WO2015196890A1 - 硬盘安全访问控制方法和硬盘 - Google Patents

硬盘安全访问控制方法和硬盘 Download PDF

Info

Publication number
WO2015196890A1
WO2015196890A1 PCT/CN2015/079945 CN2015079945W WO2015196890A1 WO 2015196890 A1 WO2015196890 A1 WO 2015196890A1 CN 2015079945 W CN2015079945 W CN 2015079945W WO 2015196890 A1 WO2015196890 A1 WO 2015196890A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
user
security
data packet
hard disk
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2015/079945
Other languages
English (en)
French (fr)
Inventor
李熠斌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP15812145.9A priority Critical patent/EP3089040B1/en
Publication of WO2015196890A1 publication Critical patent/WO2015196890A1/zh
Priority to US15/270,734 priority patent/US10192064B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/604—Tools and structures for managing or administering access control systems
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2212/00—Indexing scheme relating to accessing, addressing or allocation within memory systems or architectures
    • G06F2212/10—Providing a specific technical effect
    • G06F2212/1052—Security improvement

Definitions

  • the embodiments of the present invention relate to the field of computer technologies, and in particular, to a hard disk security access control method and a hard disk.
  • the existing data access control technology of the hard disk is based on the upper layer application and the upper layer device.
  • the common block device storage integrates the disk into a Redundant Array of Independent Disks (RAID) group. Striping is performed on the RAID, and a logical unit (LUN) is allocated on the strip and then mapped to the upper host.
  • RAID Redundant Array of Independent Disks
  • LUN logical unit
  • the host layer manages the storage data through the file system or other device system (for example, using the device database); or
  • the hard disk is directly installed in a simple computer system, and the operating system manages the storage and access of data on the hard disk through the file system.
  • the existing distributed storage Key-Value storage system is an object-based storage system in which all data is divided into small objects and then stored in a distributed hash table based on a hash algorithm (Distributed) Hash Table, referred to as DHT, is a few locations of the ring, so that the user can find the data corresponding to the object through the Key and access the data.
  • the storage system can realize simultaneous access of multiple users to the same set of storage systems.
  • the system implements a logical layer on the interface accessed by the user, and the logical layer can Allow different users to access only the range of data they are assigned, but not the data of other users.
  • Insecure in logical design Through the management of the user in the system to manage the access of all users, it must be ensured that the user's access interface is unique and secure, and the user's access must be authenticated through the interface before the relevant data can be obtained. Access; if the system's access interface is not unique, the same data can be accessed to all users, or after the system has related vulnerabilities, any data can be accessed.
  • the embodiment of the invention provides a hard disk security access control method and a hard disk to solve the security problem of the hard disk access in the prior art.
  • an embodiment of the present invention provides a hard disk security access control method, where the hard disk includes an IP interface and a control board, and the method includes:
  • the control board unpacks the access data packet, and decomposes the authentication data packet; the authentication data packet includes user access rights information;
  • the security policy Detecting, according to the stored security policy, the access authority information of the user, determining whether the access of the user is legal; the security policy records the correspondence between the access authority information of the user and the sector identifier of each sector in the hard disk;
  • the security data is used to perform security verification on the access data packet
  • the security check passes, the user is allowed to access data in a corresponding sector in the hard disk according to the sector identifier.
  • the detecting the access authority information of the user according to the stored security policy, and determining whether the access of the user is legal includes:
  • the user's access rights information is matched with the user's access rights information in the corresponding relationship; if the matching is successful, the user's access is legal; if the matching is unsuccessful, the user's access is invalid.
  • the method further includes:
  • the computing policy corresponding to the user is established in the control board in advance, and the computing policy is a policy that uses a security algorithm when performing security verification on the access data packet of the user.
  • the using a security algorithm to perform security verification on the access data packet of the user includes:
  • a security check is performed on the access data packet by selecting different security algorithms or different combinations of the security algorithms according to the calculation policy.
  • each of the foregoing Hard The disk performs security verification on the access data packet of the user by using the same security algorithm; or each of the hard disks performs security verification on the access data packet of the user by using the different security algorithm.
  • an embodiment of the present invention provides a hard disk, including an IP interface and a control board.
  • the IP interface is configured to receive an access data packet of the user, and send the access data packet to the control board;
  • the control panel includes:
  • An unpacking module configured to unpack the access data packet, and decompose the authentication data packet; the authentication data packet includes user access rights information;
  • the detecting module is configured to detect the access authority information of the user according to the stored security policy, and determine whether the access of the user is legal; the security policy records the access authority information of the user and the sector identifier of each sector in the hard disk. Correspondence relationship;
  • a security check module configured to perform security check on the access data packet by using a security algorithm if the access of the user is legal
  • the access execution module is configured to allow the user to access data in a corresponding sector in the hard disk according to the sector identifier if the security check passes.
  • the detecting module is specifically configured to:
  • the user's access rights information is matched with the user's access rights information in the corresponding relationship; if the matching is successful, the user's access is legal; if the matching is unsuccessful, the user's access is invalid.
  • control panel further includes:
  • a security policy establishing module configured to pre-establish a computing policy corresponding to the user in the control board, where the computing policy is a policy that uses a security algorithm when performing security verification on the access data packet of the user.
  • the security verification module is specifically configured to:
  • a security check is performed on the access data packet by selecting different security algorithms or different combinations of the security algorithms according to the calculation policy.
  • the hard disk includes an IP interface and a control board, and the access data packet of the user is received through the IP interface, and the access data packet is sent to the control board;
  • the control board unpacks the access data packet, and decomposes the authentication data packet;
  • the authentication data packet includes access authority information of the user; detects the access authority information of the user according to the stored security policy, and determines the user. Whether the access is legal; the security policy records the correspondence between the user's access rights information and the sector identifier of each sector in the hard disk; if the user's access is legal, the access data packet is performed using a security algorithm.
  • the security check is passed, the user is allowed to access the data in the corresponding sector in the hard disk according to the sector identifier, thereby realizing the security control of the user access to the hard disk and improving the security of the access.
  • Sexuality solves the security problem of hard disk access in the prior art.
  • Embodiment 1 is a flowchart of Embodiment 1 of a method for securely accessing a hard disk according to the present invention
  • FIG. 2 is a schematic diagram of a logical architecture of a security access control layer according to Embodiment 1 of a hard disk security access control method according to the present invention
  • Embodiment 1 of a hard disk according to the present invention is a schematic structural diagram of Embodiment 1 of a hard disk according to the present invention.
  • Embodiment 4 is a schematic structural diagram of Embodiment 2 of a hard disk according to the present invention.
  • FIG. 5 is a schematic structural diagram of an embodiment of a hard disk device according to the present invention.
  • FIG. 1 is a flowchart of a first embodiment of a hard disk security access control method according to the present invention.
  • FIG. 2 is a schematic diagram of a logical architecture of a security access control layer according to a first embodiment of a hard disk security access control method according to the present invention.
  • a hard disk based on an IP interface.
  • the hard disk can pass Software and hardware implementation.
  • the hard disk includes an IP interface and a control board.
  • the method in this embodiment may include:
  • Step 101 The IP interface receives the access data packet of the user, and sends the access data packet to the control board.
  • Step 102 The control board unpacks the access data packet, and decomposes the authentication data packet; the authentication data packet includes the access authority information of the user.
  • the hard disk implements external data access through the IP interface, and the IP interface of the hard disk has the linkability similar to the computer network node, and the hard disk itself has certain computing power, and the present invention is in the hard disk.
  • a security chip is set on the control board, and the security chip implements encryption and permission verification for each sector of the hard disk (different sectors can correspond to different users), and all accesses to the hard disk are realized based on the computing and storage capabilities of the chip on the control board. Authentication, all illegal access will not be executed.
  • the existing access control of the data in the hard disk controls the access at the upper logical level. If the authentication is performed, all the read and write commands sent from the upper layer to the hard disk are executed without any restriction.
  • the hard disk security access control of the present invention is implemented on the hard disk. As shown in FIG. 2, the user access is authenticated through the secure access control layer, and the authenticated access can be performed. If not, the hard disk will refuse access. .
  • the computing chip and the memory chip are used to implement the "secure access control layer" on the control board of the hard disk.
  • the computing chip, the memory chip and the security chip can be implemented by the same chip, or can be implemented by several different chips, as shown in FIG. 2
  • the security access control layer is determined by four main layers on the I/O processing path of the hard disk: the security access protocol unpacking layer, the sector identification table library layer, the algorithm library layer, and the access execution layer, after accessing the execution layer. It also includes a hard disk read/write implementation layer, which can adopt an existing hard disk read/write implementation manner, and step 102 can be implemented on the security access protocol unpacking layer, unpacking the user access data packet, and accessing the data packet.
  • the authentication packet containing the user's access rights information is decomposed and used by the lower layer.
  • Step 103 Detect the access authority information of the user according to the stored security policy, and determine whether the access of the user is legal.
  • the security policy records the correspondence between the access authority information of the user and the sector identifier of each sector in the hard disk.
  • step 103 may be implemented on a sector identifier table library layer, and the access rights information includes, for example, a sector identifier of a sector that the user can access, a security algorithm used by the user, and the like; Corresponding relationship between the access authority information of the user and the sector identifier of each sector in the hard disk is recorded, and the corresponding relationship is that the access authority of the user 1 corresponds to the sector identifier 1, and the access authority of the user 2 corresponds to the sector identifier 2, etc.
  • the access authority information may be determined according to the corresponding relationship in the security policy to determine whether the user's access is legal. If the sector identifier in the access authority information is consistent with the sector identifier in the correspondence between the access authority information and the sector identifier, It is legal, otherwise it is not legal.
  • Step 104 If the user's access is legal, the security algorithm is used to perform security verification on the access packet of the user.
  • the step 104 can be implemented on the algorithm library layer. If the user's access is legal, the security algorithm is used to perform security check on the user's access data packet, and the verification method in the prior art can be used for verification.
  • the algorithm library layer stores a security algorithm that performs security checks on user access.
  • Step 105 If the security check passes, the user is allowed to access data in a corresponding sector in the hard disk according to the sector identifier.
  • step 105 can be implemented on the access execution layer. If the security check passes, the user is allowed to access data in the corresponding sector in the hard disk.
  • the embodiment of the invention realizes the real security isolation of the final data storage user in the hard disk.
  • the present invention is based entirely on the end user, rather than on any device and logic level that uses the hard disk, with device independence and logical independence; the architecture is simple and easy to implement.
  • the hard disk of this embodiment includes a solid state hard disk and other storage devices, or a conventional hard disk with an IP interface and a security chip.
  • the hard disk includes an IP interface and a control board, and receives an access data packet of the user through the IP interface, and sends the access data packet to the control board; the control board accesses the access data packet.
  • the method of the embodiment detects the access authority information of the user according to the stored security policy, and determines whether the user access is legal, including:
  • the user's access rights information is matched with the user's access rights information in the corresponding relationship. If the matching is successful, the user's access is legal. If the matching is unsuccessful, the user's access is invalid.
  • the sector identification table library layer can be used to identify all the sectors in the hard disk, and the corresponding relationship between the different sector identifiers and the user's access rights is set.
  • the access authority of the user 1 corresponds to the sector identifier 1.
  • the access authority of the user 2 is matched with the sector identifier 2, etc., and the access authority information of the user is matched with the access authority information of the user corresponding to the sector identifier of each sector in the hard disk, and the access isolation of different users can be achieved by matching.
  • the method further includes:
  • a calculation strategy corresponding to the user is established in the control board in advance, and the calculation strategy is a strategy of using a security algorithm when performing security verification on the access packet of the user.
  • the security algorithm is used to perform security verification on the user's access data packet, including:
  • a security algorithm is selected according to the computing strategy by selecting a different security algorithm or a combination of different security algorithms.
  • a calculation strategy corresponding to the user may be established, and multiple stored security algorithms may be implemented to manage policies, and different algorithms may be specified to manage different sectors.
  • multiple stored security algorithms may be implemented to manage policies, and different algorithms may be specified to manage different sectors.
  • Each user can select a specific algorithm to manage their own data area; it can also implement overlapping check of multiple different algorithms for some specific areas to increase security.
  • the security policy can be selected by using a combination of different security algorithms or different security algorithms. That is, the security algorithm used for each access of the user may be “one-time” or “multiple-time”; wherein “one-time” means that it is valid once, that is, the security algorithm used for each access is different, multiple times. Sex refers to the same security algorithm used for multiple accesses, which can achieve higher security at one time.
  • each of the hard disks performs security verification on the access data packets of the user by using the same security algorithm; or each of the hard disks passes different The security algorithm performs a security check on the access packet of the user.
  • multiple hard disks can provide only some sectors of the hard disk storage capacity to form the private storage space of the user, so the data access control for each hard disk can pass the same Security algorithm implementation, can also be implemented by different security algorithms This can now be achieved by a security policy in the algorithm library layer.
  • the isolation and security of the access sector of the magnetic head of the hard disk can be achieved, and the number of supported users can logically reach the limit of the number of all normally accessed sectors in one hard disk (one user). Corresponding to one sector).
  • Multiple hard disks can be peer-to-peer encrypted to achieve the same security algorithm for the same user; or unequal encryption to implement different algorithms for the same user, ultimately achieving user security control of hard disk access and improving access security.
  • the security problem of hard disk access in the prior art is solved.
  • the hard disk 30 of the present embodiment includes an IP interface 31 and a control board 32, and the IP interface 31 is configured to receive a user access data packet. And sending the access data packet to the control board;
  • the control board 32 includes: an unpacking module 301, a detecting module 302, a security checking module 303, and an access executing module 304.
  • the unpacking module 301 is configured to unpack the access data packet and decompose the template.
  • the authentication data packet includes the access authority information of the user;
  • the detecting module 302 is configured to detect the access authority information of the user according to the stored security policy, and determine whether the access of the user is legal; the security policy Corresponding relationship between the access right information of the user and the sector identifier of each sector in the hard disk is recorded;
  • the security check module 303 is configured to secure the access data packet by using a security algorithm if the access of the user is legal.
  • the verification execution module 304 is configured to allow the user to access data in a corresponding sector in the hard disk according to the sector identifier if the security check passes.
  • the hard disk of this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • Embodiment 2 of the hard disk of the present invention is a schematic structural diagram of Embodiment 2 of the hard disk of the present invention. As shown in FIG. 4, the hard disk of this embodiment is based on the hard disk structure shown in FIG. 3, and further, the detecting module 302 is specifically configured to:
  • the user's access rights information is matched with the user's access rights information in the corresponding relationship; if the matching is successful, the user's access is legal; if the matching is unsuccessful, the user's access is invalid.
  • control board 32 further includes:
  • the security policy establishing module 305 is configured to pre-establish a computing policy corresponding to the user in the control board, where the computing policy is a policy that uses a security algorithm when performing security verification on the access data packet of the user.
  • the security check module 303 is specifically configured to:
  • a security check is performed on the access data packet by selecting different security algorithms or different combinations of the security algorithms according to the calculation policy.
  • the hard disk of this embodiment may be used to implement the technical solution of the second embodiment of the method.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 5 is a schematic structural diagram of an embodiment of a hard disk device according to the present invention.
  • the hard disk device 50 provided in this embodiment includes an IP interface 501 and a control board 502.
  • the control board 502 includes a processor 5020 and a memory 5021.
  • the IP interface 501 is configured to receive a user access packet.
  • the access data packet is sent to the control board;
  • the memory 5021 stores data and execution instructions.
  • the processor 5020 communicates with the memory 5021, and the processor 5020 calls the execution instruction in the memory 5021. Do the following:
  • the authentication data packet includes user access rights information
  • the security policy Detecting, according to the stored security policy, the access authority information of the user, determining whether the access of the user is legal; the security policy records the correspondence between the access authority information of the user and the sector identifier of each sector in the hard disk;
  • the security data is used to perform security verification on the access data packet
  • the security check passes, the user is allowed to access data in a corresponding sector in the hard disk according to the sector identifier.
  • processor 5020 is further configured to:
  • the user's access rights information is matched with the user's access rights information in the corresponding relationship; if the matching is successful, the user's access is legal; if the matching is unsuccessful, the user's access is invalid.
  • processor 5020 is further configured to:
  • the computing policy corresponding to the user is established in the control board in advance, and the computing policy is a policy that uses a security algorithm when performing security verification on the access data packet of the user.
  • processor 5020 is further configured to:
  • a security check is performed on the access data packet by selecting different security algorithms or different combinations of the security algorithms according to the calculation policy.
  • processor 5020 is further configured to:
  • each of the hard disks performs security verification on the access packets of the user by using the same security algorithm; or each of the hard disks passes different security.
  • the algorithm performs security verification on the access packet of the user.
  • the hard disk device of this embodiment is used to implement the technical solution described in any of the method embodiments, and the implementation principle and technical effects are similar, and details are not described herein again.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit or module is only a logical function division.
  • there may be another division manner for example, multiple units or modules may be used. Combinations can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or module, and may be electrical, mechanical or otherwise.
  • the modules described as separate components may or may not be physically separated.
  • the components displayed as modules may or may not be physical modules, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Databases & Information Systems (AREA)
  • Automation & Control Theory (AREA)
  • Storage Device Security (AREA)

Abstract

本发明实施例提供一种硬盘安全访问控制方法和硬盘。本发明硬盘安全访问控制方法，硬盘包括IP接口和控制板，所述方法包括：IP接口接收用户的访问数据包，并将访问数据包发送给控制板；控制板对访问数据包进行解包，分解出鉴权数据包；鉴权数据包包括用户的访问权限信息；根据存储的安全策略检测所述用户的访问权限信息，确定用户的访问是否合法；安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；若用户的访问合法，则使用安全算法对用户的访问数据包进行安全校验；若安全校验通过，则根据扇区标识允许用户对硬盘中对应扇区内的数据进行访问。本发明实施例提高了对硬盘访问的安全性。

Description

硬盘安全访问控制方法和硬盘 技术领域
本发明实施例涉及计算机技术领域，尤其涉及一种硬盘安全访问控制方法和硬盘。
背景技术
现有的硬盘数据访问控制技术是基于上层应用和上层设备的，例如在存储设备中，普通的块设备存储把磁盘整合为一个独立冗余磁盘阵列(Redundant Array of Independent Disks，简称RAID)组，在RAID上划分出条带，在条带上划分出逻辑单元(Logic Unit，简称LUN)然后映射给上层主机，主机层通过文件系统或者其他设备系统管理存储数据(例如使用设备的数据库)；或者硬盘直接安装在简单的计算机系统中，操作系统通过文件系统对硬盘上的数据存放和访问方式提供管理。
现有的分布式存储Key-Value存储系统是一种基于对象的存储系统，在该存储系统中，把所有的数据划分成小的对象，然后基于散列算法存放到分布式哈希表(Distributed Hash Table，简称DHT)环的几个位置，这样用户可以通过Key来找到对象所对应的数据，对数据实现访问。该存储系统可以实现多个用户对同一套存储系统的同时访问，为了实现多个用户的数据访问隔离，保护数据的安全，该系统会在用户访问的接口上实现一个逻辑层，该逻辑层可以让不同用户能够且只能够访问自己所被分配的数据范围，而不能访问其他用户的数据。
现有技术的Key-Value存储设备的实现原理其实也是一种逻辑的隔离。逻辑设计上具有不安全性：通过系统中的用户管理层实现对所有用户访问的管理，必须确保用户的访问接口是唯一并且安全的，用户的访问必须通过该接口鉴权以后才能获得对相关数据的访问；如果系统的访问接口不唯一，一样可以访问到所有用户的数据，或者系统存在相关漏洞后，任何数据都是可以被访问的。
发明内容
本发明实施例提供一种硬盘安全访问控制方法和硬盘，以解决现有技术中对硬盘访问的安全问题。
第一方面，本发明实施例提供一种硬盘安全访问控制方法，所述硬盘包括IP接口和控制板，所述方法包括：
所述IP接口接收用户的访问数据包，并将所述访问数据包发送给所述控制板；
所述控制板对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；
根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；
若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；
若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问。
结合第一方面，在第一方面的第一种实现方式中所述根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法，包括：
将所述用户的访问权限信息与所述对应关系中的用户的访问权限信息进行匹配；若匹配成功，则所述用户的访问合法；若匹配不成功，则所述用户的访问不合法。
结合第一方面、或第一方面的第一种实现方式，在第一方面的第二种实现方式中，所述方法，还包括：
预先在所述控制板中建立所述用户对应的计算策略，所述计算策略为对所述用户的访问数据包进行安全校验时使用安全算法的策略。
结合第一方面的第二种实现方式，在第一方面的第三种实现方式中，所述使用安全算法对所述用户的访问数据包进行安全校验，包括：
对于所述用户的每次访问，根据所述计算策略选择不同的所述安全算法或不同的所述安全算法的组合对所述访问数据包进行安全校验。
结合第一方面、或第一方面的第一～第三任一种实现方式，在第一方面的第四种实现方式中，当多个所述硬盘提供数据给同一个用户时，各个所述硬 盘通过相同的所述安全算法对所述用户的访问数据包进行安全校验；或，各个所述硬盘通过不同的所述安全算法对所述用户的访问数据包进行安全校验。
第二方面，本发明实施例提供一种硬盘，包括IP接口和控制板，
所述IP接口，用于接收用户的访问数据包，并将所述访问数据包发送给所述控制板；
所述控制板，包括：
解包模块，用于对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；
检测模块，用于根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；
安全校验模块，用于若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；
访问执行模块，用于若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问。
结合第二方面，在第二方面的第一种实现方式中，所述检测模块，具体用于：
将所述用户的访问权限信息与所述对应关系中的用户的访问权限信息进行匹配；若匹配成功，则所述用户的访问合法；若匹配不成功，则所述用户的访问不合法。
结合第二方面、或第二方面的第一种实现方式，在第二方面的第二种实现方式中，所述控制板，还包括：
安全策略建立模块，用于预先在所述控制板中建立所述用户对应的计算策略，所述计算策略为对所述用户的访问数据包进行安全校验时使用安全算法的策略。
结合第二方面的第二种实现方式，在第二方面的第三种实现方式中，所述安全校验模块，具体用于：
对于所述用户的每次访问，根据所述计算策略选择不同的所述安全算法或不同的所述安全算法的组合对所述访问数据包进行安全校验。
本发明实施例硬盘安全访问控制方法和硬盘，所述硬盘包括IP接口和控制板，通过所述IP接口接收用户的访问数据包，并将所述访问数据包发送给所述控制板；所述控制板对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问，实现了用户对硬盘访问的安全控制，提高了访问的安全性，解决了现有技术中对硬盘访问的安全问题。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作一简单地介绍。
图1为本发明硬盘安全访问控制方法实施例一的流程图；
图2为本发明硬盘安全访问控制方法实施例一的安全访问控制层的逻辑架构示意图；
图3为本发明硬盘实施例一的结构示意图；
图4为本发明硬盘实施例二的结构示意图；
图5为本发明硬盘设备实施例的结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图1为本发明硬盘安全访问控制方法实施例一的流程图，图2为本发明硬盘安全访问控制方法实施例一的安全访问控制层的逻辑架构示意图，本实施例的执行主体为智能硬盘，例如是基于IP接口的硬盘。所述硬盘可以通过 软件和硬件实现。如图1所示，所述硬盘包括IP接口和控制板，本实施例的方法可以包括：
步骤101、IP接口接收用户的访问数据包，并将访问数据包发送给控制板。
步骤102、控制板对访问数据包进行解包，分解出鉴权数据包；鉴权数据包包括用户的访问权限信息。
具体地，例如在基于IP接口的硬盘中，硬盘通过IP接口实现对外的数据访问，那么该硬盘的IP接口具备类似计算机网络节点的链接性，硬盘本身也具备一定的计算能力，本发明在硬盘控制板上设置安全芯片，该安全芯片对硬盘每个扇区(不同的扇区可以对应不同的用户)实现加密和权限验证，基于该控制板上芯片的计算和存储能力实现对本硬盘所有访问的鉴权，所有不合法的访问都不会被执行。
现有的对硬盘中数据的访问控制都在上层的逻辑层次对访问进行控制，若通过鉴权则所有上层下发到硬盘的读写命令都会被执行没有任何制约。而本发明的硬盘安全访问控制是在硬盘上实现的，如图2所示，通过安全访问控制层对用户的访问进行鉴权，经过鉴权的访问可以执行，如果不能通过，硬盘会拒绝访问。
在硬盘的控制板上使用计算芯片和存储芯片实现“安全访问控制层”，计算芯片、存储芯片和安全芯片可以通过同一个芯片实现，也可以是几个不同的芯片实现的，如图2所示，安全访问控制层在硬盘的I/O处理路径上，由四个主要的层次决定：安全访问协议解包层、扇区标识表库层、算法库层和访问执行层，访问执行层之后还包括硬盘读写实现层，该层可以采用现有的硬盘对读写的实现方式，步骤102可以在安全访问协议解包层上实现，对用户的访问数据包进行解包，把访问数据包中包含有用户的访问权限信息的鉴权数据包分解出来，给下层使用。
步骤103、根据存储的安全策略检测用户的访问权限信息，确定用户的访问是否合法；安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系。
具体地，步骤103可以在扇区标识表库层上实现，访问权限信息例如包括用户可以访问的扇区的扇区标识、用户使用的安全算法等；安全策略中记 录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系，所述对应关系如用户1的访问权限对应扇区标识1，用户2的访问权限对应扇区标识2等，则可以根据安全策略中的对应关系检测确定访问权限信息确定用户的访问是否合法，如访问权限信息中的扇区标识与该访问权限信息与扇区标识的对应关系中的扇区标识一致，则认为是合法的，否则不合法。
步骤104、若用户的访问合法，则使用安全算法对用户的访问数据包进行安全校验。
具体地，步骤104可以在算法库层上实现，若检测到用户的访问合法，则使用安全算法对用户的访问数据包进行安全校验，可以使用现有技术中的校验方式进行校验。算法库层存储对用户的访问进行安全校验的安全算法。
步骤105、若安全校验通过，则根据所述扇区标识允许用户对硬盘中对应扇区内的数据进行访问。
具体地，步骤105可以在访问执行层上实现，若安全校验通过，则允许用户对硬盘中对应扇区内的数据进行访问。
本发明实施例实现硬盘内最终数据存放用户的真正安全隔离。
本发明是完全基于最终用户，而非面对使用该硬盘的任何设备和逻辑层次，具有设备无关性和逻辑独立性；该架构结构简单，容易实现。
本实施例的硬盘包括固态硬盘以及其他存储设备，或增加IP接口和安全芯片的传统硬盘。
本实施例，所述硬盘包括IP接口和控制板，通过所述IP接口接收用户的访问数据包，并将所述访问数据包发送给所述控制板；所述控制板对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问，实现了用户对硬盘访问的安全控制，提高了访问的安全性，解决了现有技术中对硬盘访问的安全问题。
在本发明硬盘安全访问控制方法实施例二中，在方法实施例一的基础上， 本实施例的方法，根据存储的安全策略检测用户的访问权限信息，确定用户的访问是否合法，包括：
将用户的访问权限信息与对应关系中的用户的访问权限信息进行匹配；若匹配成功，则用户的访问合法；若匹配不成功，则用户的访问不合法。
具体地，可以在扇区标识表库层上实现对本硬盘中所有的扇区进行标识，设置不同的扇区标识与用户的访问权限的对应关系，如用户1的访问权限对应扇区标识1，用户2的访问权限对应扇区标识2等，将所述用户的访问权限信息与硬盘内各个扇区的扇区标识对应的用户的访问权限信息进行匹配，通过匹配可以实现不同用户的访问隔离。
可选地，所述方法，还包括：
预先在所述控制板中建立用户对应的计算策略，计算策略为对用户的访问数据包进行安全校验时使用安全算法的策略。
可选地，使用安全算法对用户的访问数据包进行安全校验，包括：
对于用户的每次访问，根据所述计算策略选择不同的安全算法或不同的安全算法的组合对访问数据包进行安全校验。
具体地，在算法库层中，可以建立用户对应的计算策略，可以对存储的多个安全算法实现策略的管理，可以指定不同的算法管理不同的扇区，在基于磁盘的多用户系统中，各个用户可以选择特定的算法来管理自己的数据区域；还可以对一些特定的区域实现多个不同算法的重叠校验，以增加安全性。
对于用户的每次访问，通过计算策略可以选择不同的安全算法或不同的安全算法的组合对访问数据包进行安全校验。即对于用户的每次访问使用的安全算法可以是“一次性”，也可以是“多次性”；其中，“一次性”是指一次有效，即每次访问使用的安全算法不同，多次性是指多次访问使用的安全算法相同，一次性可以实现比较高的安全度。
可选地，当多个所述硬盘提供数据给同一个用户时，各个所述硬盘通过相同的所述安全算法对所述用户的访问数据包进行安全校验；或，各个所述硬盘通过不同的所述安全算法对所述用户的访问数据包进行安全校验。
具体地，当多个硬盘提供数据给同一个用户时，多个硬盘可以只提供硬盘存储能力中的部分扇区去组成该用户的私有存储空间，那么对每块硬盘的数据访问控制可以通过同样的安全算法实现，也可以通过不同的安全算法实 现，这可以由算法库层中的安全策略来实现。
本实施例，可以实现以硬盘的磁头的访问扇区为最小粒度的隔离和安全，也是说，支持的用户数量在逻辑上是可以达到一个硬盘内所有正常访问的扇区数目为极限(一个用户对应一个扇区)。多个硬盘可以对等加密，实现对同一用户使用相同的安全算法；或不对等的加密，实现对同一用户使用不同的算法，最终实现了用户对硬盘访问的安全控制，提高了访问的安全性，解决了现有技术中对硬盘访问的安全问题。
图3为本发明硬盘实施例一的结构示意图，如图3所示，本实施例的硬盘30，包括IP接口31和控制板32，所述IP接口31，用于接收用户的访问数据包，并将所述访问数据包发送给所述控制板；
所述控制板32，包括：解包模块301、检测模块302、安全校验模块303和访问执行模块304，其中，解包模块301，用于对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；检测模块302，用于根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；安全校验模块303，用于若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；访问执行模块304，用于若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问。
本实施例的硬盘，可以用于执行图1所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图4为本发明硬盘实施例二的结构示意图，如图4所示，本实施例的硬盘在图3所示硬盘结构的基础上，进一步地，检测模块302，具体用于：
将所述用户的访问权限信息与所述对应关系中的用户的访问权限信息进行匹配；若匹配成功，则所述用户的访问合法；若匹配不成功，则所述用户的访问不合法。
可选地，所述控制板32，还包括：
安全策略建立模块305，用于预先在所述控制板中建立所述用户对应的计算策略，所述计算策略为对所述用户的访问数据包进行安全校验时使用安全算法的策略。
可选地，安全校验模块303，具体用于：
对于所述用户的每次访问，根据所述计算策略选择不同的所述安全算法或不同的所述安全算法的组合对所述访问数据包进行安全校验。
本实施例的硬盘，可以用于执行方法实施例二的技术方案，其实现原理和技术效果类似，此处不再赘述。
图5为本发明硬盘设备实施例的结构示意图。如图5所示，本实施例提供的硬盘设备50包括IP接口501和控制板502，其中控制板502包括处理器5020和存储器5021；其中，IP接口501用于接收用户的访问数据包，并将所述访问数据包发送给所述控制板；存储器5021存储数据和执行指令，当硬盘设备50运行时，处理器5020与存储器5021之间通信，处理器5020调用存储器5021中的执行指令，用于执行以下操作：
对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；
根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；
若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；
若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问。
可选地，所述处理器5020，还用于：
将所述用户的访问权限信息与所述对应关系中的用户的访问权限信息进行匹配；若匹配成功，则所述用户的访问合法；若匹配不成功，则所述用户的访问不合法。
可选地，所述处理器5020，还用于：
预先在所述控制板中建立所述用户对应的计算策略，所述计算策略为对所述用户的访问数据包进行安全校验时使用安全算法的策略。
可选地，所述处理器5020，还用于：
对于所述用户的每次访问，根据所述计算策略选择不同的所述安全算法或不同的所述安全算法的组合对所述访问数据包进行安全校验。
可选地，所述处理器5020，还用于：
当多个所述硬盘提供数据给同一个用户时，各个所述硬盘通过相同的所述安全算法对所述用户的访问数据包进行安全校验；或，各个所述硬盘通过不同的所述安全算法对所述用户的访问数据包进行安全校验。
本实施例的硬盘设备，用于执行任一方法实施例所述的技术方案，其实现原理和技术效果类似，此处不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。例如，以上所描述的设备实施例仅仅是示意性的，例如，所述单元或模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或模块可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，设备或模块的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (9)

  1. 一种硬盘安全访问控制方法，所述硬盘包括IP接口和控制板，其特征在于，所述方法包括：
    所述IP接口接收用户的访问数据包，并将所述访问数据包发送给所述控制板；
    所述控制板对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；
    根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；
    若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；
    若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问。
  2. 根据权利要求1所述的方法，其特征在于，所述根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法，包括：
    将所述用户的访问权限信息与所述对应关系中的用户的访问权限信息进行匹配；若匹配成功，则所述用户的访问合法；若匹配不成功，则所述用户的访问不合法。
  3. 根据权利要求1-2任一项所述的方法，其特征在于，所述方法，还包括：
    预先在所述控制板中建立所述用户对应的计算策略，所述计算策略为对所述用户的访问数据包进行安全校验时使用安全算法的策略。
  4. 根据权利要求3所述的方法，其特征在于，所述使用安全算法对所述用户的访问数据包进行安全校验，包括：
    对于所述用户的每次访问，根据所述计算策略选择不同的所述安全算法或不同的所述安全算法的组合对所述访问数据包进行安全校验。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，当多个所述硬盘提供数据给同一个用户时，各个所述硬盘通过相同的所述安全算法对所述用 户的访问数据包进行安全校验；或，各个所述硬盘通过不同的所述安全算法对所述用户的访问数据包进行安全校验。
  6. 一种硬盘，所述硬盘包括IP接口和控制板，其特征在于，
    所述IP接口，用于接收用户的访问数据包，并将所述访问数据包发送给所述控制板；
    所述控制板，包括：
    解包模块，用于对所述访问数据包进行解包，分解出鉴权数据包；所述鉴权数据包包括用户的访问权限信息；
    检测模块，用于根据存储的安全策略检测所述用户的访问权限信息，确定所述用户的访问是否合法；所述安全策略中记录有用户的访问权限信息和硬盘内各个扇区的扇区标识的对应关系；
    安全校验模块，用于若所述用户的访问合法，则使用安全算法对所述访问数据包进行安全校验；
    访问执行模块，用于若所述安全校验通过，则根据所述扇区标识允许所述用户对硬盘中对应扇区内的数据进行访问。
  7. 根据权利要求6所述的硬盘，其特征在于，所述检测模块，具体用于：
    将所述用户的访问权限信息与所述对应关系中的用户的访问权限信息进行匹配；若匹配成功，则所述用户的访问合法；若匹配不成功，则所述用户的访问不合法。
  8. 根据权利要求6-7任一项所述的硬盘，其特征在于，所述控制板，还包括：
    安全策略建立模块，用于预先在所述控制板中建立所述用户对应的计算策略，所述计算策略为对所述用户的访问数据包进行安全校验时使用安全算法的策略。
  9. 根据权利要求8所述的硬盘，其特征在于，所述安全校验模块，具体用于：
    对于所述用户的每次访问，根据所述计算策略选择不同的所述安全算法或不同的所述安全算法的组合对所述访问数据包进行安全校验
PCT/CN2015/079945 2014-06-23 2015-05-27 硬盘安全访问控制方法和硬盘 Ceased WO2015196890A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP15812145.9A EP3089040B1 (en) 2014-06-23 2015-05-27 Security access control method for hard disk, and hard disk
US15/270,734 US10192064B2 (en) 2014-06-23 2016-09-20 Method of security access control for hard disk and hard disk

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410284498.9A CN104063641B (zh) 2014-06-23 2014-06-23 硬盘安全访问控制方法和硬盘
CN201410284498.9 2014-06-23

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/270,734 Continuation US10192064B2 (en) 2014-06-23 2016-09-20 Method of security access control for hard disk and hard disk

Publications (1)

Publication Number Publication Date
WO2015196890A1 true WO2015196890A1 (zh) 2015-12-30

Family

ID=51551351

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/079945 Ceased WO2015196890A1 (zh) 2014-06-23 2015-05-27 硬盘安全访问控制方法和硬盘

Country Status (4)

Country Link
US (1) US10192064B2 (zh)
EP (1) EP3089040B1 (zh)
CN (1) CN104063641B (zh)
WO (1) WO2015196890A1 (zh)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104063641B (zh) * 2014-06-23 2017-11-24 华为技术有限公司 硬盘安全访问控制方法和硬盘
CN105069377A (zh) * 2015-08-21 2015-11-18 清华大学 安全硬盘
CN107180206B (zh) * 2016-03-11 2020-01-14 中国电子科技集团公司电子科学研究院 一种基于cdma的固态硬盘安全控制方法及装置
CN108454652B (zh) * 2017-02-22 2019-11-19 中车株洲电力机车研究所有限公司 一种安全可靠的实时测速和连续定位的方法、装置及系统
CN107247899B (zh) * 2017-05-22 2020-02-07 珠海格力电器股份有限公司 一种基于安全引擎的角色权限控制方法、装置及安全芯片
CN107194238B (zh) * 2017-05-22 2020-01-10 苏州浪潮智能科技有限公司 一种管理访问权限的方法和装置及计算机可读存储介质
EP3454216B1 (en) * 2017-09-08 2020-11-18 Nxp B.V. Method for protecting unauthorized data access from a memory
CN109660551A (zh) * 2018-12-29 2019-04-19 安徽典典科技发展有限责任公司 一种规则组件封装的数据封包及其传输方法
CN112749397A (zh) * 2019-10-29 2021-05-04 阿里巴巴集团控股有限公司 一种系统和方法
CN110990853B (zh) * 2019-11-29 2022-05-06 天津市滨海新区信息技术创新中心 动态异构冗余的数据访问保护方法及装置
CN112836221B (zh) * 2021-01-13 2024-02-06 深圳安捷丽新技术有限公司 一种多安全级别分区的便携固态硬盘及其设计方法
CN113032854A (zh) * 2021-03-30 2021-06-25 杭州华澜微电子股份有限公司 一种电子资料安全移交方法
CN115859395A (zh) * 2023-03-02 2023-03-28 北京神州慧安科技有限公司 一种具有防盗功能的硬盘及其应用的方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1795439A (zh) * 2003-03-28 2006-06-28 安全系统有限公司 计算机操作系统的安全系统与方法
CN101030175A (zh) * 2006-02-28 2007-09-05 国际商业机器公司 通用串行总线存储设备及其访问控制方法
CN101441604A (zh) * 2008-12-12 2009-05-27 成都市华为赛门铁克科技有限公司 一种固态硬盘的访问保护方法和固态硬盘
US20100017575A1 (en) * 2006-10-10 2010-01-21 Sanghoon Kim Security system for external data storage apparatus and control method thereof
GB2479227A (en) * 2010-03-30 2011-10-05 Fujitsu Ltd Preventing unauthorised access to protected data via registration and verification of device information, with hard disk self-erase capability
CN104063641A (zh) * 2014-06-23 2014-09-24 华为技术有限公司 硬盘安全访问控制方法和硬盘

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100334566C (zh) * 2002-09-06 2007-08-29 联想(北京)有限公司 在文件系统中访问硬盘任意扇区的方法
CN1595517A (zh) * 2003-09-10 2005-03-16 西安三茗科技有限责任公司 一种硬盘分区安全锁定的方法
CN100555232C (zh) * 2004-12-21 2009-10-28 西安三茗科技有限责任公司 一种硬盘Linux文件系统的数据备份还原与权限控制方法
US20060136663A1 (en) * 2004-12-22 2006-06-22 Cochran Robert A Sector-specific access control
US7634629B2 (en) * 2005-12-19 2009-12-15 Intel Corporation Mechanism to control access to a storage device
CN100590614C (zh) * 2006-08-23 2010-02-17 联想(北京)有限公司 一种虚拟技术下硬盘数据的保护方法和保护系统
CN102571434B (zh) * 2012-01-11 2014-09-10 清华大学 操作系统中网络驱动层的数据访问控制方法
KR102017828B1 (ko) * 2012-10-19 2019-09-03 삼성전자 주식회사 보안 관리 유닛, 상기 보안 관리 유닛을 포함하는 호스트 컨트롤러 인터페이스, 상기 호스트 컨트롤러 인터페이스의 동작 방법, 및 상기 호스트 컨트롤러 인터페이스를 포함하는 장치들
CN103297441A (zh) * 2013-06-25 2013-09-11 福建伊时代信息科技股份有限公司 访问控制方法和装置
US9445264B2 (en) * 2014-05-22 2016-09-13 Pacesetter, Inc. System and method for establishing a secured connection between an implantable medical device and an external device

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1795439A (zh) * 2003-03-28 2006-06-28 安全系统有限公司 计算机操作系统的安全系统与方法
CN101030175A (zh) * 2006-02-28 2007-09-05 国际商业机器公司 通用串行总线存储设备及其访问控制方法
US20100017575A1 (en) * 2006-10-10 2010-01-21 Sanghoon Kim Security system for external data storage apparatus and control method thereof
CN101441604A (zh) * 2008-12-12 2009-05-27 成都市华为赛门铁克科技有限公司 一种固态硬盘的访问保护方法和固态硬盘
GB2479227A (en) * 2010-03-30 2011-10-05 Fujitsu Ltd Preventing unauthorised access to protected data via registration and verification of device information, with hard disk self-erase capability
CN104063641A (zh) * 2014-06-23 2014-09-24 华为技术有限公司 硬盘安全访问控制方法和硬盘

Also Published As

Publication number Publication date
EP3089040B1 (en) 2018-03-07
US10192064B2 (en) 2019-01-29
EP3089040A4 (en) 2017-04-26
CN104063641A (zh) 2014-09-24
EP3089040A1 (en) 2016-11-02
CN104063641B (zh) 2017-11-24
US20170011222A1 (en) 2017-01-12

Similar Documents

Publication Publication Date Title
CN104063641B (zh) 硬盘安全访问控制方法和硬盘
US11270006B2 (en) Intelligent storage devices with cryptographic functionality
US9529735B2 (en) Secure data encryption in shared storage using namespaces
KR101719381B1 (ko) 저장 장치의 원격 액세스 제어
CN101449275B (zh) 用于存储装置的安全访问控制的系统和方法
TWI514187B (zh) 提供儲存裝置上防有毒軟體保護之系統與方法
US20080181406A1 (en) System and Method of Storage Device Data Encryption and Data Access Via a Hardware Key
US20090046858A1 (en) System and Method of Data Encryption and Data Access of a Set of Storage Devices via a Hardware Key
US9576144B2 (en) Secured file system management
CN107408096A (zh) 对硬件块的适应性存取控制
TWI789291B (zh) 用於認證在儲存裝置和主機裝置之間的資料傳輸之模組和方法
US9514325B2 (en) Secured file system management
WO2014059575A1 (zh) 输入输出操作的处理方法和装置
WO2017166362A1 (zh) 一种esim号码的写入方法、安全系统、esim号码服务器及终端
JP2023517531A (ja) 認可されていないファイル変更からフォルダを保護するためのシステム及び方法
CN110543775B (zh) 一种基于超融合理念的数据安全防护方法及系统
CN106650477A (zh) 一种加密方法和装置
US10318767B2 (en) Multi-tier security framework
CN104363229A (zh) 一种数据中心及其访问方法
US12282573B2 (en) File system protection apparatus and method in auxiliary storage device
US20220326863A1 (en) Data storage apparatus with variable computer file system
CN117573275A (zh) 一种基于TrustZone的可信容器应用安全读写方法和系统
US20180121645A1 (en) Securing a media storage device using application authority assignment
CN108111503A (zh) 基于访问限制的信息安全防护主机
CN105069377A (zh) 安全硬盘

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15812145

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015812145

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015812145

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE