阅读说明：本技术 自配置加密硬盘及其配置方法、系统及系统的启动方法 (Self-configuration encrypted hard disk, configuration method and system thereof, and starting method of system ) 是由 方刚 闻哲航 于 2021-10-13 设计创作，主要内容包括：公开了一种自配置加密硬盘及其配置方法、系统及系统的启动方法,自配置加密硬盘包括存储介质以及连通主机和存储介质的主控单元,存储介质包括系统数据区,该系统数据区包括：配置模块,自配置加密硬盘在待配置状态下启动时,配置模块的可执行代码被导入到主机中,以协助用户进行自配置加密硬盘及系统的操作特性的配置；身份认证模块,在配置模块完成操作特性的配置后,身份认证模块在正常启动时对用户身份及运行环境进行安全认证,为通过认证的用户开启访问权限。本公开的自配置加密硬盘在自配置加密硬盘内设置配置模块,导入到主机执行,免除了自配置加密硬盘在配置过程中对第三方软件的依赖,具有安全、方便、低成本的优点。(The self-configured encrypted hard disk comprises a storage medium and a main control unit which is communicated with a host and the storage medium, wherein the storage medium comprises a system data area, and the system data area comprises: the configuration module is used for guiding the executable code of the configuration module into the host when the self-configuration encryption hard disk is started in a state to be configured so as to assist a user in configuring the self-configuration encryption hard disk and the operating characteristics of the system; and the identity authentication module is used for carrying out safety authentication on the identity of the user and the operating environment when the identity authentication module is normally started after the configuration module completes the configuration of the operating characteristics, and opening the access authority for the authenticated user. The self-configuration encryption hard disk disclosed by the invention is provided with the configuration module in the self-configuration encryption hard disk, and the configuration module is led into the host for execution, so that the dependence of the self-configuration encryption hard disk on third-party software in the configuration process is avoided, and the self-configuration encryption hard disk has the advantages of safety, convenience and low cost.)

1. A self-configuration encrypted hard disk comprises a main control unit and a storage medium, wherein the main control unit is communicated with a host and the storage medium to realize data processing and transmission, and the storage medium comprises a system data area, wherein the system data area comprises:

the configuration module is used for guiding executable codes of the configuration module into the host when the self-configuration encryption hard disk is started in a to-be-configured state so as to assist a user in configuring the operating characteristics of the self-configuration encryption hard disk and a system;

and the identity authentication module is started after the configuration module completes the configuration of the operating characteristics, and performs security authentication on the user identity and the operating environment to open access authority for the authenticated user.

2. The self-configuring encrypted hard disk of claim 1, wherein the system data area further comprises:

a special code unit storing a special boot code therein, the executable code within the configuration module being imported into the host under the direction of the special boot code.

3. The self-configuring encrypted hard disk of claim 1 or 2, wherein the configuration module imports the executable code into the host by MBR Shadowing, the executable code being forced to be the first executable program code imported from the self-configuring encrypted hard disk into the host.

4. The self-configuring encrypted hard disk of claim 1, wherein the storage medium further comprises a user data area, the user data area is accessed by an operating system of the self-configuring encrypted hard disk by using a logical block addressing mode, and data in the system data area cannot be accessed by the operating system by using the logical block addressing mode.

5. The self-configuring encrypted hard disk of claim 1, wherein the identity authentication module is further configured to perform a system trustworthiness measurement to verify whether the trustworthiness of the system meets a trustworthiness criterion.

6. The self-configuring cryptographic hard disk of claim 1, wherein the configuration of the operational characteristics of the self-configuring cryptographic hard disk by the configuration module comprises: establishing user information, partitioning the storage medium, establishing and managing partition keys, and recording and managing the security status of the system.

7. The self-configuring encrypted hard disk of claim 6, wherein the configuration module forms configuration parameters after completing configuration of the self-configuring encrypted hard disk, the configuration parameters being stored in the system data area.

8. A configuration method of a self-configuration encrypted hard disk comprises a main control unit and a storage medium, wherein the storage medium comprises a system data area, and the system data area comprises a configuration module and an identity authentication module, and the configuration method comprises the following steps:

responding to a command of reading a bootstrap program sent by a host, importing an executable code of the configuration module into the host for running, and entering a configuration state;

assisting a user to configure the self-configuration encryption hard disk in the configuration state, and recording configuration parameters into the system data area;

when the mobile terminal is started in a normal operation mode, user identity information provided by a host is led into the identity authentication module for identity authentication; and

And opening the access right for the user passing the identity authentication.

9. The configuration method according to claim 8, wherein before the step of importing the executable code of the configuration module into the host for running in response to a command issued by the host to read the boot program, the method further comprises: receiving a command of reading a bootstrap program sent by a host computer, judging whether the self-configuration encryption hard disk is configured or not,

when the self-configuration encryption hard disk is configured, the step of importing the user identity information provided by the host computer into the identity authentication module for identity authentication is executed until the access right is opened for the user passing the identity authentication;

when the self-configuration encryption hard disk is not configured or needs to be reconfigured, the executable code of the configuration module is imported into the host for running, the step of entering the configuration state is carried out until the configuration is completed, and the access right is opened for the user passing the identity authentication.

10. The configuration method according to claim 8, wherein the importing the user identity information provided by the host into the identity authentication module for identity authentication further comprises: and measuring the credibility of the system, and starting the user access right of the system with the credibility reaching the credibility standard.

11. The configuration method of claim 8, wherein after the step of performing identity authentication, further comprising: and entering a configuration modification state and modifying the configuration parameters.

12. A self-configuring encrypted hard disk system, comprising:

the self-configuring encrypting hard disk according to any one of claims 1 to 7; and

the host is connected with the main control unit of the self-configuration encryption hard disk to realize data transmission and comprises a system firmware unit and a processor, wherein the system firmware unit assists the self-configuration encryption hard disk to complete the configuration of the operating characteristics.

13. A boot method of a self-configurable encrypted hard disk system, the boot method being performed on the self-configurable encrypted hard disk system of claim 12, the boot method comprising:

the system firmware unit performs hardware configuration and self-check of a host system;

the host sends a command for reading a bootstrap program to the self-configuration encryption hard disk, and loads a special bootstrap code into the host;

when the self-configuration encryption hard disk does not configure the operation characteristics, a special boot code leads the executable code of the configuration module into a host to run;

when the self-configuration encryption hard disk completes configuration of the operation characteristics, a special boot code leads the security protection code of the identity authentication module into a host for operation;

After the identity authentication is finished, the self-configuration encryption hard disk sequentially imports the main boot record, the boot loading program and the relevant codes of the operating system into the host computer for operation.

Technical Field

The invention relates to the field of information security storage, in particular to a self-configuration encrypted hard disk and a configuration method thereof, and a self-configuration encrypted hard disk system and a starting method thereof.

Background

At present, data encryption has become an effective means for protecting data and privacy, and the application of the data encryption to storage devices is particularly important. For example, for a system where an encrypted hard disk is located, information contained in elements such as a Central Processing Unit (CPU) or a memory (RAM) of a host computer has volatility, that is, the information disappears rapidly and automatically with the removal of a system power supply, and the system does not have the characteristic of being attacked continuously. While information stored in a storage device (e.g., a solid state drive) is stored in a non-volatile storage medium and retained for a long time. No matter what cause the storage device to fall into the hands of the malicious user (stealing, losing, etc.), the information contained therein is at risk of being attacked, and if no powerful protection measures are applied to the data, the data may be maliciously modified, divulged, etc., thereby causing various extremely harmful results.

The data protection method widely adopted at present adopts cryptographic algorithm encryption to ensure that only a user obtaining legal authorization can perform operations in the authority on stored data. The encryption operation can be implemented by software in a computer system, such as the bitpointer technology of Microsoft corporation, which can be implemented in any system equipped with Microsoft operating system, but the encryption and decryption operations consume the computing power of the CPU and cannot be done transparently and in real time. Encryption of stored data may also be implemented by dedicated hardware. To standardize the related software, hardware and system operation processes, the industry has established a series of standards, such as Trusted Computing device architecture (TCG) established by the international Trusted Computing Group, and particularly TCG Opal protocol established specifically for storage devices. The use of such protocols also requires storage products to perform operations that are compliant with the specifications, including storage media management, encryption key management, user management and rights management, etc. The implementation of these related functions is typically performed by management software (typically by a commercial software developer, ISV) running in the host.

Before the encryption hard disk can play a function of protecting data, a series of configuration must be carried out on the operating characteristics of the encryption hard disk, and the configuration, deployment, enabling and encryption of the encryption hard disk are all realized by means of third-party software or hardware at present. Without the assistance of third-party software and hardware, even if the encryption hard disk has a high-performance real-time password engine, the data protection function of the encryption hard disk still cannot be implemented. The adoption of such third-party software or hardware means an unacceptable cost for users, inconvenience in use, and an increase in management burden, so that the hard disk with the encryption function is used as only a normal hard disk in most cases.

Disclosure of Invention

In view of the foregoing problems, an object of the present invention is to provide a self-configurable encrypted hard disk and a configuration method thereof, which can implement configuration and deployment of the self-configurable encrypted hard disk without depending on third-party software and hardware, so as to solve the problems in the prior art.

According to an aspect of the present invention, a self-configurable encrypted hard disk is provided, including a main control unit and a storage medium, where the main control unit is connected to a host and the storage medium to implement data processing and transmission, and the storage medium includes a system data area, where the system data area includes:

The configuration module is used for guiding executable codes of the configuration module into the host when the self-configuration encryption hard disk is started in a to-be-configured state so as to assist a user in configuring the operating characteristics of the self-configuration encryption hard disk and a system;

and the identity authentication module is started after the configuration module completes the configuration of the operating characteristics, and performs security authentication on the user identity and the operating environment to open access authority for the authenticated user.

Optionally, the system data area further includes: a special code unit storing a special boot code therein, the executable code within the configuration module being imported into the host under the direction of the special boot code.

Optionally, the configuration module imports the executable code into the host by MBR Shadowing, the executable code being forced to be the first executable program code imported into the host from the self-configuring encrypted hard disk.

Optionally, the storage medium further includes a user data area, the operating system of the self-configurable encrypted hard disk accesses the user data area by using a logical block addressing manner, and data in the system data area cannot be accessed by the operating system by using the logical block addressing manner.

Optionally, the identity authentication module is further configured to perform a system credibility measurement to verify whether the credibility of the system meets a credibility standard.

Optionally, the configuring, by the configuration module, the configuration of the operating characteristics of the self-configured encrypted hard disk includes: establishing user information, partitioning the storage medium, establishing and managing partition keys, and recording and managing the security status of the system.

Optionally, the configuration module forms configuration parameters after completing configuration of the self-configured encrypted hard disk, and the configuration parameters are stored in the system data area.

According to another aspect of the present invention, there is provided a configuration method for a self-configuring encrypted hard disk, where the self-configuring encrypted hard disk includes a main control unit and a storage medium, the storage medium includes a system data area, and the system data area includes a configuration module and an identity authentication module, where the configuration method includes:

responding to a command of reading a bootstrap program sent by a host, importing an executable code of the configuration module into the host for running, and entering a configuration state;

assisting a user to configure the self-configuration encryption hard disk in the configuration state, and recording configuration parameters into the system data area;

When the mobile terminal is started in a normal operation mode, user identity information provided by a host is led into the identity authentication module for identity authentication; and

and opening the access right for the user passing the identity authentication.

Optionally, before the step of importing the executable code of the configuration module into the host for running in response to a command issued by the host to read the boot program, and entering the configuration device, the configuration method further includes: receiving a command of reading a bootstrap program sent by a host computer, judging whether the self-configuration encryption hard disk is configured or not,

when the self-configuration encryption hard disk is configured, the step of importing the user identity information provided by the host computer into the identity authentication module for identity authentication is executed until the access right is opened for the user passing the identity authentication;

when the self-configuration encryption hard disk is not configured or needs to be reconfigured, the executable code of the configuration module is imported into the host for running, the step of entering the configuration state is carried out until the configuration is completed, and the access right is opened for the user passing the identity authentication.

Optionally, the importing the user identity information provided by the host into the identity authentication module for identity authentication further includes: and measuring the credibility of the system, and starting the user access right of the system with the credibility reaching the credibility standard.

Optionally, after the step of performing identity authentication, the method further includes: and entering a configuration modification state and modifying the configuration parameters.

According to another aspect of the present invention, there is provided a self-configuring encrypted hard disk system, comprising:

encrypting the hard disk according to the self-configuration; and

the host is connected with the main control unit of the self-configuration encryption hard disk to realize data transmission and comprises a system firmware unit and a processor, wherein the system firmware unit assists the self-configuration encryption hard disk to complete the configuration of the operating characteristics.

According to another aspect of the present invention, there is provided a method for starting a self-configurable encrypted hard disk system, where the method is performed on the self-configurable encrypted hard disk system, and the method includes:

the system firmware unit performs hardware configuration and self-check of a host system;

the host sends a command for reading a bootstrap program to the self-configuration encryption hard disk, and loads a special bootstrap code into the host;

when the self-configuration encryption hard disk does not configure the operation characteristics, a special boot code leads the executable code of the configuration module into a host to run;

when the self-configuration encryption hard disk completes configuration of the operation characteristics, a special boot code leads the security protection code of the identity authentication module into a host for operation;

After the identity authentication is finished, the self-configuration encryption hard disk sequentially imports the main boot record, the boot loader and the relevant executable codes of the operating system into the host computer for operation.

The invention provides a self-configuration encrypted hard disk and a configuration method thereof.A configuration module is arranged in the self-configuration encrypted hard disk, the module configures the operational characteristics of the initialized hard disk, and the identity authentication function of a user can be started only after the configuration of the self-configuration encrypted hard disk is finished, so that the access right is opened for the verified user. The self-configuration encryption hard disk is internally provided with the configuration module, so that the configuration of the operation characteristics can be completed by self without depending on any other hardware or software except the self-configuration encryption hard disk; not only can be independently deployed by a single machine, but also is suitable for centralized deployment by multiple machines; no additional cost except for self-configuration of the encrypted hard disk; the advantages also make it very suitable for the design of the encryption hard disk main control SOC (System On a Chip).

Drawings

The above and other objects, features and advantages of the present invention will become more apparent from the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

Fig. 1 is a schematic block diagram showing a conventional self-encrypting hard disk;

FIG. 2 is a schematic diagram illustrating communication between a conventional self-encrypting hard disk and a host via an ISV software tool;

FIG. 3 is a block diagram showing schematic structures of a self-configuring encrypted hard disk system and a self-configuring encrypted hard disk according to an embodiment of the present invention;

FIG. 4 illustrates a lifecycle state transition diagram for a self-configuring cryptographic hard disk, according to an embodiment of the invention;

FIG. 5a is a flow chart of a configuration method of a self-configuring encryption hard disk according to a first embodiment of the present invention;

FIG. 5b is a flowchart of a configuration method of a self-configuring encryption hard disk according to a second embodiment of the present invention;

fig. 6 is a schematic diagram illustrating a system boot chain corresponding to a self-configuring encrypted hard disk according to an embodiment of the present invention.

Detailed Description

The invention will be described in more detail below with reference to the accompanying drawings. Like elements in the various figures are denoted by like reference numerals. For purposes of clarity, the various features in the drawings are not necessarily drawn to scale. In addition, certain well known components may not be shown.

The present invention will be described below based on examples, but the present invention is not limited to only these examples. In the following detailed description of the present invention, certain specific details are set forth. It will be apparent to one skilled in the art that the present invention may be practiced without these specific details. Well-known methods, procedures, components and circuits have not been described in detail so as not to obscure the present invention.

Unless the context clearly requires otherwise, throughout the description and the claims, the words "comprise", "comprising", and the like are to be construed in an inclusive sense as opposed to an exclusive or exhaustive sense; that is, what is meant is "including, but not limited to". In the description of the present invention, it is to be understood that the terms "first," "second," and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance. In addition, in the description of the present invention, "a plurality" means two or more unless otherwise specified.

The following detailed description of embodiments of the present invention is provided in connection with the accompanying drawings and examples.

Fig. 1 shows a schematic block diagram of a conventional self-encrypting hard disk.

At present, most hard disks widely used have a hardware encryption function, and such a hard disk with an encryption function is generally called a "Self-Encrypting hard disk" (SED). The hard disk is, for example, a solid state disk, which is a storage hard disk made of a solid state electronic storage chip. The cryptographic engine in a self-encrypting hard disk typically has sufficient capability to perform real-time or near real-time encryption and decryption operations on data. Fig. 1 is a schematic structural block diagram of a conventional SED. The method is also suitable for a Trusted Computing device architecture established by the international Trusted Computing Group (TCG), in particular to a TCG Opal protocol specially established for the storage device.

As shown in fig. 1, the encrypted hard disk 100 communicates with a host 160 through a host interface. The encrypted hard disk 100 includes a main control unit 110 and a storage medium 120, and the main control unit 110 is responsible for data management on the storage medium 120, serving as a data relay, and communicating a host 160 and the storage medium 120. Receives and processes host commands and performs the necessary processing, including data error correction, encryption, decryption, etc., on the data stream between the host 160 and the storage medium 120.

Further, host 160 includes a system firmware unit 162 (e.g., BIOS/UEFI FW) and a processor 164 (CPU 0). The main control unit 110 includes: a central processing unit 112 (CPU 1), a cryptographic engine 114 (Crypto-algorithms), a memory unit 116 (RAM/ROM), and a random number generator 118 (TRNG) for performing operations such as controlling and cryptographic processing of the hard disk subsystem. The cryptographic algorithm engine 114 uses cryptographic algorithms including, but not limited to, one or more of RSA (asymmetric cryptographic algorithm), AES (symmetric cryptographic algorithm), SM2, and SM3 to encrypt and decrypt user data to and from the host 160 in real time at high speed; the central processing unit 112 is used for controlling operations of various components in the hard disk, for example, connected to the cache unit 116, and controlling storage and release of data therein; the cache unit 116 is, for example, a RAM or a ROM; the random code generator 118 is used to generate a secret key, which has a satisfactory cryptographic strength.

The storage medium 120 is further divided into a user data area 130 and a system data area 140. The user data area 130 can be accessed by an Operating System (OS) and an application program managed by the OS according to LBA (Logical Block Address) addressing; the OS and its Boot Loader are stored in the user data area 130, and in a conventional bios (basic Input Output system) based system, the Boot Loader is stored in an LBA 0 address, which is called Master Boot Record (MBR), and in a newer UEFI standard based system, the Boot Loader is also stored in the user data area 130 in a standard agreed manner. The system data area 140 is secured and must be accessed via a special interface (e.g., a Vendor Command) and cannot be accessed via the OS via standard LBA addressing. The system data area 140 includes a firmware code unit 141, a boot code unit 142, and a security authentication unit 146. Firmware code unit 141 stores executable firmware code and related data of the hard disk subsystem; the security verification unit 146 stores a security code for determining the identity of the user, and ensures that only the user who passes the identity verification can perform subsequent operations such as reading and writing.

The encrypted hard disk 100 may adopt the TCG standard to improve data protection capability, and such protocol also requires that the encrypted hard disk 100 perform a series of configuration operations, such as storage medium management, encryption key management, user management and rights management, before data protection is implemented. The implementation of these functions, as well as other related operations, are typically implemented in a centralized management software running on host 160. The configuration operation of the encrypted hard disk 100 is described below with reference to fig. 2.

Fig. 2 shows a schematic diagram of communication between a conventional self-encrypting hard disk and a host by means of an ISV software tool.

Referring to fig. 2, for SED compliant TCG storage architectures, encryption/decryption related management functions are performed by standard commands IF-Send/IF-Receive defined by a secure management channel on the host 160 interface. The configuration software running on the host 160 collects the functions and parameters that can be supported by the configuration software from the SED100 through the standard command, calculates corresponding configuration information according to the parameters and the functions to be implemented, and then downloads the configuration information to the SED100 through the standard command, thereby completing the configuration of the SED 100. The above configuration operations are necessary for enabling the encrypted hard disk 100, but currently, such Software tool providers are collectively called ISVs (Independent Software vendors) in an ecosystem based on the TCG standard architecture. The software tools they provide are typically commodity software that is relatively expensive.

With reference to fig. 1 and fig. 2, the ISV software tool 170 runs in the host 160, so that the host 160 collects the functions and parameters that can be supported by the ISV software tool from the encrypted hard disk 100 through the standard command IF-Send/IF-Receive, calculates the corresponding configuration information, and then downloads the configuration information to the encrypted hard disk 100 through the standard command, thereby completing the configuration of the encrypted hard disk 100. Then, the main control unit 110 enables the corresponding encryption and decryption functions of the encrypted hard disk 100, and completes the secure access to the storage medium in cooperation with the storage medium 120, thereby implementing data protection.

Thus, due to the reliance on software provided by ISVs, conventional SED's are more suitable for storage-based deployment models where storage products are based on TCG Opal or similar standards, for example, for computing devices with storage (e.g., laptops distributed by the IT department of an enterprise, or external storage devices, etc.) that are managed and distributed directly by the enterprise or organization. It is also the reliance on software provided by ISVs that limits the widespread use of the cryptographic functionality of consumer encrypted hard disks in individual users, due to the additional cost burden that results. This is also one of the main reasons that most of the current encrypted hard disks are only used as ordinary hard disks. Therefore, in the configuration operation of the existing encrypted hard disk, the use of the encrypted hard disk is inconvenient and the cost is high due to the fact that the configuration operation of the existing encrypted hard disk excessively depends on the assistance of third-party software and hardware, and the data protection function cannot be well realized.

The invention improves the traditional encryption hard disk and the configuration method thereof, so that the dependence on third-party software and hardware in the configuration process can be avoided, the security and the convenience are realized, and the cost is reduced.

Fig. 3 shows a schematic block diagram of a self-configuring encrypted hard disk system and a self-configuring encrypted hard disk according to an embodiment of the present invention.

As shown in fig. 3, the self-configuring encrypted hard disk system of this embodiment includes a host 260 and a self-configuring encrypted hard disk 200, where the self-configuring encrypted hard disk 200 is connected to the host 260 through a host interface 250, the self-configuring encrypted hard disk 200 includes a main control unit 210 and a storage medium 220, the main control unit 210 is connected to the host 260 and the storage medium 220, and performs certain transmission and processing on data streams between the host 260 and the storage medium 220, such as data error correction, encryption, decryption, and the like.

Host 260 includes system firmware unit 262 (BIOS/UEFI FW) and processor 264 (CPU 0), system firmware unit 262 self-checking after power-up and assisting said self-configuring encrypted hard disk 200 to complete configuration of operational features; the processor 264 performs data processing. The storage medium 220 includes at least one user data area 230 and at least one system data area 240, the system data area 240 includes a Pre-Boot Processing module (PBP) including a configuration module 245 (PBP _ Conf) and an identity authentication module 247 (PBP _ Auth), and the self-configurable encrypted hard disk 200 of the embodiment of the present invention implements configuration and security verification of the self-configurable encrypted hard disk through the two modules, so that the configuration process of the self-configurable encrypted hard disk 200 may not depend on third-party software.

The self-configuring encrypted hard disk 200 is, for example, a solid state disk, and the main control unit 210 therein is connected between the host 260 and the storage medium 220, receives and processes commands and data sent from the host 260, and reports command execution results to the host 260 or returns data requested by the host 260. The data of the host 260 is encrypted and then written into the storage medium 220, or the data is read from the storage medium 220 and then sent to the host 260 after being decrypted.

Further, the main control unit 210 includes: a central processing unit 212 (CPU 1), a cryptographic engine 214 (Crypto-algorithms), a memory unit 216 (RAM/ROM), and a random number generator 218 (TRNG) for performing operations such as controlling and cryptographic processing of the hard disk subsystem. The cryptographic algorithm engine 214 is used for performing high-speed real-time encryption and decryption on user data to and from the host 260 by using a cryptographic algorithm, and a suitable cryptographic algorithm is a symmetric encryption and decryption algorithm such as AES or SM 4. Data transmitted from the host 260 when performing a write operation is encrypted and stored in a designated Location (LBA) in the storage medium 220. When the read operation is performed, the data in the LBA data block designated by the host 260 is read out, decrypted by the key corresponding to the authorized partition, and sent to the host 260.

The storage medium 220 includes a user data area 230 and a system data area 240, and the user data area 230 is LBA-addressable by the OS; while system data area 240 is specifically protected and not accessible by user-mode LBA addressing. The operating system OS and its boot loader are stored in the user data area 130. In a bios (basic Input Output system) based system, the Boot program is stored in LBA0 address, called Master Boot Record (MBR). I.e. the user data area 230, comprises a master boot code unit 243 (MBR), which master boot code unit 243 stores instructions for a master boot record MBR.

The system data area 240 includes a firmware code unit 241 and a special code unit 242 (mbr), and the firmware code unit 241 stores executable firmware code and related data of the hard disk subsystem, which is referred to as hard disk firmware. The hard disk firmware is executable code and data that are executed by the central processing unit 212 in the main control unit 210. The code in the special code unit shadow MBR (sMBR) 242 is used for intercepting an instruction of reading the MBR in the master boot record unit 243 during the boot process of the system, and returning the special boot program (i.e. the special boot code) according to the invention to the host for running.

Also included in system data area 240 are two modules running on the host: a configuration module 245 (PBP _ Conf) and an identity authentication module 247 (PBP _ Auth). When the self-configuring encrypted hard disk 200 is started in a state to be configured, the executable code of the configuration module 245 is imported into the host 260 to assist the user in configuring the operating characteristics of the self-configuring encrypted hard disk and the system; when the configuration module 245 is started after the configuration of the operation characteristics is completed, the identity authentication module 247 performs security authentication on the user identity and the operating environment, and opens access rights for the authenticated user. User identity authentication software is implanted in the identity authentication module 247, and encryption disk configuration software is implanted in the configuration module 245. The executable code of the configuration module 245 and the identity authentication module are imported into the host 260 under the direction of the special boot code.

The configuration module 245 functions to assist the user in configuring the operational characteristics of the hard disk and the system, including but not limited to one or more operations of establishing a user, partitioning storage medium partitions, establishing and managing partition keys, recording and managing system security status, selecting encryption algorithm, entering user login information and assigning user authority to the storage partition, recording user identity authentication information, and assigning user authority. The module is a special module added in the invention to solve the disadvantages of the traditional scheme. The function of the encryption disk is to complete the configuration of the encryption disk, so that the user can enable the functions of the encryption disk without relying on any external software. When the module needs to be started, the module is the first module which can be loaded and run in the system starting chain.

The identity authentication module 247 authenticates the identity of the user and the operating environment, and is configured to unlock the self-configuration encrypted hard disk 200 according to the identity authentication information provided by the user when the self-configuration encrypted hard disk 200 enters a protection state due to each power-on or reset after the self-configuration encrypted hard disk 200 completes configuration of the operating characteristics, so that the self-configuration encrypted hard disk enters an operable state according to the authority. After the configuration module 245 completes each configuration, the identity authentication module 247 is the first loadable module in the system boot chain.

Specifically, when the self-configured encrypted hard disk 200 is not configured or needs to be reconfigured, the configuration module 245 imports the executable code in the configuration module 245 into the host 260 through the MBR sharing technology, and the executable code in the configuration module 245 is forced to be the first executable program code imported into the host 260 from the self-configured encrypted hard disk 200; when the self-configuring encryption hard disk 200 completes configuration, after power is turned on, the security protection code in the identity authentication module 247 is imported into the host 260 for preferential execution. Therefore, after the system is powered on, the special code unit 242 selects to load the code corresponding to the configuration module 245 or the identity authentication module 247 to the host 260 according to whether the self-configured encrypted hard disk 200 is configured, and completes the corresponding function.

The specific implementation example steps of the MBR Shadowing technique can be briefly described as follows:

powering up the system; the host 260 issues a command to read the boot program to the self-configuring encrypted hard disk 200 (e.g., MBR in BIOS-based systems, MBR243 access request has been mapped to shadow MBR (MBR) 242 in the system data area 240 during the system configuration phase); in response to a boot program read command from the system, the hard disk subsystem imports a special boot code pre-embedded in a special code unit 242 (mbr) into the host 260; the host 260 runs the special boot code and imports the executable code in the configuration module 245 from the system data area 240 into the host 260 for execution. At this time, after the system is powered on, the executable code of the configuration module 245 is imported into the host 260 for execution in preference to the code of other modules, and therefore, after the system is powered on, the configuration module 245 first enters an operating state, so that the self-configuring encrypted hard disk 200 enters a configuration state. Then, the special boot code guides the security protection code in the identity authentication unit 247 into the host 260, thereby completing system credibility verification and user identity authentication; thereafter, the code in the real MBR243 or OS Loader is exported to the host 260, and the subsequent normal steps in the system boot chain are executed, completing the system boot.

Since the executable code of the configuration module 245 is forced to be the code to be executed first in the above mechanism, the system will execute the configuration module 245 first after being powered on, and complete the configuration of the self-configured encrypted hard disk 200. Since the configuration module 245 is located inside the system data area 240, it is not necessary to rely on third party software, and the configuration function is executed first, so that the security performance of the self-configuring encryption hard disk 200 can be ensured. In addition, the self-configurable encrypted hard disk 200 in the above state is a new disk that is just shipped from a factory or an initialized hard disk, and is in an unconfigured state, so that the configuration function is executed first after power-on. However, if the self-configurable encrypted hard disk 200 is configured, the identity authentication unit 247 is first executed by the host 260 after power-on. When the self-configuring encryption hard disk 200 needs to be reconfigured, the configuration function is also executed after power-on.

In summary, the present invention discloses an implementation scheme of a self-configuring encryption hard disk deployment system suitable for use on an application-specific integrated circuit (e.g., a hard disk master). Executable code stored in configuration module 245 is executed at power-on by MBR Shadowing or similar mechanism before any other executable code is brought to host 260. The code is executed before any data access, so that the configuration of a new disk format, authentication information and other necessary information can be completed according to the requirement of a security policy, third-party software is not required to be relied on, independent deployment can be realized on a single machine, the method is also suitable for centralized deployment of multiple machines, and the method is safe, convenient and low in cost.

In addition, the present invention further provides a configuration method for self-configuring an encrypted hard disk, which is specifically described with reference to fig. 4 to 6.

Fig. 4 shows a life cycle state transition diagram of a self-configuring encrypted hard disk according to an embodiment of the invention.

As shown in fig. 4, a plurality of different states of the self-configurable encrypted hard disk 200 in the life cycle are shown, which specifically include:

the first stage is as follows: and (5) initializing.

The factory-newly-shipped self-configuration encrypted hard disk 200 is initialized to a state of 'to-be-configured' (Manufactured & unitialized). The state is the default state of the new disk leaving the production line or the state of the hard disk after reinitialization, and the user can also designate the resume operation to enter. The reverse operation may be used to restore the self-configuring encrypted hard disk 200 to the original state at the factory for redeployment.

And a second stage: and (4) configuring.

When the self-configuring encrypted hard disk 200 is powered on for the first time in the user's hand, the "to-be-configured state" enters the "Configuration" state, and in this state, when the host 260 issues a command to read a boot module (MBR in BIOS or OS Loader in UEFI environment) to the self-configuring encrypted hard disk 200, the self configuring encrypted hard disk 200 will import the Configuration module 245 to the host 260 in an appropriate manner, and the Configuration module 245 is started. The configuration module 245 operating in this state assists the user in configuring the operational behavior of the encrypted hard disk to have the desired operational characteristics. The configuration module 245 establishes a user, assists the user in completing partitioning, recording user identity authentication information, assigning user rights, and the like, and records configuration information of each operation into the system data area 240 in the self-configuring encrypted hard disk 200.

And a third stage: is configured.

This state is entered after configuration is completed and the hard disk that completed the configuration operation enters the "Configured" (Configured) state. In this state, all configuration parameters have been recorded into the non-volatile system data area 240. At this time, the power-down will not affect the configuration state, i.e., the configuration parameters will be retained after the power-down. In this state, the user data will be protected as intended. Only authorized users can access the configuration according to the rights obtained at the time of configuration, and unauthorized operations (reading, writing or erasing) by unauthorized users or authorized users will be denied.

A fourth stage: and (5) identity authentication.

When the self-configuring encrypted hard disk 200 is re-powered or reset in the "configured" state, the "user Authentication" state is entered. The state may also be an implicit state, i.e., as a link in some operations. In this state, the configured hard disk, when powered on, starts the authentication module 247, which is then imported into the host 260 and run. The module is used for verifying the user identity and opening the access right corresponding to the user identity. After the configuration is completed, the data on the hard disk will be in a protected state. Only by user authentication can the data operation (read, write or erase) be performed in the assigned rights. Specifically, after entering the authentication state, the authentication module 247 receives the user authentication information from the host interface 250, and compares the user authentication information with the user authentication information recorded in the hard disk at the configuration stage according to a predetermined algorithm to determine that the visitor has the required right. Only after the legal identity authentication information is confirmed, the user can enter a subsequent operation mode, and the safety is high.

After authentication, the system may return to the second phase, re-enter the configuration mode, modify the completed configuration information, or re-initialize the hard disk. Or proceed to the fifth stage.

The fifth stage: and (5) passing the verification and operating normally.

Once the user identity is verified, the corresponding access rights are opened, so that the user can access the data according to the owned rights. After the authentication is passed, the "normal operation" (Authenticated & Operational) state is entered. In this mode, the user passes the user identity authentication, and the user state data is opened according to the corresponding authority of the user. And the user enjoys sufficient access rights (read, write or erase). Then, the user can read, write or erase the partition and the data with the authority in the state.

Fig. 5a shows a flow chart of a configuration method of a self-configuring encrypted hard disk according to a first embodiment of the invention.

The flow chart corresponds to the various states of fig. 4, as shown in fig. 5a,

in step S101, after the system is started, a command for reading a boot program from the host is received, and it is determined whether the self-configurable encrypted hard disk has been configured.

In this step, the self-configurable encrypted hard disk 200 receives a command of the host 260 to read the boot program, and then determines whether the self-configurable encrypted hard disk 200 is configured. If not, go to step S102, otherwise, go to step S104.

In step S102, in response to a command issued by the host to read the boot program, the executable code of the configuration module is imported into the host for running, and enters the configuration state.

In this step, the self-configurable encrypted hard disk 200 is not configured, and at this time, in response to a read command from the host 260, the executable code of the configuration module 245 is forced to be the first executable program code and is imported into the host 260, and enters a configuration state, and corresponding steps are executed with reference to fig. 4.

In step S103, the user is assisted in configuring the self-configurable encrypted hard disk in the configuration state, and the configuration parameters are recorded in the system data area.

In this step, a series of configurations are performed on the self-configuring encryption hard disk 200 to make it in a configured state, and the obtained configuration parameters are recorded in the system data area 240, so that data in the area is not volatilized, and the self-configuring encryption hard disk has a strong storage performance, and even after power is turned off, the configuration parameters are still kept.

After the step S103 is executed, returning to the step S101 again, and re-determining whether the self-configured encrypted hard disk has been configured, if not, indicating that the previous configuration is not successful, and continuing to execute the step S102 and the step S103 this time to re-configure the self-configured encrypted hard disk; if so, go to step S104.

In step S104, when the system is started in the normal operation mode, the user identity information provided by the host is imported into the identity authentication module for identity authentication.

In this step, when the identity authentication module 247 is started in the normal operation mode in response to the read command of the host 260, the security verification code in the identity authentication module 247 is imported into the host 260, and the user identity information from the host 260 is compared with the information in the hard disk. If the identity authentication is completed, the user identity is authenticated, and corresponding access authority can be opened for the user passing the verification.

Furthermore, the method also comprises the step of measuring the credibility of the system, and opening the user access right for the system with the credibility reaching the credibility standard. If the identity authentication is completed, at this time, the identity authentication module 247 continues to perform the credibility measurement on the system, and the user who passes the identity authentication opens the access right to consider the identity of the system to be approved, so that the security can be further improved.

In step S105, an access right is opened to the user who passes the identity authentication, and reading and writing of data and an erasing operation are performed.

In this step, the user identity authentication is successful, the access right is obtained, and corresponding read-write and erase operations are performed.

Further, the method further comprises, after the step (S104) of performing identity authentication: and entering a configuration modification state to modify the configuration parameters. In this step, the user can re-enter the configuration state after the user identity authentication is completed, and the completed configuration parameters are modified or the hard disk is re-initialized, so that the configuration modification is flexible and the application range is wide.

Thus, the configuration method of the self-configuration encryption hard disk of the embodiment is completed. The configuration method of the self-configuration encryption hard disk can firstly configure the operating characteristics of the initialized self-configuration encryption hard disk by controlling the sequence of the codes operated by the host, and only after the configuration is finished, the identity authentication function of the user is started, so that the access right is opened for the verified user. Therefore, the configuration of the operation characteristics can be completed by self, any other hardware or software except the self-configuration encryption hard disk is not needed, the operation flow is simplified, and the safety of the whole execution process is higher.

Fig. 5b shows a flow chart of a configuration method of a self-configuring encrypted hard disk according to a second embodiment of the invention.

As shown in fig. 5b, it comprises steps S201-S206, similar to the embodiment of fig. 5 a.

In step S201, after the system is started, a command for reading a boot program from the host is received, and it is determined whether the self-configurable encrypted hard disk has been configured.

In step S202, in response to a command issued by the host to read the boot program, the executable code of the configuration module is imported into the host for running, and enters the configuration state.

In step S203, the user is assisted in configuring the self-configurable encrypted hard disk in the configuration state, and the configuration parameters are recorded in the system data area.

These steps are the same as steps S101 to S103 of the first embodiment, and the description of the same parts is omitted. The difference is that after step S203, step S204 is directly performed, that is, after the step of configuring the self-configured encrypted hard disk is performed, the step of identity authentication is directly performed.

In step S204, the user identity information provided by the host is imported into the identity authentication module for identity authentication.

In step S205, the credibility of the system is measured, and the user access right is opened for the system whose credibility meets the credibility standard. If the identity authentication is completed and the user identity is authenticated, at this time, the identity authentication module 247 continues to perform credibility measurement on the system, and opens the access right for the system whose credibility reaches the credibility standard and the user who passes the identity authentication.

The present embodiment is different from the first embodiment in that the trustworthiness measurement of the system is performed as one execution step, and after the step of identity authentication, the trustworthiness measurement can be continued only if the identity authentication has been completed, otherwise the authentication is considered to have failed immediately, instead of performing the identity authentication and the trustworthiness measurement at the same time.

In step S206, an access right is opened for the user who passes the identity authentication, and reading, writing, and erasing operations on data are performed.

This step is also the same as the first embodiment, and is not described again. Through the two embodiments, the self-configuration encryption hard disk can automatically complete the configuration of the operation characteristics without depending on any other external hardware or software, the operation flow is simplified, and the safety of the whole execution process is higher.

Fig. 6 is a schematic diagram illustrating a system boot chain corresponding to a self-configuring encrypted hard disk according to an embodiment of the present invention.

When the system is started and the series of steps of fig. 4 and fig. 5a (or fig. 5 b) are executed, the above functional modules are imported into the host 260 and run in a certain order. These functional modules constitute the "startup chain" of the system. FIG. 6 is an exemplary system boot chain, also applicable to the boot method of the self-encrypting system of FIG. 3. The boot sequence of the functional modules during boot of the BIOS-based system is shown. The boot chain of a system based on UEFI firmware also behaves similarly. The system startup chain according to the invention is briefly described below by way of example in fig. 6.

As in fig. 6, S1: system FW is operated. It is the system firmware (BIOS, or UEFI FW) that begins to run first after the system is powered on. The system firmware of the host 260 performs system hardware configuration and self-checking.

S2: the mbr is run. After the system firmware completes configuration and self-test, the host 260 sends a command for reading a boot program to the self-configuration encrypted hard disk 200, and loads and executes the mbr.

S3: it is determined whether Configured (Configured). If the self-configuring cryptographic hard disk 200 has not completed the functional configuration, the mbr will load and execute the PBP _ Conf function module to complete the functional configuration (S4). Otherwise, the mbr loads and executes the PBP _ Auth module to authenticate the user identity, so as to complete the login of the user (S5).

S4: PBP _ Conf is run. The self-configuration encrypted hard disk 200 starts to enter a configuration state.

S5: PBP _ Auth is run. And after the configuration is finished, entering an identity verification step and starting to verify the identity of the user.

S6-S8: after the user identity authentication is completed and the login is completed, the MBR (master boot record), the OS Loader (boot Loader) and the related codes of the OS (operating system) are sequentially imported into the host 260 and run, thereby completing the system boot process. Thereby completing the startup chain of the system. This start chain matches the various steps shown in fig. 4-5 a (or fig. 5 b).

In summary, the self-configuring encrypted hard disk and the configuring method thereof provided by the present invention set a configuring module inside the self-configuring encrypted hard disk, the module configures the operational characteristics of the initialized hard disk, and after the configuration of the self-configuring encrypted hard disk is completed, the identity authentication function of the user is started, so as to open the access right for the verified user. The self-configuration encryption hard disk is internally provided with the configuration module, so that the configuration of the operation characteristics can be completed by self without depending on any other hardware or software except the self-configuration encryption hard disk; not only can be independently deployed by a single machine, but also is suitable for centralized deployment by multiple machines; no additional cost except for self-configuration of the encrypted hard disk; the advantages also make it very suitable for the design of the encryption hard disk main control SOC (System On a Chip).

While embodiments in accordance with the invention have been described above, these embodiments are not intended to be exhaustive or to limit the invention to the precise embodiments described. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, to thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. The invention is limited only by the claims and their full scope and equivalents.