Hard disk control method, hard disk, computer program product, device and medium

Abstract

The present application relates to the technical field of storage, and in particular to a hard disk control method, a hard disk, a computer program product, a device, and a medium. The hard disk control method comprises: acquiring a hard disk access request; identifying a space state of a target address of the hard disk access request, wherein the space state comprises an encrypted state and a non-encrypted state, and the hard disk comprises a plurality of storage units, the space state of at least one storage unit is preset to be the encrypted state, and the space state of at least one storage unit is preset to be the non-encrypted state, and / or the space state of at least one storage unit is configurable; and in response to the storage unit to which the target address belongs being in the encrypted state, performing identity authentication on a requester of the hard disk access request, so as to allow response to the hard disk access request when the requester passes the identity authentication. By using the method, an encrypted storage unit and a non-encrypted storage unit can be compatible on a hard disk, thereby ensuring data security while taking into account data storage flexibility.

Description

Hard disk control methods, hard disks, computer program products, devices and media

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202411204514.9, filed on August 30, 2024, entitled "Hard Disk Control Method, Hard Disk, Computer Program Product, Device and Media", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of storage technology, and in particular to a hard disk control method, a hard disk, a computer program product, a computer device, and a computer-readable storage medium. Background Technology

[0004] With the development and expansion of applications of technologies such as cloud computing, the Internet of Things, and mobile computing, information technology is becoming increasingly important in social production and daily life. Portable solid-state drives (SSDs) with technologies such as SSDs (Solid State Disks) have advantages such as high storage efficiency, portability, ample capacity, and light weight, and are typically used as portable persistent storage devices.

[0005] At the same time, the security requirements and emphasis on information storage are increasing, and the security requirements for different types of data are also different. For publicly available learning materials and notes, which can be considered public information, encryption may not be necessary. However, highly private information such as bank account information and website login information usually requires encrypted storage. However, current technologies have not adequately addressed the storage problem for data with both encryption requirements, often focusing on only one encryption level, which can easily lead to poor data security or cumbersome access processes. Alternatively, storing different encryption requirements on multiple hard drives is inconvenient and makes it difficult to distinguish and manage. Summary of the Invention

[0006] This application provides a hard disk control method, a hard disk, a computer program product, a computer device, and a computer-readable storage medium.

[0007] On one hand, a hard disk control method is provided, comprising: acquiring a hard disk access request; identifying the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state, and the hard disk includes multiple storage units; the spatial state of at least one storage unit is pre-set to an encrypted state, and the spatial state of at least one storage unit is pre-set to an unencrypted state; and / or, the spatial state of at least one storage unit is configurable; and in response to the storage unit to which the target address belongs being in an encrypted state, authenticating the requester of the hard disk access request, so as to allow the response to the hard disk access request if the requester is authenticated.

[0008] In some embodiments of this application, identifying the spatial state of the target address of a hard disk access request includes: parsing the target address of the hard disk access request; querying an encrypted configuration table to obtain the access mode of the storage unit to which the target address belongs; wherein the encrypted configuration table includes the access mode of the storage unit within the hard disk; and determining the spatial state of the target address based on the access mode.

[0009] In some embodiments of this application, the hard disk includes a first storage module and a second storage module; wherein, the first storage module includes a plurality of accessible storage units, and the second storage module hides the access channel from the outside of the hard disk; querying the encrypted configuration table includes: accessing the second storage module and performing a read operation on the encrypted configuration table stored in the second storage module.

[0010] In some embodiments of this application, the access mode includes at least a pass-through mode, a first medium mode, and a second medium mode; wherein, the encryption / decryption complexity of the first medium mode is higher than that of the second medium mode; determining the spatial state of the target address based on the access mode includes: determining the spatial state of the target address as unencrypted in response to the access mode being a pass-through mode; and determining the spatial state of the target address as encrypted in response to the access mode being a first medium mode or a second medium mode.

[0011] In some embodiments of this application, the hard disk includes a second storage module that is relatively hidden from the outside; the hard disk control method further includes: constructing an encrypted configuration table in the second storage module; wherein the encrypted configuration table includes access modes of storage units within the hard disk; when the storage unit is in an encrypted state, the encrypted configuration table also includes encrypted data for encrypting the storage unit; and in response to obtaining a management instruction for managing the storage unit, adjusting the information associated with the target storage unit in the encrypted configuration table based on the management instruction.

[0012] In some embodiments of this application, the management instruction includes a new instruction for creating a new storage unit or setting an idle storage unit; adjusting the information associated with the target storage unit in the encryption configuration table based on the management instruction includes: identifying that the new instruction carries an encryption medium, encrypting the target storage unit of the new instruction using the encryption medium; and writing the encryption medium into the encryption configuration table and associating it with the target storage unit to authenticate the requester accessing the target storage unit based on the encryption configuration table.

[0013] In some embodiments of this application, the encryption medium includes an access password; encrypting the target storage unit of the new instruction using the encryption medium includes locking the target storage unit using the access password; and writing the encryption medium into the encryption configuration table includes obtaining a root key generated by the hard disk, encrypting the access password using the root key, and writing the encrypted access password into the encryption configuration table.

[0014] In some embodiments of this application, the encryption medium includes an encryption key; writing the encryption medium into the encryption configuration table includes: obtaining a root key generated by the hard disk, encrypting the encryption key using the root key; obtaining a random key generated by the hard disk, encrypting the random key using the root key; and writing the encrypted root key and random key as encrypted data into the encryption configuration table.

[0015] In some embodiments of this application, the hard disk control method includes: fusing an encryption key and a random key to obtain a fused key; and using the fused key to encrypt data in a target storage unit.

[0016] In some embodiments of this application, the hard disk includes a first storage module and a second storage module; wherein, the first storage module includes a plurality of accessible storage units, and the second storage module hides the access channel from the outside of the hard disk; obtaining the root key generated by the hard disk includes: calling the key protection unit located in the second storage module to obtain the root key stored in the key protection unit; wherein, after encryption using the root key, the root key in the first storage module is deleted.

[0017] In some embodiments of this application, the management instruction includes an update instruction for modifying the encrypted data of the target storage unit; adjusting the information associated with the target storage unit in the encryption configuration table based on the management instruction includes: authenticating the instructor of the update instruction in response to the space state of the target storage unit being encrypted; and updating the encrypted data of the target storage unit in the encryption configuration table to the target encrypted data in response to the instructor being authenticated; wherein the target encrypted data is the encrypted data to be updated as indicated by the update instruction.

[0018] In some embodiments of this application, in response to the target encrypted data including the target encryption key, before updating the original encrypted data of the target storage unit in the encryption configuration table to the target encrypted data, the method further includes: decrypting the data stored in the target storage unit using the original encryption key; and encrypting the decrypted data using the target encryption key.

[0019] In some embodiments of this application, the management instructions include an obsolescence instruction to instruct the obsolescence of the target storage unit; adjusting the information associated with the target storage unit in the encryption configuration table based on the management instructions includes: obtaining a temporary key randomly generated by the hard disk; encrypting the target storage unit using the temporary key; and clearing the encrypted data of the target storage unit in the encryption configuration table.

[0020] In some embodiments of this application, the hard disk control method further includes: monitoring the storage units within the hard disk; determining whether the storage units meet preset disposal conditions based on the monitoring results; and, in response to the storage units meeting the preset disposal conditions, designating the storage units as target storage units and generating disposal instructions.

[0021] In some embodiments of this application, the hard disk control method further includes: obtaining unit information of the storage unit; wherein the unit information includes an access mode and a unit identifier; and creating a virtual unit associated with the storage unit based on the unit information; wherein the virtual unit is used to receive control requests for the storage unit.

[0022] On the other hand, a hard disk is provided, comprising: a first storage module, an encryption module, and a control driver module; the first storage module includes multiple storage units; the encryption module is used to encrypt at least one storage unit; and the control driver module is connected to the first storage module and the encryption module, and is used to acquire a hard disk access request; identify the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state; the hard disk includes multiple storage units, wherein the spatial states of two storage units may be different; in response to the storage unit to which the target address belongs being in an encrypted state, the requester of the hard disk access request is authenticated, so as to allow the response to the hard disk access request if the requester is authenticated.

[0023] In some embodiments of this application, the encryption module includes: a random key unit, a key protection unit, and an encryption unit; the random key unit is used to generate a random key; the key protection unit is used to store a root key; wherein the key protection unit hides the access channel from the outside of the hard disk; and the encryption unit is used to encrypt at least one of the random key, the encryption key, and the access password based on the root key.

[0024] In some embodiments of this application, the storage module further includes a second storage module; the second storage module is not visible from the outside of the hard disk and is used to store the encrypted configuration table.

[0025] On the other hand, a computer program product is provided, which, when executed by one or more processors, performs the following steps: acquiring a hard disk access request; identifying the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state; the hard disk includes multiple storage units, wherein the spatial states of two storage units may be different; and in response to the storage unit to which the target address belongs being in an encrypted state, authenticating the requester of the hard disk access request, so as to allow the response to the hard disk access request when the requester is authenticated.

[0026] On the other hand, a computer device is provided, including

[0027] One or more processors; and

[0028] A memory associated with one or more processors, the memory storing computer-readable instructions that, when read and executed by one or more processors, perform the following steps: obtaining a hard disk access request; identifying the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state; the hard disk includes multiple storage units, wherein the spatial states of two storage units may be different; and authenticating the requester of the hard disk access request in response to the storage unit to which the target address belongs being encrypted, so as to allow the hard disk access request to be responded to when the requester is authenticated.

[0029] In another aspect, a computer-readable storage medium is provided having computer-readable instructions stored thereon, which, when executed by one or more processors, perform the following steps: acquiring a hard disk access request; identifying the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state; the hard disk includes multiple storage units, wherein the spatial states of two storage units may be different; and in response to the storage unit to which the target address belongs being in an encrypted state, authenticating the requester of the hard disk access request so as to allow the response to the hard disk access request when the requester is authenticated. Attached Figure Description

[0030] Figure 1 is a schematic diagram of the hard disk structure of some embodiments of this application;

[0031] Figure 2 is a schematic diagram of the hard disk structure of some other embodiments of this application;

[0032] Figure 3 is a schematic diagram of the hard disk structure according to some embodiments of this application;

[0033] Figure 4 is a schematic diagram of the structure of a storage system according to some embodiments of this application;

[0034] Figure 5 is a schematic diagram of the structure of a storage system according to some other embodiments of this application;

[0035] Figure 6 is a flowchart illustrating a hard disk control method according to some embodiments of this application;

[0036] Figure 7 is a schematic flowchart of a hard disk control method according to some other embodiments of this application;

[0037] Figure 8 is a flowchart illustrating the execution of a new instruction according to some embodiments of this application;

[0038] Figure 9 is a flowchart illustrating the execution of update instructions according to some embodiments of this application;

[0039] Figure 10 is a flowchart illustrating the execution of obsolete instructions according to some embodiments of this application;

[0040] Figure 11 is a flowchart illustrating the execution of a hard disk access request according to some embodiments of this application;

[0041] Figure 12 is a flowchart illustrating the execution of a hard disk write request according to some embodiments of this application;

[0042] Figure 13 is a schematic diagram of the structure of a computer device according to some embodiments of this application;

[0043] Figure 14 is a schematic diagram of the structure of a computer program product according to some embodiments of this application;

[0044] Figure 15 is a schematic diagram of the structure of a non-volatile computer-readable storage medium according to some embodiments of this application. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] To address the technical problem of poor hard disk flexibility in related technologies, this application provides a hard disk control method, a hard disk, a computer program product, a computer device, and a computer-readable storage medium. The hard disk control method includes: acquiring a hard disk access request; identifying the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state, and the hard disk includes multiple storage units; the spatial state of at least one storage unit is pre-set to an encrypted state, and the spatial state of at least one storage unit is pre-set to an unencrypted state; and / or, the spatial state of at least one storage unit is configurable; in response to the storage unit to which the target address belongs being in an encrypted state, authenticating the requester of the hard disk access request, so that the hard disk access request is allowed to be responded to when the requester is successfully authenticated. The structure and detailed working principle of this application are illustrated below.

[0047] Please refer to Figure 1, which is a schematic diagram of the hard disk structure of some embodiments of this application.

[0048] In some embodiments, the hard disk may include a plurality of storage units 111 and a control drive module 20. The control drive module 20 is connected to the storage units 111. The control drive module 20 includes a hard disk drive 21, which can create a plurality of virtual units 31, each virtual unit 31 being connected to the hard disk drive 21 and associated with the storage units 111.

[0049] In some embodiments, the mapping relationship between virtual unit 31 and storage unit 111 can be one-to-one, one-to-many, many-to-one, etc., and is not limited here. It is not recommended to configure the mapping relationship between virtual unit 31 and storage unit 111 as many-to-many, but it can be set in this way to meet your own needs, that is, the mapping relationship between virtual unit 31 and storage unit 111 is set as many-to-many, and is not strictly limited here.

[0050] The control drive module 20 can respond to the virtual unit 31 acquiring a control request, and take the virtual unit 31 that acquires the control request as the current virtual unit 31; parse the storage unit 111 associated with the current virtual unit 31 and take it as the target address; drive the target address to execute the control request.

[0051] Therefore, in this embodiment, the hard disk control drive module 20 can create several virtual units 31. These virtual units 31 are connected to the hard disk drive 21 and associated with storage units 111. Thus, in this application, control requests to the hard disk can be received through the virtual units 31, and the associated storage unit 111 can be located based on the current virtual unit 31 receiving the control request, and the corresponding control request can be executed. In other words, when controlling the hard disk, the storage address or intended storage address of the data can be obtained, and address location can be performed relatively simply and clearly through the virtual units 31, thereby optimizing the hard disk's working principle and improving its ease of use and response efficiency.

[0052] Please refer to Figure 2, which is a schematic diagram of the hard disk structure of some other embodiments of this application.

[0053] In some embodiments, the hard disk includes a first storage module 11, an encryption module 40, and a control drive module 20. The first storage module 11 includes a plurality of storage units 111. In layman's terms, the storage unit 111 can be considered equivalent to a sub-hard disk, etc. The first storage module 11 is compatible with both storage units 111 in an encrypted state and storage units 111 in an unencrypted state.

[0054] In some embodiments, at least one storage unit 111 may be pre-specified as encrypted and at least one storage unit 111 may be pre-specified as unencrypted during the hard disk generation process, thus pre-configuring the encrypted and unencrypted storage units 111. Alternatively, at least one storage unit 111 may be reserved without pre-configured space, allowing users to configure the space of this reserved storage unit 111 according to their own data storage security needs. Other storage units 111 within the hard disk may be pre-configured as encrypted or unencrypted.

[0055] For example, all storage units 111 in the first storage module 11 are pre-configured. The space state of some storage units 111 can be set to an encrypted state, that is, the access mode is a medium mode that requires encryption medium to decrypt. The space state of other storage units 111 can be set to an unencrypted state, that is, the access mode is a pass-through mode that does not require encryption medium to decrypt, allowing direct access to the data stored in the storage unit 111 without authentication.

[0056] Alternatively, some storage units 111 within the first storage module 11 are pre-configured, and some storage units 111 are reserved for user configuration. That is, the space state of some storage units 111 can be pre-set to an encrypted state, or the space state of some storage units 111 can be set to an unencrypted state, or the space state of some storage units 111 can be pre-set to an encrypted state and the space state of some storage units 111 can be pre-set to an unencrypted state; the other reserved storage units 111 do not have their space state pre-configured and can be freely set to an encrypted or unencrypted state.

[0057] Alternatively, all storage units 111 within the first storage module 11 may not have their space status preset.

[0058] The working principle of the storage unit 111 with no pre-set space state will be illustrated with examples later, and will not be repeated here.

[0059] The encryption module 40 is used to encrypt at least one storage unit 111.

[0060] The control driver module 20 is connected to the first storage module 11 and the encryption module 40. The control driver module 20 can acquire hard disk access requests; identify the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state; the hard disk includes multiple storage units 111, wherein the spatial states of two storage units 111 may be different; in response to the storage unit 111 to which the target address belongs being in an encrypted state, the controller authenticates the requester of the hard disk access request, so that the hard disk access request is allowed to be responded to when the requester is authenticated.

[0061] Therefore, this embodiment can divide the hard disk into multiple storage units 111. Furthermore, the space state of at least one storage unit 111 is pre-set to an encrypted state, and the space state of at least one storage unit 111 is pre-set to an unencrypted state; and / or, the space state of at least one storage unit 111 is configurable. Thus, the hard disk can simultaneously store encrypted storage units 111 and unencrypted storage units 111, making it compatible with both encrypted and unencrypted storage units 111 to accommodate data storage with different encryption requirements. Upon receiving a hard disk access request, the system can verify whether data access is allowed based on the space state of the target address and the identity of the requester, thereby ensuring data security while maintaining data storage flexibility.

[0062] Please refer to Figure 3, which is a schematic diagram of the hard disk structure of some embodiments of this application.

[0063] In some embodiments, the encryption module 40 may include a random key unit 41, a key protection unit 42, and an encryption unit 43. The random key unit 41 is used to generate a random key. The key protection unit 42 is used to store a root key. The key protection unit 42 hides the access channel from the outside of the hard disk. The encryption unit 43 is used to encrypt at least one of the random key, the encryption key, and the access password based on the root key.

[0064] In some embodiments, the storage module may further include a second storage module 12. The second storage module 12 is not visible from the outside of the hard disk and is used to store the encrypted configuration table, thereby preventing external access to the encrypted configuration table from the hard disk. This improves the storage security of the encrypted configuration table, reduces the risk that the acquisition of the encrypted configuration table will affect the security of the storage unit 111 of the hard disk in an encrypted state, and further enhances the security of the hard disk.

[0065] Furthermore, the control drive module 20 may also include a control unit 22. The hard disk drive 21 can be used to create virtual units 31 (as shown in Figure 1) and store the mapping relationship between virtual units 31 and storage units 111. If the control unit 22 does not need to be aware of the virtual units 31 and store the relationship between them, adding a new module (i.e., virtual unit 31) to the hard disk will not significantly increase the workload of the control unit 22, thus ensuring its performance. As the name suggests, the control unit 22 can be considered equivalent to the hard disk's master controller; the hard disk drive is used to drive the storage units 111 to execute control requests, etc.

[0066] Please refer to Figure 4, which is a schematic diagram of the structure of a storage system according to some embodiments of this application.

[0067] In some embodiments, the storage system includes an interactive device and a hard disk as described above; the interactive device includes an interactive module 51 and an interactive channel 52, the interactive module 51 includes a plurality of sub-interactive units, each of which is connected to an interactive channel 52; the virtual units 31 of the hard disk are connected to an interactive channel 52.

[0068] In some embodiments, the mapping relationship between the interaction module 51 and the virtual unit 31 can be one-to-one, one-to-many, many-to-one, etc., and is not limited here. It is not recommended to configure the mapping relationship between the interaction module 51 and the virtual unit 31 as many-to-many, but it can be set in this way to meet your own needs, that is, the mapping relationship between the interaction module 51 and the virtual unit 31 is set as many-to-many, and is not strictly limited here.

[0069] Please refer to Figure 5, which is a schematic diagram of the structure of a storage system according to some other embodiments of this application.

[0070] In some embodiments, the virtual unit 31 of the hard disk, the storage unit 111, and the interaction module 51 of the interaction device can have a one-to-one mapping relationship. This simplifies the efficiency of identifying the target storage unit 111 when obtaining management commands / control requests, which is beneficial to further improving the response efficiency of the hard disk and thus improving hard disk performance. This also simplifies the process for users to identify the storage unit 111, allowing the interaction module 51 to adapt to the naming of the storage unit 111 or be defined by the user.

[0071] For limitations on the control driver module, please refer to the limitations on hard disk control methods below, which will not be repeated here. Each module in the above control driver module can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0072] Please refer to Figure 6, which is a flowchart illustrating some embodiments of the hard disk control method of this application.

[0073] S101: Obtain hard disk access request.

[0074] In this embodiment, the hard disk access request requests access to data stored on the hard disk, which can be considered as a request to read data stored on the hard disk.

[0075] S102: Identify the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state, and the hard disk includes multiple storage units; the spatial state of at least one storage unit is pre-set to an encrypted state, and the spatial state of at least one storage unit is pre-set to an unencrypted state; and / or, the spatial state of at least one storage unit is configurable.

[0076] In this embodiment, as described above, the hard disk is compatible with both storage units in an encrypted state and storage units in an unencrypted state. When a hard disk access request is received, it can be identified whether the storage unit targeted by the hard disk access request is in an encrypted state.

[0077] In this embodiment, there are two naming methods for the target storage unit. When a control request such as a hard disk access request or a hard disk write request is obtained, the target storage unit is called the target address. When a management instruction such as a new instruction or an update instruction is obtained to configure the access mode / space status, the target storage unit is called the target storage unit, so as to distinguish the naming under different functions.

[0078] In this embodiment, the space state of the storage unit can be formed in the following ways: At least one storage unit can be pre-specified as encrypted and at least one storage unit can be pre-specified as unencrypted during the hard disk generation process; for example, the configuration of encrypted and unencrypted storage units can be pre-implemented. Alternatively, at least one storage unit can be reserved without pre-configured space state, allowing users to configure the space state of this reserved storage unit according to their own data storage security needs. Other storage units within the hard disk can be pre-configured as encrypted or unencrypted.

[0079] For example, all storage units in the first storage module are pre-configured. The space state of some storage units can be set to encrypted state, that is, the access mode is a medium mode that requires encryption medium to decrypt. The space state of other storage units can be set to unencrypted state, that is, the access mode is a pass-through mode that does not require encryption medium to decrypt, allowing direct access to the data stored in the storage unit without authentication.

[0080] Alternatively, some storage units within the first storage module are pre-configured, while others are reserved for user configuration. In other words, some storage units can be pre-configured as encrypted, or as unencrypted, or vice versa; the remaining storage units are not pre-configured and can be freely configured as either encrypted or unencrypted.

[0081] Alternatively, all storage units within the first storage module may not have their space status preset.

[0082] S103: In response to the fact that the storage unit to which the target address belongs is in an encrypted state, authenticate the requester of the hard disk access request so that the hard disk access request can be responded to when the requester is successfully authenticated.

[0083] In this embodiment, in response to the storage unit to which the target address belongs being in an encrypted state, the data at the target address is considered to have a certain degree of confidentiality. It is necessary to verify the identity of the requester who requests access to the target address, and when the requester passes the authentication, the hard disk access request is responded to to ensure the security of the confidential data.

[0084] Therefore, this embodiment can divide the hard disk into multiple storage units. Furthermore, at least one storage unit's space state is pre-set to an encrypted state, and at least one storage unit's space state is pre-set to an unencrypted state; and / or, the space state of at least one storage unit is configurable. Thus, the hard disk can simultaneously store encrypted and unencrypted storage units, making it compatible with both encrypted and unencrypted storage units to accommodate data storage with different encryption requirements. Upon receiving a hard disk access request, the system can verify whether data access is allowed based on the space state of the target address and the identity of the requester, thereby ensuring data security while maintaining data storage flexibility.

[0085] Please refer to Figure 7, which is a flowchart illustrating a hard disk control method according to some other embodiments of this application.

[0086] In some embodiments, the hard disk includes a control drive module and multiple storage units; wherein the hard disk drive of the control drive module can create several virtual units, each virtual unit being connected to the hard disk drive and associated with a storage unit. Based on this, the hard disk control method can be as follows:

[0087] S201: In response to a virtual unit acquiring a control request, the virtual unit that acquires the control request is designated as the current virtual unit.

[0088] In this embodiment, the virtual unit that obtains the control request is designated as the current virtual unit.

[0089] As illustrated in the examples above, a control request may include at least one of a hard disk access request and a hard disk write request. A request for hard disk modification, for example, can be considered to include two steps: a hard disk access process and a hard disk write process. In this embodiment, the hard disk write process may include two steps: deleting data and writing data.

[0090] S202: Resolve the memory unit associated with the current virtual unit and use it as the target address.

[0091] In this embodiment, as described above, the virtual unit has been pre-associated with a storage unit. Therefore, when the current virtual unit receives a control request, the storage unit associated with the current virtual unit can be considered as the target storage unit, i.e., the target address.

[0092] S203: Driver target address execution control request.

[0093] In this embodiment, in response to resolving the target address, the target address can be driven to execute a control request.

[0094] Therefore, the hard drive control driver module in this embodiment can create several virtual units, which are connected to and associated with the hard drive storage units. Thus, in this application, control requests to the hard drive can be received through virtual units, and the associated storage unit can be located based on the current virtual unit receiving the control request, and the corresponding control request can be executed. In other words, when controlling the hard drive, it is possible to know the storage address or intended storage address of the data, and address location can be performed relatively simply and clearly through virtual units, thereby optimizing the hard drive's working principle and improving its ease of use and response efficiency.

[0095] In some embodiments, when resolving the storage unit associated with the current virtual unit, the configuration information of the current virtual unit can be obtained. The unit information associated with the current virtual unit within the configuration information is identified. The unit information belongs to the storage unit associated with the current virtual unit.

[0096] In other words, the process involves obtaining the storage unit's unit information, which includes the access mode and unit identifier. Based on this unit information, a virtual unit is created that is associated with the storage unit; this virtual unit is used to receive control requests for the storage unit.

[0097] In some embodiments, the cell identifier may be the cell number of the storage cell and / or the storage address range, which is not limited here.

[0098] Accordingly, the principle for creating several virtual units can be as follows: Unit information of each storage unit within the hard disk can be obtained. This unit information includes a unit identifier. A virtual unit is then created for each storage unit, and the created virtual unit is configured using the unit information of the storage unit.

[0099] Furthermore, virtual units can be configured based on storage unit access modes. For example, access modes can include pass-through mode and media mode.

[0100] In some embodiments, the cell identifier of the storage cell can be written into the configuration information of the virtual cell.

[0101] The access mode of the storage unit is written into the configuration information of the virtual unit to identify the space status of the storage unit based on the access mode. When the virtual unit obtains a control request, it determines whether to authenticate the requester based on the access mode.

[0102] In this application, an encrypted configuration table can be built within the hard disk to manage access modes and other aspects of storage units based on the encrypted configuration table. That is, the encrypted configuration table includes the access modes of storage units within the hard disk; when the storage unit is in an encrypted state, the encrypted configuration table also includes encrypted data used to encrypt the storage unit.

[0103] Furthermore, as described above, the hard disk includes a first storage module and a second storage module. The first storage module includes multiple accessible storage units, and the second storage module has its access channels hidden from the outside of the hard disk.

[0104] The encrypted configuration table can be stored in the second storage module. This means the encrypted configuration table is not visible or accessible outside the hard drive, reducing the risk of tampering and thus improving its security. However, the second storage module can be accessed to perform read operations on the encrypted configuration table stored there.

[0105] In some embodiments, the hard disk can acquire or generate management instructions for managing storage units. For example, management instructions can be used to adjust the information associated with a target storage unit in an encrypted configuration table to modify the control method for the storage unit.

[0106] For example, management commands can include at least one of the following: create command, update command, and discard command. A create command can be used to create a new storage unit or set a free storage unit; an update command can be used to modify the encrypted data of a target storage unit; and a discard command can be used to instruct the discard of a target storage unit. The following examples illustrate the execution principles of each management command.

[0107] Please refer to Figure 8, which is a flowchart illustrating the execution of a new instruction according to some embodiments of this application.

[0108] S301: Get the new command.

[0109] S302: Identify newly created commands that carry encrypted media.

[0110] In this embodiment, the target storage unit of the new instruction can be encrypted using the encryption medium carried by the new instruction.

[0111] S303: Determine whether the encryption medium contains an access password.

[0112] In this embodiment, when it is determined that the encryption medium includes an access password, step S304 is executed; when it is determined that the encryption medium includes an access password, step S306 is executed.

[0113] S304: Obtain the root key and use the root key to encrypt the access password.

[0114] In this embodiment, the root key generated by the hard drive can be obtained, and the access password can be encrypted using the root key. Thus, during actual use of the hard drive, the access password can be used to lock the target storage unit.

[0115] In some embodiments, the key protection unit located in the second storage module can be invoked to obtain the root key stored in the key protection unit.

[0116] S305: Write the encrypted access password into the encryption configuration table.

[0117] In this embodiment, the access password encrypted with the root key can be written into the encryption configuration table.

[0118] For example, the header of the encryption configuration table includes the cell label category, storage address range category, access mode category, access password category, encryption key category, and random key category of the storage unit. Thus, the encryption medium can be written into the body of the corresponding header within the encryption configuration table based on the encryption medium category and the target storage unit.

[0119] S306: Determine whether the encryption medium contains an encryption key.

[0120] In this embodiment, when it is determined that the encryption medium includes the encryption key, step S307 is executed; when it is determined that the encryption medium does not include the encryption key, step S311 is executed (as illustrated in Figure 8) or the process ends.

[0121] S307: Obtain the root key and use the root key to encrypt the encryption key.

[0122] In this embodiment, the root key generated by the hard drive is obtained, and the encryption key is encrypted using the root key.

[0123] S308: Obtain a randomly generated key from the hard drive.

[0124] In this embodiment, as described above, the hard disk may include a random key unit, which can generate a random key. If so, the random key and the encryption key can be used together to encrypt the target storage unit, thereby further improving the security of data encryption.

[0125] S309: Obtain the root key and use the root key to encrypt the random key.

[0126] In this embodiment, the root key generated by the hard drive is obtained, and the encryption key is encrypted using the root key.

[0127] S310: Write the encrypted encryption key and random key into the encryption configuration table.

[0128] In this embodiment, the encrypted root key and random key can be written into the encryption configuration table as encrypted data.

[0129] In this way, the random key of the encrypted target storage unit can be saved so that when the data in the target storage unit is decrypted later, the random key saved in the encryption configuration table can be parsed so that the random key and the encryption key can be used together to decrypt the data in the target storage unit.

[0130] In other words, when the encryption medium includes an encryption key, the encryption key and the random key can be merged to obtain a merged key when encrypting the target storage unit. The working principle of using the merged key to encrypt the data in the target storage unit will be explained in detail later, and will not be repeated here.

[0131] S311: Write other attributes to the encrypted configuration table.

[0132] In this embodiment, the encrypted medium can be written into the encryption configuration table and associated with the target storage unit to authenticate the requester accessing the target storage unit based on the encryption configuration table.

[0133] Furthermore, in this embodiment, after encrypting the encryption medium using the root key, the root key stored in the first storage module can be deleted to reduce the risk of the root key being obtained, thereby further improving the security and reliability of the hard drive.

[0134] For example, the access mode of the target storage unit can be automatically identified and filled into the corresponding access mode category, or the corresponding fields in the new instruction can be extracted and written into the table body corresponding to each table header in the encryption configuration table, which will not be elaborated here.

[0135] In some embodiments, the header of the encrypted configuration table may be hidden or not set, and the header corresponding to each column / row may be specified by code or other means; or, the header of the encrypted configuration table may be explicitly specified, which is not limited here.

[0136] An example of an encryption configuration table can be shown in the table below:

[0137] Table 1 Encryption Configuration Table

[0138] In other words, this application can receive user control requests through virtual units, thereby reducing the cumbersome steps of confirming the detailed storage address of the control request target; the hard drive can also be compatible with both encrypted and unencrypted storage units to improve the flexibility of data storage security levels. Furthermore, this application can further set encryption levels for storage units whose space status is encrypted, adaptively ensuring data security while reducing the encryption burden on data with relatively low security requirements.

[0139] In other words, based on different combinations of encryption media, the access modes of the storage unit in this embodiment can include at least a pass-through mode, a first media mode, a second media mode, and a third media mode. The pass-through mode allows access without authentication.

[0140] The encrypted medium in the first medium mode includes an access password. In conjunction with the configuration of the storage unit via management instructions (new instructions) as described in the foregoing embodiments, the encrypted medium carried by the management instructions can be identified and recorded. In response to the management instructions carrying an encrypted medium including an access password, the access mode of the target storage unit is determined to be the first medium mode.

[0141] The encryption medium in the second media mode may include an access password and an encryption key. In conjunction with the configuration of the storage unit via management instructions (new instructions) as described in the foregoing embodiments, the encryption medium carried by the management instructions can be identified and recorded. In response to the management instructions carrying encryption medium including an access password and an encryption key, the access mode of the target storage unit is determined to be the second media mode.

[0142] The encryption medium in the third media mode may include an encryption key. In conjunction with the configuration of the storage unit via management instructions (new instructions) as described in the foregoing embodiments, the encryption medium carried by the management instructions can be identified and recorded. In response to the encryption medium carrying the management instructions including an encryption key, the access mode of the target storage unit is determined to be the third media mode.

[0143] When the target storage unit's access mode is the second or third media mode, the root key can be obtained and used to encrypt the encryption medium. A random key unit is controlled to generate a random key. The random key is then encrypted using the root key. The encrypted medium and the random key are recorded. The random key can be used to encrypt data after being combined with the encryption key.

[0144] In other words, in this embodiment, the hard disk storage space is preset as multiple storage units. At least one of these storage units can have its access mode configured via management commands. That is, in response to receiving management commands, the target storage unit can be configured based on the management commands; wherein, the management commands are used to configure at least one of the storage unit's access mode and the encryption medium. A virtual unit associated with the target storage unit is configured. The configuration principle is illustrated in the examples above and will not be repeated here.

[0145] Please refer to Figure 9, which is a flowchart illustrating the execution of update instructions in some embodiments of this application.

[0146] S401: Get update command.

[0147] S402: Query the access mode of the target storage unit in the encryption configuration table.

[0148] In this embodiment, when the access mode is pass-through mode, step S406 can be executed; when the access mode is media mode, step S403 can be executed.

[0149] S403: Authenticate the party issuing the update command.

[0150] In this embodiment,

[0151] In response to the target storage unit's space state being encrypted, the sender of the update command is authenticated.

[0152] S404: Determine whether the original encrypted data in the encrypted configuration table includes the encryption key.

[0153] In this embodiment,

[0154] S405: Decrypt the data stored in the target storage unit using the original encryption key.

[0155] S406: Process the target storage unit according to the update instruction.

[0156] In this embodiment, taking the example that the encryption medium indicated by the update instruction includes an encryption key, the decrypted data can be encrypted using the target encryption key.

[0157] S407: Update the encrypted data of the target storage unit in the encryption configuration table to the target encrypted data.

[0158] In this embodiment, the target encrypted data is the encrypted data that the update instruction indicates to be updated.

[0159] The encrypted data refers to the encrypted medium stored in the encryption configuration table, which is encrypted using the root key. Specifically, the encrypted data may include an access password encrypted using the root key, and / or an encryption key encrypted using the root key. Furthermore, when the encryption medium includes an encryption key, it may also include a random key encrypted using the root key.

[0160] Please refer to Figure 10, which is a flowchart illustrating the execution of obsolete instructions in some embodiments of this application.

[0161] S501: Obtain obsolete instructions.

[0162] In this embodiment, the obsolescence command can originate from outside the hard drive, i.e., the user inputs the obsolescence command to instruct the target storage unit to be obsolescence.

[0163] And / or, the storage units can be monitored inside the hard drive to determine whether a storage unit should be discarded.

[0164] In some embodiments, the storage units within the hard disk can be monitored. Based on the monitoring results, a determination is made as to whether the storage units meet preset disposal conditions.

[0165] In response to a storage unit meeting a preset disposal condition, the storage unit is selected as the target storage unit and a disposal instruction is generated.

[0166] If no storage unit meets the preset discard conditions, no action is taken or the system checks again after a preset interval to see if any storage unit meets the preset discard conditions. This is to manage the stability of the hard drive and discard storage units that may affect its stability, thereby improving the stability of the hard drive.

[0167] S502: Obtain a randomly generated temporary key from the hard drive.

[0168] S503: Encrypt the target storage unit using a temporary key.

[0169] In this embodiment, when a discard instruction indicates that the target storage unit is no longer needed, the randomly generated temporary key for encrypting the target storage unit is not saved. The temporary key can be the same as the random key. Therefore, since the temporary key for encrypting the target storage unit is not saved and is randomly generated, it is almost impossible to decrypt the target storage unit, thus achieving the discarding of the target storage unit.

[0170] S504: Clear the encrypted data in the target storage unit within the encrypted configuration table.

[0171] Please refer to Figure 11, which is a flowchart illustrating the execution of a hard disk access request according to some embodiments of this application.

[0172] S601: Obtain hard disk access request.

[0173] S602: Resolve the target address of the hard disk access request.

[0174] S603: Query the encryption configuration table to obtain the access mode of the storage unit to which the target address belongs.

[0175] In this embodiment, the encrypted configuration table includes the access modes of the storage units within the hard disk.

[0176] Furthermore, as described above, the hard disk includes a first storage module and a second storage module. The first storage module includes multiple accessible storage units, and the second storage module has its access channels hidden from the outside of the hard disk.

[0177] The encrypted configuration table can be stored in the second storage module. This means the encrypted configuration table is not visible or accessible outside the hard drive, reducing the risk of tampering and thus improving its security. However, the second storage module can be accessed to perform read operations on the encrypted configuration table stored there.

[0178] S604: Determine the spatial status of the target address based on the access mode.

[0179] In this embodiment, when the spatial state of the target address is determined to be encrypted, step S605 is executed; when the spatial state of the target address is determined to be unencrypted, step S616 is executed.

[0180] The access modes of the storage unit may include at least pass-through mode, first medium mode, and second medium mode; wherein, the encryption and decryption complexity of the first medium mode is higher than that of the second medium mode.

[0181] If so, in response to the access mode being pass-through mode, the spatial state of the target address can be determined to be unencrypted; in response to the access mode being the first medium mode or the second medium mode, the spatial state of the target address can be determined to be encrypted.

[0182] S605: Retrieve verification parameters from the requester.

[0183] S606: Retrieve encrypted data from the target address in the encryption configuration table.

[0184] In this embodiment, the encrypted data includes an encrypted medium encrypted with a root key.

[0185] S607: Determine whether the encrypted data in the encrypted configuration table includes the access password.

[0186] In this embodiment, when it is determined that the encrypted data in the encrypted configuration table includes an access password, step S608 is executed; when it is determined that the encrypted data in the encrypted configuration table does not include an access password, step S610 is executed.

[0187] S608: Obtain the root key and decrypt the access password within the encrypted data.

[0188] S609: Compare and verify the access passwords of the verification parameters and the encrypted data.

[0189] In this embodiment, when it is determined that the access passwords for the verification parameters and the encrypted data match, step S610 is executed; when it is determined that the access passwords for the verification parameters and the encrypted data do not match, it can be considered that the access password sent by the requester is incorrect, and it can be considered that the requester does not have the permission to access the target address, so the process can end.

[0190] S610: Determine whether the encrypted data in the encrypted configuration table includes the encryption key.

[0191] In this embodiment, when it is determined that the encrypted data in the encrypted configuration table includes an encryption key, step S611 is executed; when it is determined that the encrypted data in the encrypted configuration table does not include an encryption key, step S616 is executed.

[0192] S611: Obtain the root key of the hard drive and decrypt the encryption key within the encrypted data.

[0193] S612: Compare and verify the encryption keys of the parameters and the encrypted data.

[0194] In this embodiment, when it is determined that the encryption keys of the verification parameters and the encrypted data match, step S613 is executed; when it is determined that the encryption keys of the verification parameters and the encrypted data do not match, it can be considered that the encryption key sent by the requester is incorrect, and it can be considered that the requester does not have the permission to access the target address, so the process can end.

[0195] S613: Obtain the root key of the hard drive and decrypt the random key within the encrypted data.

[0196] In this embodiment, the root key is used to decrypt the encrypted data to obtain a random key.

[0197] S614: Combine the encryption key and the random key to obtain the combined key.

[0198] S615: Decrypt the data stored at the target address.

[0199] In this embodiment, the data stored at the target address can be decrypted using the fusion key.

[0200] S616: Read the data requested by the hard disk access request.

[0201] In other words, in this embodiment, the encrypted data is an encrypted medium encrypted with the root key. The root key can be used to decrypt the encrypted data to obtain the encrypted medium. By comparing whether the encrypted medium matches the verification parameters, the requester of the hard drive access request is authenticated. That is, the verification parameters can be analyzed to see if they match the encrypted data. If the verification parameters match the encrypted data, the requester is considered to have the right to access the target address, the requester is deemed to have been authenticated, and the control request is allowed to be executed.

[0202] Please refer to Figure 12, which is a flowchart illustrating the execution of a hard disk write request according to some embodiments of this application.

[0203] S701: Obtain a hard disk write request.

[0204] S702: Obtain the write data carried by the hard disk write request.

[0205] S703: Access mode for querying the target address of a hard disk write request.

[0206] S704: Determine whether the encryption medium of the target address includes the encryption key.

[0207] In this embodiment, when it is determined that the encryption medium of the target address includes an encryption key, step S705 is executed; when it is determined that the encryption medium of the target address does not include an encryption key, step S707 is executed.

[0208] S705: Obtain the encryption key stored at the target address on the hard disk.

[0209] In this embodiment, in response to the target address's access mode being media mode and the encryption medium including an encryption key, the encryption key of the target address stored on the hard disk can be obtained.

[0210] S706: Encrypt the written data using an encryption key.

[0211] In this embodiment, the written data can be encrypted using an encryption key.

[0212] Alternatively, as described in the previous embodiments, the written data can be further encrypted using a random key. In some embodiments, a random key stored at the target address on the hard disk can be obtained; the random key and the encryption key can be merged to obtain a merged key; and the written data can be encrypted using the merged key.

[0213] S707: Writes the data to the target address.

[0214] In this embodiment, in response to determining that the hard disk access mode is the pass-through mode or the first media mode as described above, i.e., the decryption medium does not include an encryption key and therefore does not need to encrypt the write data using the encryption key, the write data can be written to the target address. In response to determining that the hard disk access mode is the second media mode or the third media mode as described above, i.e., the decryption medium includes an encryption key, the write data is encrypted using the obtained encryption key, and the encrypted write data is written to the target address.

[0215] In other words, in this embodiment, in response to determining that the spatial state of the target address is encrypted, the request type of the control request can be identified. That is, in response to the spatial state of the target address being encrypted, the type of control request can be distinguished before driving the target address to execute the control request.

[0216] The request type in response to the control request is a hard disk access request, which can be used to determine whether to authenticate the requester in order to ensure the security of confidential data on the hard disk.

[0217] In response to a control request categorized as a disk write request, it can be determined that the disk write request is permitted. This eliminates the need for authentication of the requester, improving data writing efficiency and reducing authentication operations during data writing. Furthermore, in response to the determination that no authentication of the requester is required, the storage unit can be monitored in conjunction with the preset disposal conditions described earlier. If it is determined that the requester has written a large amount of data in a short period of time, even causing the storage unit's storage space to be exhausted or nearly exhausted, a disposal instruction can be generated to discard the storage unit.

[0218] In some embodiments, the requester of the hard disk write request can also be authenticated to screen the requester to a certain extent and reduce the risk of situations affecting hard disk stability.

[0219] In layman's terms, the original components in hard drives such as NVMe (Non-Volatile Memory Host Controller Interface Specification) SSDs can remain unchanged, and the controller executes the hard drive firmware code. Temporary data generated by the controller is stored in volatile memory, while persistent data is stored in the media space of NAND (Nand Flash) chips. In this application, the NVMe SSD can be equipped with an encryption unit, a random key unit, and a key protection unit. The encryption unit provides symmetric encryption and decryption capabilities for the hard drive; the random key unit provides the ability to generate truly random numbers; and the key protection unit can generate a root key before leaving the factory using a random key unit such as a true random number generator, providing access to the root key and restricting external access to the root key.

[0220] The hard drive firmware maintains an encrypted configuration table, which includes data such as the cell number, address range, access mode, access password, encryption key, and random key for each storage unit. This encrypted configuration table can be stored in NAND space inaccessible to the user. When a user creates a sub-hard drive (i.e., a storage unit) through management software, the attribute parameters pass sequentially through the virtual device of the operating system's custom driver, the physical device, and the hard drive firmware logic, ultimately being saved into the firmware's encrypted configuration table. When a user reads encrypted data stored on a sub-hard drive through management software, they need to enter an access password and / or encryption key. The firmware retrieves the access password, encryption key, and random key written during creation or configuration from the encrypted configuration table.

[0221] Taking a secure medium that includes both an access password and an encryption key as an example, the process begins with authentication using the access password, followed by secondary authentication using the encryption key. Finally, a fused key is generated using the encryption key and a random key to decrypt the data on the hard drive and return it to the user, maximizing the security of confidential data. When a user writes data to a sub-hard drive through management software, the hard drive firmware retrieves the encryption key and random key written during creation or configuration from the encryption configuration table, generates a fused key, and uses this fused key to encrypt the written user data before storing it on the hard drive. In response to the determination that a user no longer needs data on a certain sub-hard drive, a discard command can be triggered. The hard drive firmware generates a temporary and random key, encrypts the data on the corresponding sub-hard drive, and restores the security attributes in the encryption configuration table to the no-access level.

[0222] In summary, this application establishes a storage unit mechanism through a hard disk and configures security attributes for the storage units. It maintains and manages the security access attributes of the storage units and performs targeted processing of data read and write operations based on the security access attributes. This ensures both categorized data storage (different types of data are stored in different storage units) and hierarchical data protection (different storage units are set with different security protection levels), thus guaranteeing both convenience and security on a single hard disk.

[0223] It should be understood that although the steps in the flowcharts of Figures 6-12 are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in Figures 6-12 may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0224] In some embodiments, as shown in FIG14, a computer program product is provided, including a computer program. The steps of the hard disk control method described above, when executed by a processor, are not repeated here.

[0225] Please refer to Figure 13, which is a schematic diagram of the structure of a computer device according to some embodiments of this application.

[0226] In some embodiments, the computer device may be a terminal, the internal structure of which may be illustrated in Figure 13.

[0227] The computer device includes one or more processors connected via a system bus, memory associated with the one or more processors, a network interface, a display screen, and input devices. The processors of the computer device provide computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer-readable instructions. The internal memory provides an environment for the operation of the operating system and computer-readable instructions in the non-volatile storage media. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer-readable instructions are executed by the processor, they implement a hard disk control method. The display screen of the computer device can be an LCD screen or an e-ink display screen. The input devices of the computer device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad located on the casing of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0228] Those skilled in the art will understand that the structure illustrated in Figure 13 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. The computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0229] In some embodiments, as shown in FIG15, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the computer-readable instructions are read and executed by one or more processors, they can perform the following steps:

[0230] S101: Obtain hard disk access request.

[0231] S102: Identify the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state, and the hard disk includes multiple storage units; the spatial state of at least one storage unit is pre-set to an encrypted state, and the spatial state of at least one storage unit is pre-set to an unencrypted state; and / or, the spatial state of at least one storage unit is configurable.

[0232] S103: In response to the fact that the storage unit to which the target address belongs is in an encrypted state, authenticate the requester of the hard disk access request so that the hard disk access request can be responded to when the requester is successfully authenticated.

[0233] In some embodiments, a computer-readable storage medium is provided having computer-readable instructions stored thereon, which, when executed by one or more processors, can perform the following steps:

[0234] S101: Obtain hard disk access request.

[0235] S102: Identify the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state, and the hard disk includes multiple storage units; the spatial state of at least one storage unit is pre-set to an encrypted state, and the spatial state of at least one storage unit is pre-set to an unencrypted state; and / or, the spatial state of at least one storage unit is configurable.

[0236] S103: In response to the fact that the storage unit to which the target address belongs is in an encrypted state, authenticate the requester of the hard disk access request so that the hard disk access request can be responded to when the requester is successfully authenticated.

[0237] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile computer-readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0238] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0239] The embodiments described above are merely examples of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these modifications and improvements all fall within the protection scope of this application.

Claims

1. A hard disk control method, characterized in that, The hard disk control method includes: Obtain a hard drive access request; Identify the spatial state of the target address of the hard disk access request; wherein the spatial state includes an encrypted state and an unencrypted state, and the hard disk includes multiple storage units; the spatial state of at least one of the storage units is pre-set to an encrypted state, and the spatial state of at least one of the storage units is pre-set to an unencrypted state; and / or, the spatial state of at least one of the storage units is configurable; and In response to the storage unit to which the target address belongs being encrypted, the requester of the hard disk access request is authenticated, so that the hard disk access request is allowed to be responded to if the requester is successfully authenticated.

2. The hard disk control method according to claim 1, characterized in that, The spatial state for identifying the target address of the hard disk access request includes: Parse the target address of the hard disk access request; The encryption configuration table is queried to obtain the access mode of the storage unit to which the target address belongs; wherein, the encryption configuration table includes the access modes of the storage units within the hard disk; and The spatial status of the target address is determined based on the access mode.

3. The hard disk control method according to claim 2, characterized in that, The hard disk includes a first storage module and a second storage module; wherein, the first storage module includes a plurality of accessible storage units, and the second storage module has a hidden access channel relative to the outside of the hard disk; The query encryption configuration table includes: Access the second storage module and perform a read operation on the encrypted configuration table stored in the second storage module.

4. The hard disk control method according to claim 2, characterized in that, The access modes include at least a pass-through mode, a first medium mode, and a second medium mode; wherein the encryption and decryption complexity of the first medium mode is higher than that of the second medium mode. Determining the spatial status of the target address based on the access pattern includes: In response to the access mode being the pass-through mode, the spatial state of the target address is determined to be unencrypted; and In response to the access mode being either the first media mode or the second media mode, the spatial state of the target address is determined to be encrypted.

5. The hard disk control method according to claim 1, characterized in that, The hard disk includes a second storage module that is relatively hidden from the outside; the hard disk control method further includes: An encryption configuration table is constructed in the second storage module; wherein, the encryption configuration table includes the access modes of the storage units within the hard disk; when the storage unit is in an encrypted state, the encryption configuration table also includes encrypted data for encrypting the storage unit; and In response to receiving a management instruction for managing the storage unit, the information associated with the target storage unit in the encryption configuration table is adjusted based on the management instruction.

6. The hard disk control method according to claim 5, characterized in that, The management instructions include creation instructions, used to create new storage units or set up free storage units; The adjustment of the information associated with the target storage unit in the encryption configuration table based on the management instruction includes: The newly created instruction carries an encryption medium, and the target storage unit of the newly created instruction is encrypted using the encryption medium. as well as The encrypted medium is written into an encryption configuration table and associated with the target storage unit to authenticate the requester accessing the target storage unit based on the encryption configuration table.

7. The hard disk control method according to claim 6, characterized in that, The encryption medium includes an access password; the target storage unit for encrypting the newly created instruction using the encryption medium includes: The target storage unit is locked using the access password; and The step of writing the encryption medium into the encryption configuration table includes: Obtain the root key generated by the hard drive, encrypt the access password using the root key, and write the encrypted access password into the encryption configuration table.

8. The hard disk control method according to claim 6, characterized in that, The encryption medium includes an encryption key; The step of writing the encryption medium into the encryption configuration table includes: Obtain the root key generated by the hard drive, and encrypt the encryption key using the root key; Obtain the random key generated by the hard drive, and encrypt the random key using the root key; and The encrypted root key and random key are used as the encrypted data and written into the encryption configuration table.

9. The hard disk control method according to claim 8, characterized in that, The hard disk control method includes: By combining the encryption key and the random key, a fused key is obtained; and The data within the target storage unit is encrypted using the fusion key.

10. The hard disk control method according to claim 7 or 8, characterized in that, The hard disk includes a first storage module and a second storage module; wherein, the first storage module includes a plurality of accessible storage units, and the second storage module has a hidden access channel relative to the outside of the hard disk; The step of obtaining the root key generated by the hard drive includes: The key protection unit located in the second storage module is invoked to obtain the root key stored in the key protection unit; wherein, after encryption using the root key, the root key in the first storage module is deleted.

11. The hard disk control method according to claim 5, characterized in that, The management instructions include update instructions for modifying the encrypted data in the target storage unit; The adjustment of the information associated with the target storage unit in the encryption configuration table based on the management instruction includes: In response to the target storage unit being in an encrypted state, the sender of the update instruction is authenticated; and In response to the instruction party's authentication, the encrypted data of the target storage unit in the encrypted configuration table is updated to the target encrypted data; wherein, the target encrypted data is the encrypted data to be updated as indicated by the update instruction.

12. The hard disk control method according to claim 11, characterized in that, In response to the target encrypted data including the target encryption key, the step of updating the original encrypted data of the target storage unit in the encryption configuration table to the target encrypted data further includes: Decrypt the data stored in the target storage unit using the original encryption key; and The decrypted data is then encrypted using the target encryption key.

13. The hard disk control method according to claim 5, characterized in that, The management instructions include a disposal instruction, used to instruct the disposal of the target storage unit; adjusting the information associated with the target storage unit in the encryption configuration table based on the management instructions includes: Obtain the temporary key randomly generated from the hard drive; The target storage unit is encrypted using the temporary key; and Clear the encrypted data in the target storage unit within the encryption configuration table.

14. The hard disk control method according to claim 13, characterized in that, The hard disk control method also includes: The storage units within the hard disk are monitored; Based on the monitoring results, a judgment is made as to whether the storage unit meets the preset disposal conditions; and In response to the storage unit meeting the preset disposal conditions, the storage unit is designated as the target storage unit and the disposal instruction is generated.

15. The hard disk control method according to claim 1, characterized in that, The hard disk control method also includes: Obtain the unit information of the storage unit; wherein the unit information includes the access mode and the unit identifier; and A virtual unit is created based on the unit information and associated with the storage unit; wherein the virtual unit is used to receive control requests for the storage unit.

16. A hard disk, characterized in that, The hard disk includes: The first storage module includes multiple storage units; An encryption module is used to encrypt at least one of the storage units; and A control drive module, connected to the first storage module and the encryption module, is used to implement the hard disk control method according to any one of claims 1-14.

17. The hard disk according to claim 16, characterized in that, The encryption module includes: Random key unit, used to generate random keys; A key protection unit for storing the root key; wherein, the key protection unit hides the access channel from the outside of the hard disk; and An encryption unit is used to encrypt at least one of a random key, an encryption key, and an access cipher based on a root key.

18. The hard disk according to claim 16, characterized in that, The storage module further includes a second storage module; The second storage module is not visible from the outside of the hard disk and is used to store the encrypted configuration table.

19. A computer program product, comprising a computer program, characterized in that, When executed by one or more processors, the computer program implements the steps of the hard disk control method according to any one of claims 1-15.

20. A computer device, comprising: One or more processors; as well as A memory associated with the one or more processors, the memory being used to store computer-readable instructions that, when read and executed by the one or more processors, implement the steps of the hard disk control method as described in any one of claims 1-15.

21. A non-volatile computer-readable storage medium, characterized in that, The non-volatile computer-readable storage medium stores computer-readable instructions that, when executed by one or more processors, implement the steps of the hard disk control method as described in any one of claims 1-15.

Images