CN105354503B - Data encryption and decryption method for storage device - Google Patents

Abstract

The invention discloses a method for encrypting and decrypting data in a storage device, comprising: providing an encryption and decryption engine, wherein the encryption and decryption engine is hardware; parses write instruction information from a write instruction, and compares the write data with the write instruction information is transmitted to the encryption and decryption engine; and a hard disk key is combined with the write command information through the encryption and decryption engine to encrypt the write data, and the encrypted write data is transmitted through a communication The port writes to a storage device.

Description

Storage device data encryption and decryption method

technical field

The present invention relates to the field of computer technology, and in particular, to a method for encrypting and decrypting data of a storage device.

Background technique

Regarding removable storage devices (hereinafter referred to as hard disks), data encryption and decryption are common methods to protect the security of user data. The existing hard disk encryption technology is usually performed by software (such as the Bitlock program of Microsoft Corporation or the open source Truecrypt program, etc.) in the system memory, or performed by the controller of the storage device inside the storage device. The key of the above-mentioned hard disk encryption technology may be exposed in the system memory or on the bus connecting the storage device, resulting in a decrease in security. Therefore, how to avoid hard disk key exposure and improve the difficulty of cracking encryption rules, etc., are important issues to be solved urgently in the technical field.

SUMMARY OF THE INVENTION

According to an embodiment of the present invention, a method for encrypting and decrypting data in a storage device includes: providing an encryption and decryption engine, where the encryption and decryption engine is hardware; and parses the write instruction information from the write instruction, and writes the write data and the write instruction information is transmitted to the encryption/decryption engine; and a hard disk key is combined with the write instruction information via the encryption/decryption engine, so as to encrypt the write data and encrypt the encrypted write data. The input data is written to a storage device through a communication port.

In one embodiment, the storage device data encryption and decryption method further includes: parsing the read command information from the read command, and transferring the undecrypted read data and the read command information from the storage device to a the encryption/decryption engine; and combining the hard disk key with the read instruction information via the encryption/decryption engine, so as to decrypt the undecrypted read data in response to the read instruction.

In one embodiment, the write command information includes the logical address indicated by the write command and the number of sectors, and the read command information includes the logical address and the sector indicated by the read command quantity. The encryption/decryption engine performs data encryption/decryption in units of the sector according to the logical address.

In one embodiment, the storage device data encryption and decryption method further includes: providing a trusted platform module, the trusted platform module includes a hard disk key supply hardware, and the hard disk key comes from the hard disk key supply hardware. The encryption/decryption engine can communicate with the hard disk key supply hardware according to a key exchange protocol to obtain the hard disk key, so as to maintain the security of the hard disk key. In another embodiment, the encryption/decryption engine is packaged with the hard disk key supply hardware, which effectively prevents the hard disk key from being exposed to the outside. In another embodiment, the encryption/decryption engine is fabricated on the same chip as the hard disk key supply hardware, which effectively prevents the hard disk key from being exposed to the outside.

The encryption and decryption engine in the above-mentioned storage device data encryption and decryption method of the present invention is implemented in hardware, and the data security is greatly improved. In addition, the write/read instruction information is also considered during data encryption and decryption, which greatly increases the difficulty of being cracked.

Hereinafter, the present invention will be described in detail by way of embodiments and in conjunction with the accompanying drawings.

Description of drawings

FIG. 1 illustrates a chipset 100 implemented in accordance with one embodiment of the present invention;

Figure 2A illustrates the XTS-AES data encryption technique;

Figure 2B illustrates the XTS-AES data decryption technique;

FIG. 3 illustrates a trusted platform module 300;

Fig. 4 is the flow chart of the hard disk key exchange protocol;

Fig. 5A is the flow chart of SATA hard disk writing;

Fig. 5B is the flow chart of SATA hard disk reading;

Fig. 6 is the SATA hard disk writing flow chart that adopts NCQ DMA;

FIG. 7 is a flow chart of USB hard disk writing.

Reference number:

100: chipset; 102: storage device main controller;

104: Encryption and decryption engine; 106: Communication port;

108: storage device;

202, 204: encryption computing hardware; 206: modular multiplication component;

208, 210: Modular addition components; 212: Encryption computing hardware;

214: decryption operation hardware; 216: modular multiplication component;

218, 220: die plus components;

300: Trusted Platform Module; 302: Trusted Platform Module Software;

304: hard disk key supply hardware;

aj: constant;

C: ciphertext; cc: data;

Cmd_Info: write/read command information;

Data: unencrypted write data/decrypted read data;

Data_Encrypted: encrypted write data / undecrypted read data;

DEK: hard disk key;

DEK_key1, DEK_key2: Two-part keys that make up the hard disk key DEK;

p: plaintext; pp: data;

S402...S406, S502...S514, S522...S534, S602...S620, S702...S714: steps;

T: Modulo multiplication result.

Detailed ways

The following description lists various embodiments of the present invention. The following description introduces the basic concepts of the invention and is not intended to limit the content of the invention. The actual scope of invention should be defined according to the scope of the patent application.

FIG. 1 illustrates a chipset 100 implemented in accordance with one embodiment of the present invention. The chipset 100 includes a storage device main controller 102 and an encryption/decryption engine 104 . The storage device master controller 102 controls communication between a communication port 106 and a storage device 108 . The communication port 106 may be, for example, a Serial Advanced Technology Attachment (SATA) interface or a Universal Serial Bus (USB) interface. The storage device 108 is also called a hard disk, and can be a mechanical hard disk or a solid-state hard disk. The encryption/decryption engine 104 is hardware and is coupled to the storage device main controller 102 to implement encryption and decryption of data written to or read from the storage device 108 . Since the encryption/decryption engine 104 is enclosed in the chipset 100 by hardware, data security is greatly improved. In one embodiment, the data encryption and decryption performed by the encryption/decryption engine 104 does not use the external space of the chipset 100 for temporary data storage at all. In one embodiment, the chipset 100 composed of the north bridge and the south bridge is made in the south bridge. In another embodiment, the encryption/decryption engine 104 can also be integrated inside the storage device main controller 102 to further improve the security of encryption and decryption. As for the storage device main controller 102, it includes parsing the write/read command information Cmd_Info from the received write/read command. In one embodiment, the write/read commands here are DMA requests sent to the chipset 100 by a direct memory access (DMA) controller of a host (not shown).

The encryption/decryption engine 104 also considers the write/read command information Cmd_Info when encrypting and decrypting data, which greatly increases the difficulty of being cracked.

This paragraph discusses write instructions. The storage device main controller 102 parses the write command information Cmd_Info from the received write command, and transmits the write data Data and the write command information Cmd_Info to the encryption/decryption engine 104 . The encryption/decryption engine 104 combines the hard disk key DEK with the write instruction information Cmd_Info to encrypt the write data Data, and passes the encrypted write data Data_Encrypted to the storage device main controller 102 for transparent Write to the storage device 108 through the communication port 106 .

This paragraph discusses read instructions. The storage device main controller 102 parses the read command information Cmd_Info from the received read command, and transmits the undecrypted read data Data_Encrypted and the read command information Cmd_Info from the storage device 108 to the encryption device. Decryption engine 104 . The encryption/decryption engine 104 combines the hard disk key DEK with the read instruction information Cmd_Info, so as to decrypt the undecrypted read data Data_Encrypted, and deliver the decrypted read data Data to the storage device main controller 102 responds to the read instruction.

The data accessed by the DMA request is transmitted in units of data blocks with a relatively fixed format, which facilitates the encryption and decryption engine 104 of the present invention to perform automatic encryption and decryption operations without software participation. The write/read command of the DMA request includes the logical address (eg, LBA) to be accessed and the number of sectors. In one embodiment, the encryption/decryption engine 104 encrypts and decrypts data in units of sectors according to the sector number in the logical address (eg, LBA) indicated by the write/read command; for example, XTS-AES/SM4 data Encryption and decryption technology. The write/read command information Cmd_Info includes the logical address and sector number indicated by the write/read command.

Figure 2A illustrates the XTS-AES data encryption technique. The write command information Cmd_Info includes the hard disk sector number i indicated by the write command. The hard disk key DEK consists of two parts: the key DEK_key1 and the key DEK_key2. After the hard disk sector number i is combined with the key DEK_key2 by the encryption computing hardware 202, it is combined with the constant ^aj by the modular multiplication component 206, and the modular multiplication result T is the unencrypted written data p (that is, "plaintext") by the modular multiplication component 208. ", Fig. 1 is combined with the data label), after the modular addition result pp is combined with the key DEK_key1 through the encryption operation hardware 204, the generated data cc will be combined with the modular multiplication result T by the modular addition component 210 to obtain the encrypted write data C ( That is, "ciphertext", labeled as Data_Encrypted in Figure 1). FIG. 2A takes the XTS-AES encryption algorithm as an example to illustrate, but the present invention is not limited to this, and other encryption algorithms also fall within the scope of the present invention to be protected.

Figure 2B illustrates the XTS-AES data decryption technique. The read command information Cmd_Info includes the hard disk sector number i indicated by the read command. The hard disk key DEK consists of two parts: the key DEK_key1 and the key DEK_key2. After the hard disk sector number i is combined with the key DEK_key2 by the encryption operation hardware 212, it is combined with the constant ^aj by the modular multiplication component 216, and the modular multiplication result T is obtained by the modular multiplication component 218 and the undecrypted read data C (that is, "encrypted"). "Text", in Fig. 1 is combined with the label Data_Encrypted), after the modular addition result cc is combined with the key DEK_key1 by the decryption operation hardware 214, the generated data pp will be combined with the modular multiplication result T by the modular addition component 220 to obtain the decrypted read data p (ie "plaintext", marked with Data in Figure 1). FIG. 2B takes the XTS-AES decryption algorithm as an example to illustrate, but the present invention is not limited to this, and other decryption algorithms are also within the scope of protection of the present invention.

It is worth noting that the present invention encrypts the written data Data after the combination of the hard disk sector number i and the hard disk key, so that in a DMA access request with a data block (such as a sector) as a unit, the data block and the data block are encrypted. There is no interdependent relationship between encryption and decryption. The technology described in FIG. 2A and FIG. 2B makes the same data of different sector numbers show different encryption results, which is not easy to be cracked. In addition, since the encryption of different sector numbers is independent, the undecrypted data of different sector numbers can be independently extracted and decrypted.

In one embodiment, XTS-AES and XTS-SM4 are two encryption/decryption operation options set via a register bit; the hardware architecture of XTS-SM4 encryption/decryption operation is similar to FIG. 2A and FIG. 2B . XTS-AES encryption and decryption technology can be enabled or disabled through the "efuse" bit to comply with policies and regulations.

This paragraph discusses the hard disk key DEK. FIG. 3 illustrates a Trusted Platform Module (TPM) 300 , which includes Trusted Platform Module software 302 and hard disk key provisioning hardware 304 . The hard disk key supply hardware 304 is connected to the encryption/decryption engine 104 and supplies the hard disk key DEK required by the encryption/decryption engine 104 . The trusted platform module 300 can run the trusted platform module software 302 through the Unified Extensible Firmware Interface (UEFI) or operating system (OS) to operate the hard disk key provisioning hardware 304 to generate the hard disk key DEK.

This paragraph discusses communication security between the hard disk key provisioning hardware 304 and the encryption/decryption engine 104 . In one embodiment, the encryption/decryption engine 104 communicates with the hard disk key provisioning hardware 304 according to a key exchange protocol (eg, Diffie-Hellman key exchange protocol). FIG. 4 is a flowchart of a hard disk key exchange protocol. Step S402, the encryption/decryption engine 104 and the hard disk key supply hardware 304 determine a key exchange key (Key Exchange Key, KEK). Step S404 , the hard disk key supply hardware 304 encrypts the hard disk key DEK with the key exchange key KEK, and then transmits it to the encryption/decryption engine 104 . Step S406, the encryption/decryption engine 104 decrypts the hard disk key DEK by using the key exchange key KEK calculated by itself. The encryption/decryption engine 104 securely obtains the hard disk key DEK from the hard disk key supply hardware 304 in the steps shown in the flow.

The communication closure between the hard disk key supply hardware 304 and the encryption/decryption engine 104 can also be implemented in a hardware architecture. In one embodiment, the encryption/decryption engine 104 is packaged with the hard disk key provisioning hardware 304 . In one embodiment, the encryption/decryption engine 104 is fabricated on the same chip as the hard disk key supply hardware 304 . In one embodiment, the chipset 100 consisting of a north bridge and a south bridge is made in the south bridge. The above closed communication environment ensures that the hard disk key DEK will not be exposed on the external bus or interface, so that the hard disk key supply hardware 304 and the encryption/decryption engine 104 are allowed to communicate in plaintext (unencrypted).

In one embodiment, the hard disk key DEK request of the encryption/decryption engine 104 to the hard disk key provisioning hardware 304 is not issued by the hard disk key until the hard disk key provisioning hardware 304 confirms that the identification condition set by the user is satisfied. The provisioning hardware 304 accepts. Password, smart card (smart card), fingerprint, remote attestation, user identity (user identity), system status (system status) can be used as identification conditions set by the user. The identification conditions can be set by the Trusted Platform Module software 302 operating in UEFI or OS type.

In one embodiment, the trusted platform module 300 further uses a key migration technology to make encrypted backups of the hard disk key DEK.

The following specifically discusses how the chipset 100 encrypts and decrypts the Serial Advanced Technology Attachment (SATA) storage device 108 . The SATA hard disk (corresponding to 108 ) can be a mechanical hard disk (HDD) or a solid-state disk (SDD). The chipset 100 can be designed to perform full hard disk encryption for the SATA hard disk 108 or partial hard disk encryption for a specific logical address (eg, LBA), which can be configured by the chipset 100 via a basic input output system (BIOS). The encryption/decryption engine 104 may use encryption algorithms such as XTS-AES or XTS-SM4, and use the logical address (eg, LBA) as the adjustment (tweak, corresponding to the hard disk sector number i in Figure 2A and Figure 2B). The hard disk sector size (sectorsize) is, for example, 512 bytes or 4K bytes.

FIG. 5A is a flow chart of writing to a SATA hard disk. Step S502, the SATA controller (corresponding to 102) parses the received write command (such as WRITE DMA EXT), obtains the write command information Cmd_Info including the logical address (such as LBA) and the number of sectors (sector count), and stores it. Provided to the encryption/decryption engine 104 for encryption request. In step S504, the encryption/decryption engine 104 requests the hard disk key DEK from the hard disk key supply hardware 304. In step S506, the hard disk key provisioning hardware 304 supplies the hard disk key DEK after confirming that the user's pre-defined conditions are satisfied. Step S508, after the SATA controller 102 receives the activation permission (for example, the activation permission defined by direct memory access, DMA Activate Frame Information Structure, DMA ActivateFIS), it forwards the unencrypted write data Data to the encryption and decryption engine 104 (for example, DMA Activate FIS). , forwarded in units of data blocks DATA FIS, one DATA FIS may include multiple sectors, and one DMA command may include multiple DATA FIS writes), that is, the encryption/decryption engine 104 receives unencrypted writes from the SATA controller 102 Data Data (for example, received in units of data blocks DATA FIS). Step S510, the encryption/decryption engine 104 encrypts the unencrypted write data Data based on the hard disk key DEK and the write instruction information Cmd_Info, and forwards the encrypted write data Data_Encrypted to the SATA controller 102; the encryption/decryption engine 104 can continue The next DATA FIS is encrypted until no more data is received from the SATA controller 102 . Step S512 , the SATA controller 102 writes the encrypted write data Data_Encrypted into the SATA hard disk 108 . Step S514 , the subsequent hard disk status (Status transmission) is sent back to the upper-layer software by the SATA controller 102 without the encryption/decryption engine 104 . In one embodiment, the SATA controller 102 and the encryption/decryption engine 104 will perform steps S508 to S514 cyclically until the encryption of all DATA FISs indicated by the write command is completed.

FIG. 5B is a flow chart of reading a SATA hard disk. Step S522, the SATA controller 102 parses the received read command, obtains the read command information Cmd_Info including the logical address (such as LBA) and the sector count, and provides it to the encryption/decryption engine 104 as a decryption request . In step S524, the encryption/decryption engine 104 requests the hard disk key DEK from the hard disk key supply hardware 304. In step S526, the hard disk key provisioning hardware 304 supplies the hard disk key DEK after confirming that the user pre-defined conditions are satisfied. In step S528, the SATA controller 102 forwards the undecrypted read data Data_Encrypted of the SATA hard disk 108 to the encryption/decryption engine 104 (for example, in the unit of the data block DATA FIS), that is, the encryption/decryption engine 104 sends the data from the SATA controller to the encryption/decryption engine 104. 102 Receives undecrypted read data Data_Encrypted (eg, received in units of data blocks DATA FIS). Step S530, the encryption/decryption engine 104 decrypts the undecrypted read data Data_Encrypted based on the hard disk key DEK and the read instruction information Cmd_Info, and forwards the decrypted read data Data to the SATA controller 102; the encryption/decryption engine 104 can continue to decrypt The next DATA FIS, until no more data is received from the SATA controller 102 . In step S532, the SATA controller 102 returns the decrypted read data Data to the upper-layer software. Step S534 , the subsequent hard disk status (Status transmission) is sent back to the upper-layer software by the SATA controller 102 without going through the encryption/decryption engine 104 . In one embodiment, the SATA controller 102 and the encryption/decryption engine 104 will perform steps S528 to S534 cyclically until the decryption of all DATA FISs indicated by the read command is completed.

SATA transfers can also be used for DMA technology for Native Command Queue (NCQ).

Figure 6 is a flow chart of writing to a SATA hard disk using NCQ DMA. Step S602, the SATA controller 102 parses the received write command (such as WRITE FPDMA QUEUED), and obtains its tag (TAG, which distinguishes multiple write commands or multiple read commands following NCQ), and includes a logical address. (eg LBA), and write command information Cmd_Info with sector count and size. In step S604, after receiving the NCQ command, the SATA hard disk 108 sends a status message (Register D2H FIS) to the host to allow the next NCQ command to be received. The SATA hard disk 108 may also switch to process other higher priority or previously received NCQ commands. Step S606, before processing the command identified by the tag (TAG), the SATA hard disk 108 sends a DMA setup (DMA Setup FIS) and an activation information (DMA ACTIVEFIS) to the host. In step S608, the SATA controller 102 parses the tag from the DMA setting information, finds the corresponding DMA buffer (DMAbuffer) and the write command information Cmd_Info, and provides it to the encryption/decryption engine 104 for encryption request. In step S610, the encryption/decryption engine 104 requests the hard disk key DEK from the hard disk key supply hardware 304. In step S612, the hard disk key provisioning hardware 304 supplies the hard disk key DEK after confirming that the user's pre-defined conditions are satisfied. Step S614, the SATA controller 102 forwards the unencrypted write data Data to the encryption/decryption engine 104 (for example, forwarding in units of data blocks DATA FIS, a DATA FIS may include multiple sectors, and a DMA command may include multiple DATA FIS write), that is, the encryption/decryption engine 104 receives the unencrypted write data Data from the SATA controller 102 (eg, received in units of data blocks DATA FIS). Step S616, the encryption/decryption engine 104 encrypts the unencrypted write data Data into encrypted write data Data_Encrypted based on the hard disk key DEK and the write instruction information Cmd_Info, and forwards it to the SATA controller 102; the encryption/decryption engine 104 can continue The next data is encrypted until no more data is received from the SATA controller 102 . Step S618 , the SATA controller 102 writes the encrypted write data Data_Encrypted to the SATA hard disk 108 . Step S620, the SATA hard disk 108 sends an update message (SET Device Bits FIS) to the host to update the values of the register (SActive register) and the status (Status) in the host. The update message is passed through the SATA controller 102 without encryption and decryption. The engine 104 passes back to the upper layer software. The SATA hard disk reading process of the NCQ DMA also uses the same concept to securely obtain the hard disk key DEK, and is enclosed in the encryption and decryption engine 104 to complete the undecrypted read data Data_Encrypted obtained by the SATA controller 102 from the SATA hard disk 108 . In one embodiment, the SATA controller 102 and the encryption/decryption engine 104 will cyclically execute steps S614 and S620 until the encryption of all DATA FISs indicated by the write command is completed.

The following specifically discusses how the chipset 100 encrypts and decrypts the storage device 108 for Universal Serial Bus (USB) communication. Chipset 100 can be designed to perform full-disk encryption for USB hard drives (corresponding to 108 ), or partial hard-disk encryption for a specific logical address (eg, LBA) range, which can be configured by chipset 100 via a basic input output system (BIOS). The chipset 100 can also enable or disable encryption of the storage device to which it is connected via a basic input output system (BIOS) for a specific USB communication port. The USB controller (corresponding to 102 in FIG. 1 ) controls the USB communication port (corresponding to 106 in FIG. 1 ) and the USB hard disk 108 using the Bulk-Only Transport (BOT) protocol under the USB2.0 standard, or the USB 3.0 A USB protocol that transmits data in units of data blocks, such as the Universal Serial Bus (USB Attached SCSI, UAS) protocol under the standard.

FIG. 7 is a flow chart of USB hard disk writing. Step S702, the USB controller 102 parses the received write command (eg write(10)), obtains the write command information Cmd_Info including the logical address (eg LBA) and sector count, and provides it to The encryption/decryption engine 104 makes an encryption request. Step S704, the encryption/decryption engine 104 requests the hard disk key DEK from the hard disk key supply hardware 304. In step S706, the hard disk key provisioning hardware 304 supplies the hard disk key DEK after confirming that the user's pre-defined conditions are satisfied. Step S708 , the USB controller 102 forwards the unencrypted write data Data (eg, in units of data packages) to the encryption/decryption engine 104 . Step S710, the encryption/decryption engine 104 encrypts the unencrypted write data Data based on the hard disk key DEK and the write instruction information Cmd_Info, and forwards the encrypted write data Data_Encrypted to the USB controller 102; the encryption/decryption engine 104 can continue The next write data is encrypted until no more data is received from the USB controller 102 . Step S712 , the USB controller 102 writes the encrypted write data Data_Encrypted into the USB hard disk 108 . Step S714 , the subsequent hard disk status (Status transmission) is sent back to the upper-layer software by the USB controller 102 without the encryption and decryption engine 104 . The USB hard disk reading process also uses the same concept to securely obtain the hard disk key DEK, and is enclosed in the encryption and decryption engine 104 to complete the undecrypted read data Data_Encrypted obtained by the USB controller 102 from the USB hard disk 108 . In one embodiment, the USB controller 102 and the encryption/decryption engine 104 will cyclically execute steps S708 and S714 until the encryption of all data packages indicated by the write command is completed.

In one embodiment, the storage device host controller 102 and the encryption/decryption engine 104 disclosed in the present invention are implemented in a host controller and installed on the host.

Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention. Anyone familiar with the art can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, this The protection scope of the invention shall be determined by the scope of the patent application.

Claims (19)

1. A data encryption and decryption method for a storage device, comprising:

providing an encryption and decryption engine which is hardware;

analyzing writing instruction information from the writing instruction, and transmitting the writing data and the writing instruction information to the encryption and decryption engine; and

after a hard disk secret key and the write-in instruction information are combined before encryption by the encryption and decryption engine, the write-in data are encrypted by the combination of the hard disk secret key and the write-in instruction information, and the encrypted write-in data are written into a storage device through a communication port, wherein the hard disk secret key comes from a trusted platform module;

wherein the step of passing the write data and the write command information to the encryption/decryption engine further comprises: the write data is forwarded to the encryption/decryption engine upon determining that an activation grant defined by a direct memory access is received.

2. The storage device data encryption and decryption method of claim 1, further comprising:

analyzing reading instruction information from the reading instruction, and transmitting the undecrypted reading data and the reading instruction information which are taken from the storage device to the encryption and decryption engine; and is

The hard disk key is combined with the read instruction information via the encryption and decryption engine to decrypt the undecrypted read data in response to the read instruction.

3. The storage device data encryption and decryption method of claim 2, wherein:

the writing instruction information comprises a logical address indicated by the writing instruction and the number of sectors; and is

The read instruction information includes a logical address indicated by the read instruction and the number of sectors.

4. The storage device data encryption and decryption method of claim 3, wherein:

the encryption and decryption engine is used for encrypting and decrypting data by taking the sector as a unit according to the logical address.

5. The method of claim 1, wherein the trusted platform module comprises a hard disk key provisioning hardware, and the hard disk key is derived from the hard disk key provisioning hardware.

6. The storage device data encryption and decryption method of claim 5, wherein:

the trusted platform module operates the hard disk key provisioning hardware through a unified extensible firmware interface or operating system.

7. The storage device data encryption and decryption method of claim 5, wherein:

the encryption/decryption engine follows a key exchange protocol to communicate with the hard disk key provisioning hardware to obtain the hard disk key.

8. The storage device data encryption and decryption method of claim 5, wherein:

the encryption and decryption engine is packaged together with the hard disk key supply hardware or manufactured on the same chip.

9. The storage device data encryption and decryption method of claim 5, wherein:

the hard disk key requirement of the encryption and decryption engine on the hard disk key supply hardware is accepted by the hard disk key supply hardware after the hard disk key supply hardware confirms that the identification condition set by the user is satisfied.

10. The storage device data encryption and decryption method of claim 5, wherein:

the hard disk secret key is encrypted and backed up by the trusted platform module.

11. The storage device data encryption and decryption method of claim 1, further comprising:

the storage device is partially encrypted through the setting of the basic input and output system, and only the write-in data of a specific logical address is encrypted.

12. The storage device data encryption and decryption method of claim 1,

wherein the communication port is a serial high-tech accessory interface.

13. The storage device data encryption and decryption method of claim 1, further comprising:

parsing a tag from the write instruction, the tag distinguishing write instructions that follow a native instruction ordering; and

transmitting corresponding write command information to the encryption and decryption engine according to the label indicated by the storage device;

wherein the write instruction information further includes a sector size indicated by the write instruction.

14. The storage device data encryption and decryption method of claim 1, further comprising:

encryption of the storage device connected to the communication port using the universal serial bus is enabled or disabled via the bios.

15. The storage device data encryption and decryption method of claim 14, further comprising:

and controlling a data block transmission protocol to be adopted between the communication port and the storage device.

16. The storage device data encryption and decryption method of claim 14, further comprising:

the communication port and the storage device are controlled to be connected with a small computer system interface protocol by adopting a universal serial bus.

17. The method as claimed in claim 1, wherein the encryption/decryption engine is implemented in a south bridge.

18. The method as claimed in claim 5, wherein the encryption/decryption engine and the hardware key supply are implemented in a south bridge.

19. The method of claim 1, wherein the write command is a DMA request from a host.

Images