Storage apparatus access method, product, device, and non-volatile readable storage medium

Abstract

The present application relates to the field of solid-state disks, and discloses a storage apparatus access method, a product, a device, and a non-volatile readable storage medium. In order to solve the problem of limitations in secure access control and data encryption and decryption of solid-state disks, the method comprises: on the basis of an apparatus public key of a storage apparatus, verifying the validity of a user digital certificate that is sent by a virtual machine system and comprises a user public key, and when the user digital certificate is valid, generating a first random number, wherein the user digital certificate is a digital certificate signed by means of an apparatus private key matching the apparatus public key; using the user public key to encrypt the first random number, so as to obtain encrypted data, and outputting the encrypted data; and when data to be verified is received, using the first random number to decrypt the data to be verified, so as to obtain plaintext data, and when the plaintext data is valid, responding to a hard disk drive loading request sent by the virtual machine system. The present application can realize fine control of individual virtual functions, and optimize the performance of data transmission while ensuring data security.

Description

Storage device access methods, products, devices and non-volatile readable storage media

[0001] Cross-references to related applications

[0002] This application claims priority to Chinese Patent Application No. 202510108741.X, filed on January 23, 2025, entitled “A method, product, apparatus and readable storage medium for accessing a storage device”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of solid-state drives, and in particular to a storage device access method, product, device, and non-volatile readable storage medium. Background Technology

[0004] With the rapid development of technologies such as the Internet and cloud computing, solid-state drives (SSDs) have become the mainstream storage medium due to their high performance and reliability. Currently, SSD capacities are increasing, with some reaching 8TB, 16TB, or even larger. However, some users only need a small amount of storage space for their data, resulting in wasted capacity if they use the entire SSD. SSDs supporting SR-IOV (Single Root I / O Virtualization) offer a solution to this problem. This technology allows the SSD to create multiple virtual functions (VFs), enabling different users to mount different VFs and achieve independent data read and write operations. However, this technology has limitations in terms of secure access control and data encryption / decryption for SSDs. On the one hand, current security access measures mostly apply to the entire SSD and cannot provide fine-grained control over individual virtual functions (VFs), making it difficult to meet the personalized access needs of different users. On the other hand, while encrypted data transmission can ensure data security, it requires encryption and decryption operations every time data is read or written, which can have a significant impact on system performance.

[0005] Therefore, the relevant technologies have limitations in terms of secure access control and data encryption / decryption for solid-state drives. Summary of the Invention

[0006] The purpose of this application is to provide a storage device access method, product, device, and non-volatile readable storage medium that enables fine-grained control over individual virtual functions, thereby optimizing data transmission performance while ensuring data security.

[0007] To address the aforementioned technical problems, according to a first aspect, this application provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, and the storage device access method includes:

[0008] Based on the device public key of the storage device, the validity of the user digital certificate, which includes the user public key, sent by the virtual machine system is verified, and a first random number is generated when the user digital certificate is valid; the user digital certificate is a digital certificate signed by the device private key in conjunction with the device public key.

[0009] The first random number is encrypted using the user's public key, and the encrypted data is output so that the virtual machine system can decrypt the encrypted data using the user's private key that is paired with the user's public key to obtain the second random number.

[0010] When the virtual machine system receives the data to be verified, which is encrypted with the second random number, it decrypts the data to be verified using the first random number to obtain the plaintext data. When the plaintext data is valid, it responds to the request sent by the virtual machine system to load the hard disk driver, so that the virtual machine system can recognize the sub-storage device corresponding to the virtual function in the storage device.

[0011] In some embodiments, each virtual function is configured with a security authentication capability register, the structure of which includes a capability identifier, a base address register, a command register, an offset register, and a data register.

[0012] In some embodiments, the above storage device access method further includes:

[0013] If no user digital certificate is received from the virtual machine system within a preset time period after data is detected in the base address register corresponding to the virtual function, the security authentication capability register corresponding to the virtual function is reset so that the virtual function is not recognized by the virtual machine system.

[0014] In some embodiments, verifying the validity of a user digital certificate including the user's public key sent by the virtual machine system, based on the device public key of the storage device, includes:

[0015] In response to the detection of a digital certificate command in the command register corresponding to the virtual function, the certificate data in the data register corresponding to the virtual function is organized into a complete user digital certificate using the offset value in the offset register corresponding to the virtual function.

[0016] Verify whether the signature value of the user's digital certificate is the preset signature value based on the device public key of the storage device;

[0017] If the signature value of the user's digital certificate is the preset signature value, the user's digital certificate is deemed valid.

[0018] If the signature value of a user's digital certificate is not the preset signature value, the user's digital certificate is deemed invalid.

[0019] In some embodiments, the storage device stores a mapping table, which is used to characterize the association between user information and the function identifiers of virtual functions. The user digital certificate also includes user information and the function identifiers of virtual functions.

[0020] Generating the first random number when the user's digital certificate is valid includes:

[0021] When the user's digital certificate is valid, determine whether the function identifier of the virtual function associated with the user information in the user's digital certificate in the mapping relationship table is the target identifier;

[0022] If the function identifier of the virtual function associated with the user information in the user's digital certificate in the mapping table is the target identifier, generate the first random number;

[0023] If the function identifier of the virtual function associated with the user information in the user's digital certificate in the mapping table is not the target identifier, reset the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

[0024] In some embodiments, before resetting the security authentication capability register corresponding to the virtual function, the storage device access method further includes:

[0025] Write a verification failure value to the data register corresponding to the virtual function so that the virtual machine system can display an error message after obtaining the verification failure value from the data register.

[0026] In some embodiments, encrypting a first random number using the user's public key to obtain encrypted data and outputting it includes:

[0027] The encrypted data is obtained by encrypting the first random number using the user's public key.

[0028] In response to the detection of a random number retrieval command in the command register corresponding to the virtual function, encrypted data is written to the data register so that the virtual machine system can retrieve the encrypted data from the data register.

[0029] In some embodiments, when receiving data to be verified encrypted with a second random number from a virtual machine system, decrypting the data to be verified using a first random number to obtain plaintext data includes:

[0030] In response to the detection of a verification data command in the command register corresponding to the virtual function, the sub-data in the data register corresponding to the virtual function is organized into complete data to be verified using the offset value in the offset register corresponding to the virtual function; the sub-data is data of a preset length in the data to be verified output by the virtual machine system and encrypted with a second random number;

[0031] The plaintext data is obtained by decrypting the data to be verified using the first random number.

[0032] In some embodiments, after decrypting the data to be verified using a first random number to obtain plaintext data, the storage device access method further includes:

[0033] If the plaintext data is invalid, reset the security authentication capability register corresponding to the virtual function.

[0034] In some embodiments, the security authentication capability register corresponding to each virtual function is configured to be selectively enabled according to user commands;

[0035] Verifying the validity of a user digital certificate, which includes the user's public key, sent by the virtual machine system based on the device public key of the storage device includes:

[0036] When the security authentication capability register corresponding to the virtual function is enabled, the validity of the user digital certificate, which includes the user's public key, sent by the virtual machine system is verified based on the device public key of the storage device.

[0037] Storage device access methods also include:

[0038] If the security authentication capability register corresponding to the virtual function is not enabled, when a request to load the hard disk driver is received from the virtual machine system, the operation of loading the hard disk driver is performed so that the virtual machine system can recognize the sub-storage device corresponding to the virtual function in the storage device.

[0039] To address the aforementioned technical problems, according to a second aspect, this application also provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, and the storage device access method includes:

[0040] Obtain the user's public key, private key, and digital certificate including the user's public key from the virtual machine system; the digital certificate is a digital certificate signed with the device's private key from the storage device.

[0041] Send the user digital certificate to the target virtual function corresponding to the virtual machine system so that the target virtual function can verify the validity of the user digital certificate based on the device public key that works in conjunction with the device private key;

[0042] The random number returned by the target virtual function when verifying the validity of the user's digital certificate is decrypted using the user's private key. The user verification data encrypted with the random number is then sent to the target virtual function so that the target virtual function can verify the validity of the user verification data based on the random number it generates.

[0043] In response to the user verifying the validity of the data, read and write operations are performed on the sub-storage device corresponding to the identified target virtual function in the storage device.

[0044] In some embodiments, each virtual function is configured with a security authentication capability register, the structure of which includes a capability identifier, a base address register, a command register, an offset register, and a data register.

[0045] In some embodiments, sending a user digital certificate to the target virtual function corresponding to the virtual machine system includes:

[0046] Write the value of the data certificate command to the command register corresponding to the target virtual function, and send the user digital certificate to the target virtual function through the offset register and data register corresponding to the target virtual function via the transaction layer data packet (TLP).

[0047] In some embodiments, before decrypting the random number returned by the target virtual function when verifying the validity of the user's digital certificate using the user's private key, the storage device access method further includes:

[0048] Encrypted data is obtained through the data register corresponding to the target virtual function. The encrypted data is generated by encrypting a first random number using the user's public key. The first random number is a random number generated when verifying the validity of the user's digital certificate.

[0049] In some embodiments, decrypting the random number returned by the target virtual function when verifying the validity of the user's digital certificate using the user's private key includes:

[0050] The encrypted data is decrypted using the user's private key in conjunction with the user's public key to obtain the second random number.

[0051] In some embodiments, the security authentication capability register corresponding to each virtual function is configured to be selectively enabled according to user commands; before sending the user digital certificate to the target virtual function corresponding to the virtual machine system, the storage device access method further includes:

[0052] If the security authentication capability register corresponding to the target virtual function is not enabled, a request to load the hard disk driver is sent to the target virtual function so that the target virtual function can perform the operation of loading the hard disk driver.

[0053] To address the aforementioned technical problems, according to a third aspect, this application also provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, each virtual function being configured with a security authentication capability register, and the storage device access method includes:

[0054] Obtain user configuration commands and adjust the security authentication status values ​​corresponding to each virtual function in the global array according to the user configuration commands. The security authentication status values ​​include enabled and disabled status values.

[0055] For each virtual function, if the security authentication status value of the virtual function is enabled, the security authentication capability register of the virtual function is made visible to the virtual machine system, so that the virtual machine system can perform security authentication with the virtual function after traversing the security authentication capability register. When the security authentication is successful, the virtual function is identified and mounted.

[0056] For each virtual function, if the security authentication status value of the virtual function is off, the security authentication capability register controlling the virtual function is not visible to the virtual machine system.

[0057] To address the aforementioned technical problems, according to the fourth aspect, this application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of any of the memory device access methods described above.

[0058] To address the aforementioned technical problems, according to a fifth aspect, this application also provides an electronic device, comprising:

[0059] The memory is configured to store computer programs;

[0060] The processor is configured to perform any of the storage device access methods described above when executing a computer program.

[0061] To address the aforementioned technical problems, according to a sixth aspect, this application also provides a computer non-volatile readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the storage device access methods described above.

[0062] This application provides a storage device access method. By using the storage device's public key to verify the user's digital certificate sent by the virtual machine system, it ensures that only users with valid certificates can access specific virtual functions. This verification mechanism can be precise down to each virtual function, thereby achieving fine-grained control over individual virtual functions. When the user's digital certificate is valid, a first random number is generated and encrypted using the user's public key. The virtual machine system uses the user's private key to decrypt the encrypted data to obtain a second random number, ensuring that each virtual function access request is independently verified. Only when both the user's digital certificate and the data to be verified are valid can the virtual machine system mount and recognize the virtual function, enhancing security. By generating and using random numbers in the initial verification stage, encryption and decryption operations are avoided during each data read / write operation, optimizing data transmission performance while ensuring data security.

[0063] This application also provides two other methods for accessing storage devices, computer program products, electronic devices, and computer non-volatile readable storage media, which have the same beneficial effects as the aforementioned methods for accessing storage devices. Attached Figure Description

[0064] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 is a flowchart of the steps of the first storage device access method provided in this application;

[0066] Figure 2 is a schematic diagram of a configuration space for a virtual function provided in this application;

[0067] Figure 3 is a schematic diagram of the structure of a security authentication capability register provided in this application;

[0068] Figure 4 is a flowchart of a virtual machine system for virtual function verification provided in this application;

[0069] Figure 5 is a flowchart of the steps of the second storage device access method provided in this application;

[0070] Figure 6 is a flowchart of the steps of the third storage device access method provided in this application;

[0071] Figure 7 is a schematic diagram of the structure of an electronic device provided in this application;

[0072] Figure 8 is a schematic diagram of the structure of a computer non-volatile readable storage medium provided in this application. Detailed Implementation

[0073] The core of this application is to provide a storage device access method, product, device, and non-volatile readable storage medium that enables fine-grained control over individual virtual functions, optimizing data transmission performance while ensuring data security.

[0074] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0075] Firstly, referring to Figure 1, this application provides a method for accessing a storage device, including:

[0076] S101: Based on the device public key of the storage device, verify the validity of the user digital certificate sent by the virtual machine system, which includes the user public key, and generate a first random number when the user digital certificate is valid; the user digital certificate is a digital certificate signed by the device private key in conjunction with the device public key;

[0077] In this embodiment, the storage device is a storage device supporting SR-IOV functionality. SR-IOV is a hardware I / O virtualization technology standard. As a hardware I / O virtualization solution, SR-IOV defines that I / O devices are natively shareable. One SR-IOV device can create multiple virtual devices, and allocating these virtual devices to different virtual machines achieves the sharing of physical hardware. It can be understood that a storage device supporting SR-IOV functionality can create multiple virtual functions (VFs). Different users can mount different virtual functions through virtual machines for data read and write operations. In this embodiment, a virtual machine system can mount one or more virtual functions, and a user can use one or more virtual machine systems. The storage device supporting SR-IOV functionality can be an SSD. The storage device access method in this embodiment can be executed through each virtual function virtualized by the storage device. The following description uses one virtual function as an example to illustrate the process of verifying the mounted virtual machine system; other virtual functions are similar.

[0078] It is understood that when a storage device leaves the factory, it is instructed by a private command to generate a public-private key pair internally, namely the device public key and device private key in this embodiment. The storage device saves this public-private key pair in its internal non-volatile secure memory. For ease of description and distinction, the device public key is named SSD_pubkey (Solid State Drive Public Key) and the device private key is named SSD_prikey (Solid State Drive Private Key). This public-private key pair cannot be exported in any way.

[0079] Accordingly, the user generates a public-private key pair within the virtual machine system, which is the user public key and user private key in this embodiment. For ease of description and distinction, the user public key is named user_pubkey (User Public Key), and the user private key is named user_priksy (User Private Key). The user_priksy is saved in a secure area and cannot be exported in any way. After exporting the user_pubkey, the user sends the user information (including but not limited to the username) and user_pubkey to the device administrator. The device administrator sends the user information, user_pubkey, and the PCIe (Peripheral Component Interconnect Express) number corresponding to the virtual function (i.e., the function identifier of the virtual function) to the storage device through a private command. The storage device organizes the user information and user public key into a preset digital certificate, signs the preset digital certificate using SSD_prikey, obtains the user digital certificate (named user_cert here), and returns it to the device administrator. The device administrator sends the generated user digital certificate to the user, and the user installs user_cert in a specific location in the virtual machine system.

[0080] It's understandable that after the virtual machine system starts, it retrieves the user's digital certificate containing the user_pubkey from the aforementioned specific location and transmits it to the corresponding virtual function. Upon receiving the user's digital certificate, the virtual function verifies its validity using the SSD_prikey. The SSD_prikey is pre-stored by the virtual function and corresponds to the SSD_prikey used to sign the user's digital certificate. If the user's digital certificate is verified as valid, it means that the user using the virtual machine system has permission to access the virtual function, thus ensuring that only users with valid certificates can access specific virtual functions. Using digital certificates and asymmetric key encryption / decryption for verification is more secure than using symmetric key encryption / decryption for authentication, and it also prevents data loss and compromise due to lost passwords.

[0081] When verifying the validity of a user's digital certificate, the virtual function generates a first random number. This first random number is dynamically generated, meaning that a unique first random number is generated each time the virtual machine system starts and performs security authentication with the virtual function. The first random number generated in each security authentication process is different. Even if an attacker intercepts the encrypted data in a certain security authentication process, they cannot replay this data in subsequent authentications because a different random number is used for each security authentication. This further enhances the system's security and prevents attackers from gaining access through replay attacks.

[0082] S102: Encrypt the first random number using the user's public key, obtain the encrypted data and output it, so that the virtual machine system can use the user's private key in conjunction with the user's public key to decrypt the encrypted data and obtain the second random number;

[0083] In this embodiment, the first random number is encrypted using the user's public key in the user's digital certificate to obtain encrypted data, which is then output. This encryption process ensures that only users with the corresponding user private key can decrypt the original random number (i.e., the first random number). After obtaining the encrypted data, the virtual machine system decrypts it using its pre-stored user private key to obtain the second random number. It can be understood that different virtual machine systems or different users have different user public and user private keys. Therefore, even if multiple virtual machine systems or users use the same virtual function, the encrypted data generated by each system or user and the second random number obtained by decryption are different. The second random number obtained by decryption for each virtual machine system or user is unique, ensuring the independence and security of each session, so that the second random number can be used for secondary verification of the virtual machine system in the future.

[0084] S103: When the virtual machine system outputs the data to be verified, which is encrypted with the second random number, the first random number is used to decrypt the data to be verified to obtain the plaintext data. When the plaintext data is valid, the virtual machine system responds to the request to load the hard disk driver so that the virtual machine system can recognize the sub-storage device corresponding to the virtual function in the storage device.

[0085] In this embodiment, after decrypting to obtain the second random number, the virtual machine system encrypts the data to be verified based on the second random number and outputs it to the virtual function. The data to be verified can be some data pre-agreed upon by the virtual machine system and the virtual function. After receiving the data to be verified, the virtual function uses its own generated first random number to decrypt the data to obtain plaintext data. It then judges the validity of the plaintext data, that is, whether the plaintext data is the data pre-agreed upon by itself and the virtual machine system. If the plaintext data is the data pre-agreed upon by itself and the virtual machine system, the plaintext data is deemed valid. This indicates that the virtual machine system possesses the correct user private key and is a verified legitimate user. Once the plaintext data is verified as valid, if the virtual function receives a request from the virtual machine system to load the hard disk driver, the virtual function will load the hard disk driver. If a request to load the hard disk driver is received from the virtual machine system, the hard disk driver is loaded. After the hard disk driver is loaded, the virtual machine system can identify the corresponding sub-storage device (NVMe (Non-Volatile Memory Express) device) in the storage device (such as an SSD) of the virtual function. Finally, the virtual machine system can read and write access to the sub-storage device. As can be seen, in this embodiment, by using the device public key of the storage device to verify the user digital certificate sent by the virtual machine system, it is ensured that only users with valid certificates can access specific virtual functions. This verification mechanism can be precise down to each virtual function, thereby achieving fine-grained control over individual virtual functions. When the user digital certificate is valid, a first random number is generated and encrypted using the user's public key. The virtual machine system uses the user's private key to decrypt the encrypted data to obtain a second random number, ensuring that each virtual function access request is independently verified. Only when both the user digital certificate and the data to be verified are valid can the virtual function be mounted and recognized by the virtual machine system, enhancing security. By generating and using random numbers in the initial verification stage, encryption and decryption operations are avoided during each data read and write, optimizing data transmission performance while ensuring data security.

[0086] Based on the above embodiments:

[0087] In one exemplary embodiment, each virtual function is configured with a security authentication capability register, the structure of which includes a capability identifier, a base address register, a command register, an offset register, and a data register.

[0088] It is understood that each PCIe device has a 4K configuration space. Within this configuration space, there are many registers describing PCIe-related capabilities; this space is called the PCIe capability register space. The PCIe extended capability structure is stored after address 0x100 in the PCIe configuration space. Taking the capability register example in the 4K configuration space of a PCIe device as shown in Figure 2, this embodiment implements a PCIe security authentication capability register in the PCIe extended capability structure configuration space for each virtual function; that is, the security authentication capability register in this embodiment. In Figure 2, the capability structure is located in the low address region (0 to 0xFF) of the configuration space. The capability structure header includes the following fields: Bit 15:0 Capability ID: identifies the type of capability; Bit 19:16 Capability Version: identifies the version of the capability; Bit 31:20 Next Capability Offset: points to the offset address of the next capability structure in the configuration space. The extended capability structure is located in the high address region (0x100 to 0xFFF) of the configuration space. The structure of the security authentication capability register is shown in Figure 3. The first four bytes are the PCIe extended capability register header, conforming to the definition in the PCIe basic protocol. Bits 0-16 of these four bytes are the capability identifier of the PCIe extended register (the value of this capability identifier cannot be the same as the capability ID (Identification) of the capability register defined in the PCIe protocol; this value is a user-defined value. When the virtual machine system starts, the PCIe driver of the virtual machine system detects this capability identifier when traversing the capability registers of this virtual function, thus determining that this is a PCIe security authentication capability register). The capability identifier of the extended register in Figure 3 is host read-only (i.e., the host can only read), the capability version is host read-only, and the offset of the next capability register is host read-only. Command register (host read / write, i.e., the host can read and write): The virtual machine system writes different control commands to the command register to notify the storage device of the next operation. The control commands are mainly divided into: digital certificate command WRITE_CERT, random number GET_RANDOM, data verification command VERIFY, and verification result GET_RESULT. Offset Register (Host Read / Write): Each time the virtual machine system reads or writes 4 bytes of data from the data register, the value in the offset register is the offset within the entire data set containing those 4 bytes of data, expressed in Dwords (unsigned 32-bit integers). Data Register (Host Read / Write): The virtual machine reads or writes data through this register according to different commands. The structure of this security authentication capability register also includes a base address register (not shown in Figure 3).

[0089] In one exemplary embodiment, the storage device access method further includes:

[0090] If no user digital certificate is received from the virtual machine system within a preset time period after data is detected in the base address register corresponding to the virtual function, the security authentication capability register corresponding to the virtual function is reset so that the virtual function is not recognized by the virtual machine system.

[0091] It is understandable that before a virtual machine system can communicate with a virtual function, it needs to configure the virtual function's base address register (BAR) before sending TLP (Transaction Layer Packet) messages. Therefore, in this embodiment, after detecting that data has been written to the base address register, the virtual function starts a timer with a timeout period of T. This timer is configured to monitor whether the virtual machine system completes security authentication within a specified time. The virtual function does not process the virtual machine's NVMe driver loading instruction (i.e., hard disk driver request) until security authentication is successful, thus ensuring that only authenticated virtual machine systems can access storage resources. Within time T after power-on, the virtual function waits for the virtual machine system to send the user's digital certificate. If the user's digital certificate is not received within this time, the virtual function will consider the virtual machine system as a virtual machine system on an insecure system platform because it has not provided the necessary authentication information within the specified time. The virtual function will set an authentication failure flag to indicate that the authentication process has not succeeded and reset its security authentication capability register to prevent unauthenticated virtual machine systems from attempting to use the virtual function, ensuring that the virtual function will not be recognized or used on insecure system platforms, thereby improving the overall security of the system.

[0092] In one exemplary embodiment, verifying the validity of a user digital certificate including the user's public key sent by the virtual machine system based on the device public key of the storage device includes:

[0093] In response to the detection of a digital certificate command in the command register corresponding to the virtual function, the certificate data in the data register corresponding to the virtual function is organized into a complete user digital certificate using the offset value in the offset register corresponding to the virtual function.

[0094] Verify whether the signature value of the user's digital certificate is the preset signature value based on the device public key of the storage device;

[0095] If the signature value of the user's digital certificate is the preset signature value, the user's digital certificate is deemed valid.

[0096] If the signature value of a user's digital certificate is not the preset signature value, the user's digital certificate is deemed invalid.

[0097] In this embodiment, when the PCIe driver of the virtual machine system traverses the PCIe capability registers of the solid-state drive, upon reaching the security authentication capability register, the PCIe driver reads the user digital certificate `user_cert` from a specific location in the virtual machine system and writes the value of the `WRITE_CERT` digital certificate command to the command register of the virtual function. The certificate data is then sent to the virtual function via a TLP message through the offset register and data register. The virtual function continuously organizes the certificate data in the data register using the offset value in the offset register. When the virtual function detects that the offset value in the offset register is 0xFFFF and the value in the data register is 0, it indicates that the user digital certificate transmission is complete. At this point, the signature value of the user digital certificate is verified against the preset signature value based on `SSD_pubkey`. If they are the same, the user digital certificate is valid; otherwise, it is invalid.

[0098] If the verification fails, the virtual function sets a failure flag and stops responding to subsequent processes of loading the NVMe driver.

[0099] In one exemplary embodiment, the storage device stores a mapping table, which is used to characterize the association between user information and the function identifiers of virtual functions. The user digital certificate also includes user information and the function identifiers of virtual functions.

[0100] Generating the first random number when the user's digital certificate is valid includes:

[0101] When the user's digital certificate is valid, determine whether the function identifier of the virtual function associated with the user information in the user's digital certificate in the mapping relationship table is the target identifier;

[0102] If the function identifier of the virtual function associated with the user information in the user's digital certificate in the mapping table is the target identifier, generate the first random number;

[0103] If the function identifier of the virtual function associated with the user information in the user's digital certificate in the mapping table is not the target identifier, reset the security authentication capability register corresponding to the virtual function so that the virtual function is not recognized by the virtual machine system.

[0104] In this embodiment, while the storage device uses SSD_prikey to sign the preset digital certificate to obtain the user's digital certificate and returns it to the device administrator, the SSD internally establishes a mapping table to map the user information and the PCIe number of the virtual function (i.e., the function identifier in this embodiment). This is so that during the subsequent verification of the user's digital certificate, it can also be verified whether the user accessing this virtual function is the user assigned by the administrator, thus preventing the virtual function from being randomly mounted by other users.

[0105] Optionally, when the user digital certificate is successfully verified, the mapping table is searched based on the user information in the user digital certificate to find the PCIe number associated with the user information in the user digital certificate. It is then determined whether the PCIe number is the PCIe number corresponding to this virtual function. If not, a failure flag is set and the subsequent process of loading the NVMe driver is no longer responded to.

[0106] In one exemplary embodiment, before resetting the security authentication capability register corresponding to the virtual function, the storage device access method further includes:

[0107] Write a verification failure value to the data register corresponding to the virtual function so that the virtual machine system can display an error message after obtaining the verification failure value from the data register.

[0108] The PCIe driver of the virtual machine system writes the value of GET_RESULT, the verification result, to the command register. If the virtual function verification is successful, it writes the verification result value 0 to the data register. If the verification fails, it writes the verification result value 0xFFFFFFFF to the data register and resets its security authentication capability register, no longer responding to any TLP messages.

[0109] After the user information and user digital certificate are successfully verified, the virtual function generates a 16-byte first random number and encrypts the first random number using the user's public key in user_cert to obtain the encrypted data enc_random_data.

[0110] In one exemplary embodiment, encrypting a first random number using the user's public key to obtain encrypted data and outputting it includes:

[0111] The encrypted data is obtained by encrypting the first random number using the user's public key.

[0112] In response to the detection of a random number retrieval command in the command register corresponding to the virtual function, encrypted data is written to the data register so that the virtual machine system can retrieve the encrypted data from the data register.

[0113] The virtual machine system's PCIe driver determines whether the verification was successful based on the value of the GET_RESULT command. If successful, the driver writes the value of the GET_RANDOM command to the command register and to the offset register, specifying the offset position to retrieve the data. The virtual machine then returns the encrypted data (enc_random_data) to the virtual machine via the data register. If the PCIe driver detects a verification failure, it displays an error message to the user.

[0114] In one exemplary embodiment, when receiving verification data encrypted with a second random number from the virtual machine system, decrypting the verification data using a first random number to obtain plaintext data includes:

[0115] In response to the detection of a verification data command in the command register corresponding to the virtual function, the sub-data in the data register corresponding to the virtual function is organized into complete data to be verified using the offset value in the offset register corresponding to the virtual function; the sub-data is data of a preset length in the data to be verified output by the virtual machine system and encrypted with a second random number;

[0116] The plaintext data is obtained by decrypting the data to be verified using the first random number.

[0117] The virtual machine system's PCIe driver uses `user_prikey` to decrypt the encrypted data, obtaining a second random number. This second random number, a 16-byte key, is then used to encrypt the following organized data, including but not limited to user information, the virtual function's PCIe number, the virtual function's capacity, the SSD's SN (Serial Number), and the SSD's MN (Model Number). The virtual machine system's PCIe driver writes the value of the `VERIFY` command to the command register and continuously writes to the offset register and data register, sending the encrypted data to be verified to the virtual function. After receiving the complete data to be verified, the virtual function decrypts it using its own generated first random number to obtain the plaintext data.

[0118] Verify the plaintext data for correctness. If the verification is successful, set the verification success flag and continue processing subsequent TLP messages sent by the virtual machine system.

[0119] In one exemplary embodiment, after decrypting the data to be verified using a first random number to obtain plaintext data, the storage device access method further includes:

[0120] If the plaintext data is invalid, reset the security authentication capability register corresponding to the virtual function.

[0121] If plaintext data verification fails, i.e., the plaintext data is invalid, the virtual function sets a failure flag and will no longer respond to subsequent processes of loading the NVMe driver.

[0122] The virtual machine system's PCIe driver writes the value of GET_RESULT, the verification result, to the command register, and then reads the data register. If the virtual function verification is successful, it returns 0; otherwise, it returns 0xFFFFFFFF, and the virtual function resets its security authentication capability register, ceasing to respond to any TLP messages. The virtual machine system's PCIe driver determines whether the verification was successful based on the value of the GET_RESULT command. If successful, it continues to send TLP messages to load information such as the NVMe driver. Finally, the virtual machine can recognize the VF's NVMe device and perform read and write operations. In this embodiment, during the security authentication process, the transmission of user digital certificates, encrypted data, and other data is achieved by reading and writing data using TLP messages through several registers in the PCIe security authentication capability register. This process is independent of the host system kernel and allows data transmission even without recognizing the NVMe device, offering high flexibility and convenience.

[0123] In one exemplary embodiment, the security authentication capability register corresponding to each virtual function is configured to be selectively enabled according to user commands;

[0124] Verifying the validity of a user digital certificate, which includes the user's public key, sent by the virtual machine system based on the device public key of the storage device includes:

[0125] When the security authentication capability register corresponding to the virtual function is enabled, the validity of the user digital certificate, which includes the user's public key, sent by the virtual machine system is verified based on the device public key of the storage device.

[0126] Storage device access methods also include:

[0127] If the security authentication capability register corresponding to the virtual function is not enabled, when a request to load the hard disk driver is received from the virtual machine system, the operation of loading the hard disk driver is performed so that the virtual machine system can recognize the sub-storage device corresponding to the virtual function in the storage device.

[0128] In this embodiment, the security authentication capability register corresponding to each virtual function is configured to be selectively enabled based on user commands. Within the system's Physical Function (PF), a global array is maintained for the security authentication capabilities of all virtual functions. If a virtual function is required to require security authentication upon mounting, the administrator sends a private command to the PF to enable security authentication for that virtual function. The PF then sets the corresponding index value in this array to 1. When the virtual machine system traverses the PCIe configuration space of that virtual function, it determines that security authentication is enabled based on the global array, and thus allows the virtual machine system to access the security authentication capability register for that virtual function. When a virtual function does not require security authentication, a command can be sent to the PF to disable security authentication. In this case, the virtual machine system will not access this security authentication capability register when traversing the PCIe configuration space of that virtual function.

[0129] Furthermore, the PCIe driver for the virtual machine system that needs to perform security authentication with VF also needs to be modified synchronously. When the virtual machine system starts, the PCIe driver of the virtual machine system needs to recognize the PCIe security authentication capability register and be able to perform subsequent encryption and decryption operations for verification.

[0130] Virtual machines without this security authentication PCIe driver will not recognize the PCIe security authentication capability register and will not be able to perform security authentication within the specified time. Therefore, they cannot access VFs with the security authentication function enabled and can only mount VFs with this function disabled.

[0131] In summary, this application provides a method for enabling the SR-IOV function on a solid-state drive (SSD) and then enabling the implemented PCIe security capability register. This allows the virtual machine system to verify the legitimacy of the virtual machine before allowing access during startup. Referring to Figure 4, after the virtual machine system writes to the base address register, it starts a timer with a timeout period of T. The virtual machine system enumerates the device, identifies the security authentication capability register, and sends a WRITE_CERT command and certificate data to the virtual machine system. The virtual machine system uses SSD_pubkey to verify the certificate. If the verification fails, it executes the corresponding operation for verification failure as described above. If the verification is successful, the virtual machine system generates a verification success message, and the virtual machine system sends a GET_RESULT command to obtain the verification result. If the verification is confirmed to be successful, the virtual machine system... The system reads the security authentication counter and a random number, sends a GET_RANDOM command to the virtual function, generates a random number, encrypts it using the user_pubkey from the certificate, and sends it to the virtual machine system. The virtual machine system decrypts the random number using the user_pubkey, encrypts related data using the random number, and sends a VERIFY command. The virtual function decrypts the data using the random number, compares it with the plaintext data for correctness, and sets a successful verification flag if verification is successful. If verification fails, the corresponding operation for verification failure described above is executed. The virtual machine system sends a GET_RESULT command. If verification is successful, the virtual machine system sends a load driver message, writes to the specified register, executes the load driver process, sets the sub-storage device to be ready, and the host on the virtual machine system side detects the readiness and performs read and write operations. This application ensures that virtual functions requiring security protection can only be mounted and used by certified virtual machine systems, thereby guaranteeing data security. For virtual functions that do not require security protection, the PCIe security capability register can be disabled, allowing access by virtual machines from any system, providing high flexibility and ease of operation while ensuring security.

[0132] Secondly, referring to Figure 5, this application also provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, and the storage device access method includes:

[0133] S201: Obtain the user's public key, user's private key, and user digital certificate including the user's public key from the virtual machine system; the user digital certificate is a digital certificate signed by the device's private key from the storage device.

[0134] S202: Send the user digital certificate to the target virtual function corresponding to the virtual machine system so that the target virtual function can verify the validity of the user digital certificate based on the device public key that works in conjunction with the device private key;

[0135] S203: Use the user's private key to decrypt the random number returned by the target virtual function when verifying the validity of the user's digital certificate, and send the user verification data encrypted with the random number to the target virtual function so that the target virtual function can verify the validity of the user verification data based on the random number it generates.

[0136] S204: In response to the user verifying the validity of the data, perform read / write operations on the sub-storage device corresponding to the identified target virtual function in the storage device.

[0137] In this embodiment, the above steps are implemented through a virtual machine system, which has the same beneficial effects as the first storage device access method.

[0138] Thirdly, referring to Figure 6, this application also provides a storage device access method, wherein the storage device is virtualized into multiple virtual functions, each virtual function is configured with a security authentication capability register, and the storage device access method includes:

[0139] S301: Obtain user configuration commands and adjust the security authentication status values ​​corresponding to each virtual function in the global array according to the user configuration commands. The security authentication status values ​​include on status values ​​and off status values.

[0140] S302: If the security authentication status value of the virtual function is enabled, the security authentication capability register of the virtual function is made visible to the virtual machine system, so that the virtual machine system can traverse to the security authentication capability register and perform security authentication with the virtual function. When the security authentication is successful, the virtual function is identified and mounted.

[0141] S303: If the security authentication status of a virtual function is off, the security authentication capability register that controls the virtual function is not visible to the virtual machine system.

[0142] In this embodiment, the above steps are implemented through the physical function PF, which has the same beneficial effects as the first storage device access method.

[0143] Fourthly, this application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the storage device access method as described in any of the embodiments above.

[0144] For a description of the computer program product provided in this application, please refer to the above embodiments; further details will not be repeated here.

[0145] The computer program product provided in this application has the same beneficial effects as the aforementioned storage device access method.

[0146] Fifthly, referring to Figure 7, this application also provides an electronic device, including:

[0147] Memory 21 is configured to store computer programs;

[0148] The processor 22 is configured to implement the steps of the storage device access method as described in any of the embodiments above when executing a computer program.

[0149] The electronic device also includes:

[0150] Input interface 23, connected to processor 22 via communication bus 26, is configured to acquire externally imported computer programs, parameters, and instructions, and save them to memory 21 under the control of processor 22. This input interface can be connected to an input device to receive parameters or instructions manually entered by the user. This input device can be a touch layer covering the display screen, or buttons, a trackball, or a touchpad mounted on the terminal casing.

[0151] Display unit 24 is connected to processor 22 via communication bus 26 and is configured to display data sent by processor 22. This display unit can be a liquid crystal display (LCD) or an electronic ink display, etc.

[0152] Network port 25, connected to processor 22 via communication bus 26, is configured to communicate with external terminal devices. The communication technology used for this connection can be wired or wireless, such as mobile high-definition link technology, universal serial bus, high-definition multimedia interface, wireless fidelity technology, Bluetooth communication technology, Bluetooth low-power communication technology, and communication technology based on IEEE 802.11s.

[0153] For a description of the electronic device provided in this application, please refer to the above embodiments; further details will not be repeated here.

[0154] The electronic device provided in this application has the same beneficial effects as the storage device access method described above.

[0155] Sixthly, referring to FIG8, this application also provides a computer non-volatile readable storage medium 30, on which a computer program 31 is stored, and when the computer program 31 is executed by a processor, it implements the steps of the storage device access method as described in any of the embodiments above.

[0156] The non-volatile readable storage medium 30 of the computer may include various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0157] For a description of the computer non-volatile readable storage medium 30 provided in this application, please refer to the above embodiments; further details will not be repeated here.

[0158] The computer non-volatile readable storage medium 30 provided in this application has the same beneficial effects as the storage device access method described above.

[0159] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0160] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for accessing a storage device, characterized in that, The storage device is virtualized into multiple virtual functions, and the storage device access method includes: Based on the device public key of the storage device, the validity of the user digital certificate including the user public key sent by the virtual machine system is verified, and a first random number is generated when the user digital certificate is valid; the user digital certificate is a digital certificate signed by the device private key in conjunction with the device public key; The first random number is encrypted using the user's public key to obtain encrypted data, which is then output. The virtual machine system then uses the user's private key, which is paired with the user's public key, to decrypt the encrypted data and obtain the second random number. When the virtual machine system receives the data to be verified encrypted with the second random number, it decrypts the data to be verified using the first random number to obtain plaintext data. When the plaintext data is valid, it responds to the request sent by the virtual machine system to load the hard disk driver, so that the virtual machine system can identify the sub-storage device corresponding to the virtual function in the storage device.

2. The storage device access method according to claim 1, characterized in that, Each of the virtual functions is configured with a security authentication capability register, the structure of which includes a capability identifier, a base address register, a command register, an offset register, and a data register.

3. The storage device access method according to claim 2, characterized in that, The storage device access method further includes: If, within a preset time period after detecting data in the base address register corresponding to the virtual function, the user digital certificate sent by the virtual machine system is not received, the security authentication capability register corresponding to the virtual function is reset so that the virtual function is not recognized by the virtual machine system.

4. The storage device access method according to claim 2, characterized in that, Verifying the validity of the user digital certificate, which includes the user's public key, sent by the virtual machine system based on the device public key of the storage device includes: In response to detecting the presence of a digital certificate command in the command register corresponding to the virtual function, the certificate data in the data register corresponding to the virtual function is organized into a complete user digital certificate using the offset value in the offset register corresponding to the virtual function. Verify whether the signature value of the user's digital certificate is a preset signature value based on the device public key of the storage device; If the signature value of the user digital certificate is the preset signature value, the user digital certificate is deemed valid. If the signature value of the user digital certificate is not the preset signature value, the user digital certificate is deemed invalid.

5. The storage device access method according to claim 4, characterized in that, The storage device stores a mapping table, which is used to represent the association between user information and the function identifier of the virtual function. The user digital certificate also includes user information and the function identifier of the virtual function. Generating the first random number when the user's digital certificate is valid includes: When the user digital certificate is valid, determine whether the function identifier of the virtual function associated with the user information in the user digital certificate in the mapping relationship table is the target identifier; If the function identifier of the virtual function associated with the user information in the user digital certificate in the mapping table is the target identifier, generate a first random number; If the function identifier of the virtual function associated with the user information in the user digital certificate in the mapping table is not the target identifier, the security authentication capability register corresponding to the virtual function is reset so that the virtual function is not recognized by the virtual machine system.

6. The storage device access method according to claim 5, characterized in that, Before resetting the security authentication capability register corresponding to the virtual function, the storage device access method further includes: A verification failure value is written to the data register corresponding to the virtual function, so that the virtual machine system displays an error message after obtaining the verification failure value from the data register.

7. The storage device access method according to claim 2, characterized in that, The first random number is encrypted using the user's public key to obtain encrypted data, which is then output as follows: The first random number is encrypted using the user's public key to obtain encrypted data; In response to detecting a random number retrieval command in the command register corresponding to the virtual function, the encrypted data is written into the data register so that the virtual machine system can retrieve the encrypted data from the data register.

8. The storage device access method according to claim 2, characterized in that, When the virtual machine system receives the data to be verified, which is encrypted with the second random number, and decrypts the data to be verified using the first random number to obtain plaintext data, the following steps are performed: In response to the detection that a verification data command exists in the command register corresponding to the virtual function, the sub-data in the data register corresponding to the virtual function is organized into complete data to be verified using the offset value in the offset register corresponding to the virtual function; the sub-data is data of a preset length in the data to be verified output by the virtual machine system and encrypted with the second random number; The plaintext data is obtained by decrypting the data to be verified using the first random number.

9. The storage device access method according to claim 8, characterized in that, After decrypting the data to be verified using the first random number to obtain plaintext data, the storage device access method further includes: If the plaintext data is invalid, reset the security authentication capability register corresponding to the virtual function.

10. The storage device access method according to any one of claims 2-9, characterized in that, The security authentication capability register corresponding to each of the aforementioned virtual functions is configured to be selectively enabled based on user commands; Verifying the validity of the user digital certificate, which includes the user's public key, sent by the virtual machine system based on the device public key of the storage device includes: When the security authentication capability register corresponding to the virtual function is enabled, the validity of the user digital certificate, which includes the user's public key, sent by the virtual machine system is verified based on the device public key of the storage device. The storage device access method further includes: If the security authentication capability register corresponding to the virtual function is not enabled, when a request to load the hard disk driver is received from the virtual machine system, the operation of loading the hard disk driver is performed so that the virtual machine system can recognize the sub-storage device corresponding to the virtual function in the storage device.

11. A method for accessing a storage device, characterized in that, The storage device is virtualized into multiple virtual functions, and the storage device access method includes: Obtain the user's public key, user's private key, and user digital certificate including the user's public key from the virtual machine system; the user digital certificate is a digital certificate signed by the device private key of the storage device. The user digital certificate is sent to the target virtual function corresponding to the virtual machine system so that the target virtual function can verify the validity of the user digital certificate based on the device public key that works in conjunction with the device private key; The user's private key is used to decrypt the random number returned by the target virtual function when verifying the validity of the user's digital certificate, and the user verification data encrypted with the random number is sent to the target virtual function so that the target virtual function can verify the validity of the user verification data based on the random number it generates. In response to the validity of the user verification data, read and write operations are performed on the sub-storage device corresponding to the identified target virtual function in the storage device.

12. The storage device access method according to claim 11, characterized in that, Each virtual function is configured with a security authentication capability register, the structure of which includes a capability identifier, a base address register, a command register, an offset register, and a data register.

13. The storage device access method according to claim 12, characterized in that, Sending the user digital certificate to the target virtual function corresponding to the virtual machine system includes: Write the value of the data certificate command to the command register corresponding to the target virtual function, and send the user digital certificate to the target virtual function through the offset register and the data register corresponding to the target virtual function via a transaction layer packet (TLP) message.

14. The storage device access method according to claim 12, characterized in that, Before decrypting the random number returned by the target virtual function when verifying the validity of the user digital certificate using the user's private key, the storage device access method further includes: Encrypted data is obtained through the data register corresponding to the target virtual function, wherein the encrypted data is generated by encrypting a first random number using the user's public key, and the first random number is a random number generated when verifying the validity of the user's digital certificate.

15. The storage device access method according to claim 14, characterized in that, The step of decrypting the random number returned by the target virtual function when verifying the validity of the user's digital certificate using the user's private key includes: The encrypted data is decrypted using the user's private key, which is used in conjunction with the user's public key, to obtain a second random number.

16. The storage device access method according to any one of claims 12 to 15, characterized in that, The security authentication capability register corresponding to each virtual function is configured to be selectively enabled based on user commands; Before sending the user digital certificate to the target virtual function corresponding to the virtual machine system, the storage device access method further includes: If the security authentication capability register corresponding to the target virtual function is not enabled, a request to load the hard disk driver is sent to the target virtual function so that the target virtual function can perform the operation of loading the hard disk driver.

17. A method for accessing a storage device, characterized in that, The storage device is virtualized into multiple virtual functions, each of which is configured with a security authentication capability register. The storage device access method includes: Obtain user configuration commands, and adjust the security authentication status values ​​corresponding to each virtual function in the global array according to the user configuration commands. The security authentication status values ​​include an on status value and a off status value. For each virtual function, if the security authentication status value of the virtual function is the enabled status value, the security authentication capability register of the virtual function is made visible to the virtual machine system, so that the virtual machine system can perform security authentication with the virtual function after traversing the security authentication capability register. When the security authentication is successful, the virtual function is identified and mounted. For each virtual function, if the security authentication status value of the virtual function is the off status value, the security authentication capability register of the virtual function is made invisible to the virtual machine system.

18. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the storage device access method as described in any one of claims 1-17.

19. An electronic device, characterized in that, include: The memory is configured to store computer programs; The processor is configured to implement the steps of the storage device access method as described in any one of claims 1-17 when executing the computer program.

20. A computer-defined non-volatile readable storage medium, characterized in that, The computer non-volatile readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the storage device access method as described in any one of claims 1-17.

Images