clears the initialization setting, and the encrypted solid state drive will be in an unencrypted state; the setting program can provide the user with a hard disk lock area during the process of setting the hard disk password; after the hard disk password and the hard disk lock area are set, the setting program will The OPAL standard transmits a setting instruction to the self-encrypting drive, so that the self-encrypting drive encrypts at least a portion of the disk area of ​​the encrypted solid state drive according to the password data and the hard disk lock driver.

8. An encrypted solid state hard disk system, characterized in that: The encrypted solid-state drive system comprises: a setting program according to any one of claims 1 to 7 and an encrypted solid-state drive that complies with the TCG OPAL standard; when the encrypted solid-state drive leaves the factory, a pre-boot authentication image file is not stored in a shadow MBR area of ​​a self-encrypting drive of the encrypted solid-state drive, and the encrypted solid-state drive can be connected to the computer via the USB port.

Images