CN105868643A - Data protection method, memory control circuit unit and memory storage device - Google Patents

Abstract

The present invention provides a data protection method, a memory control circuit unit and a memory storage device. The data protection method includes: establishing a secure channel with an electronic device through a wireless communication network; obtaining an identification code through the secure channel established on the wireless communication network; using the identification code to obtain an encryption and decryption key and storing the encryption and decryption key in a buffer memory; using the encryption and decryption key to decode data read from a rewritable non-volatile memory module, wherein the data of the rewritable non-volatile memory module is encrypted with the encryption and decryption key; detecting whether a confirmation signal from the electronic device is received from the secure channel established on the wireless communication network; if a confirmation signal from the electronic device is not received within a predetermined time, clearing the encryption and decryption key stored in the buffer memory.

Description

Data protection method, memory control circuit unit and memory storage device

technical field

The invention relates to a data protection method for a rewritable non-volatile memory module, a memory control circuit unit and a memory storage device.

Background technique

U disk is a kind of data storage device, and it generally uses flash memory as storage medium. Flash memory is a kind of Electrically Erasable Programmable Read Only Memory (EEPROM for short), which has the advantages of being writable, erasable, and able to save data after power failure. In addition, flash memory is a kind of non-volatile memory (Non-Volatile Memory), which has the advantages of small size, fast access speed, and low power consumption, and because of its data erasing (Erasing) uses "One block at a time" (Block by Block) erase method, so it has the advantage of fast operation speed. Due to its small size, large capacity and easy portability, the USB flash drive has been widely used for personal data storage. However, when the U disk is accidentally lost, a large amount of data stored therein may also be stolen.

In order to solve the above problems, manufacturers have developed wireless compatibility certification (Wireless Fidelity, referred to as WiFi) U disk and secure digital (Secure Digital, referred to as SD) card, Wi-Fi wireless card reader or wireless external hard disk box and other products. Security mechanisms such as Wi-Fi Protected Access Personal (WPA-Personal for short) can be set up, but in this mechanism, all devices use a shared key to connect, so everyone in the Users who share the network can steal or tamper with other people's data during the connection. Based on the above, how to ensure the security of the memory storage device in the wireless communication network environment is a problem to be solved in this field.

Contents of the invention

The present invention provides a data protection method, a memory control circuit unit, and a memory storage device, which use a secure channel established in a wireless communication network to transmit an identification code, and use the identification code to generate an encryption and decryption key to read the memory storage device, so as to improve Security of memory storage devices.

An exemplary embodiment of the present invention provides a data protection method for protecting data of a rewritable non-volatile memory module in a memory storage device. The data protection method includes: establishing a safe channel with an electronic device through a wireless communication network. The method also includes: obtaining the identification code through the secure channel established on the wireless communication network. The method also includes: using the identification code to obtain the encryption and decryption key and storing the encryption and decryption key in the buffer memory. The method further includes: using the encryption and decryption key to decode the data read from the rewritable non-volatile memory module, wherein the data of the rewritable non-volatile memory module is encrypted with the encryption and decryption key. The method further includes: detecting whether a confirmation signal from the electronic device is received through the secure channel established on the wireless communication network. The method further includes: if the confirmation signal from the electronic device is not received within a predetermined time, clearing the encryption and decryption key stored in the buffer memory.

In an embodiment of the present invention, the above data protection method further includes: after clearing the encryption and decryption keys stored in the buffer memory, setting the memory storage device to a no-media state.

In an embodiment of the present invention, the step of obtaining the identification code through the secure channel established on the wireless communication network includes: obtaining the identification code input from the electronic device through the secure channel established on the wireless communication network, wherein the electronic device is Handheld Electronic Devices.

In an embodiment of the present invention, the step of obtaining the identification code through the secure channel established on the wireless communication network includes: obtaining the identification code generated by the electronic device through the secure channel established on the wireless communication network, wherein the electronic device is a server and electrically connected to a wireless network access point.

In an embodiment of the present invention, the wireless communication network is a Bluetooth network, a wireless compatibility certification network, a near field communication network or a radio frequency identification network.

In an embodiment of the present invention, the steps of using the identification code to obtain the encryption and decryption key and storing the encryption and decryption key in the buffer memory include: storing personal identification code information in a rewritable non-volatile memory module Digest and key. The above steps also include: using a one-way hash function to generate an information digest corresponding to the identification code. The above steps also include: judging whether the information summary matches the personal identification code information summary, wherein when the information summary and the personal identification code information summary match, according to the identification code, use the encryption and decryption function to decode the key to obtain the encryption and decryption key.

In an embodiment of the present invention, the above-mentioned step of storing the personal identification code information summary and the key in the rewritable non-volatile memory module includes: initially generating the personal identification code information according to the personal identification code through a one-way hash function Summary. The above steps further include: initially encrypting the encryption and decryption key with an encryption and decryption function according to the personal identification code to generate a key.

In an embodiment of the present invention, the step of initially encrypting the encryption and decryption key using an encryption and decryption function according to the personal identification code to generate the key includes: initially generating the encryption and decryption key in a random manner.

In an embodiment of the present invention, the above-mentioned step of decoding the data read from the rewritable non-volatile memory module using the encryption and decryption key includes: using the encryption and decryption function to decode the data read from the rewritable non-volatile memory module according to the encryption and decryption key. The data read from the volatile memory module, wherein the data of the rewritable non-volatile memory module is encrypted using an encryption and decryption function according to the encryption and decryption key.

An exemplary embodiment of the present invention provides a memory control circuit unit for controlling a rewritable non-volatile memory module, which includes a host interface, a memory interface, a memory management circuit, and a wireless communication interface. The host interface is electrically connected to the host system. The memory interface is electrically connected to the rewritable non-volatile memory module. The memory management circuit is electrically connected to the host interface and the memory interface. The wireless communication interface is electrically connected to the memory management circuit. Wherein the memory control circuit unit establishes a secure channel with the electronic device through a wireless communication network through a wireless communication network. Wherein the wireless communication interface obtains the identification code through a safe channel established on the wireless communication network. Wherein the memory management circuit obtains the encryption and decryption key by using the identification code and stores the encryption and decryption key in the buffer memory. The memory management circuit decodes the data read from the rewritable non-volatile memory module using the encryption and decryption key, wherein the data of the rewritable non-volatile memory module is encrypted with the encryption and decryption key. Wherein the wireless communication interface detects whether the confirmation signal from the electronic device is received through the security channel established on the wireless communication network. Wherein, if the wireless communication interface does not receive the confirmation signal from the electronic device within a predetermined time, the memory management circuit clears the encryption and decryption key stored in the buffer memory.

In an embodiment of the present invention, after the memory management circuit clears the encryption and decryption keys stored in the buffer memory, when the memory management circuit receives an access signal from the host system, the memory management circuit transmits a no-media signal to the host system.

In an embodiment of the present invention, the wireless communication network is a Bluetooth network, a wireless compatibility certification network, a near field communication network or a radio frequency identification network.

In an embodiment of the present invention, the above-mentioned memory management circuit stores the personal identification code information summary and the key in the rewritable non-volatile memory module. The above memory management circuit also uses a one-way hash function to generate an information digest corresponding to the identification code. The above-mentioned memory management circuit also judges whether the information digest matches the personal identification code information digest, wherein when the information digest and the personal identification code information digest match, the memory management circuit uses the encryption and decryption function to decode the key according to the identification code to obtain the encryption and decryption key.

In an embodiment of the present invention, the memory management circuit initially encrypts the encryption and decryption key according to the personal identification code using an encryption and decryption function to generate a key.

An exemplary embodiment of the present invention provides a memory storage device, which includes a connection interface unit, a rewritable non-volatile memory module, a memory control circuit unit, and a wireless communication interface. The connection interface unit is electrically connected to the host system. The memory control circuit unit is electrically connected to the connection interface unit and the rewritable non-volatile memory module. The wireless communication interface is electrically connected to the memory control circuit unit. Wherein the memory control unit establishes a secure channel with the electronic device through the wireless communication interface through the wireless communication network. Wherein the memory control circuit unit obtains the identification code through the safe channel established on the wireless communication network. Wherein the memory control circuit unit obtains the encryption and decryption key by using the identification code and stores the encryption and decryption key in the buffer memory. The memory control circuit unit uses the encryption and decryption key to decode the data read from the rewritable non-volatile memory module, wherein the data of the rewritable non-volatile memory module is encrypted with the encryption and decryption key. Wherein the memory control circuit unit detects whether the confirmation signal from the electronic device is received from the secure channel established on the wireless communication network. Wherein, if the memory control circuit unit does not receive the confirmation signal from the electronic device within a predetermined time, the memory control circuit unit clears the encryption and decryption key stored in the buffer memory.

In an embodiment of the present invention, after the memory control circuit unit clears the encryption and decryption keys stored in the buffer memory, when the memory control circuit unit receives an access signal from the host system, the memory control circuit The unit transmits no media signal to the host system.

In an embodiment of the present invention, the memory control circuit unit obtains the identification code input from the electronic device through a secure channel established on the wireless communication network, wherein the electronic device is a handheld electronic device.

In an embodiment of the present invention, the memory control circuit unit obtains the identification code generated by the electronic device through a secure channel established on a wireless communication network, wherein the electronic device is a server and is electrically connected to a wireless network access point.

In an embodiment of the present invention, the wireless communication network is a Bluetooth network, a wireless compatibility certification network, a near field communication network or a radio frequency identification network.

In an embodiment of the present invention, the above-mentioned memory control circuit unit stores the personal identification code information summary and the key in the rewritable non-volatile memory module. The memory control circuit unit also uses a one-way hash function to generate an information digest corresponding to the identification code. The above-mentioned memory control circuit unit also judges whether the information summary matches the personal identification code information summary, wherein when the information summary and the personal identification code information summary match, the memory management circuit uses the encryption and decryption function to decode the key according to the identification code to obtain the encryption and decryption key .

In an embodiment of the present invention, the memory control circuit unit initially encrypts the encryption and decryption key according to the personal identification code using an encryption and decryption function to generate the key.

In an embodiment of the present invention, the memory control circuit unit initially generates encryption and decryption keys in a random manner.

In an embodiment of the present invention, the above-mentioned memory control circuit unit decodes the data read from the rewritable non-volatile memory module using an encryption and decryption function according to the encryption and decryption key, wherein the rewritable non-volatile memory module Data is encrypted using encryption and decryption functions based on encryption and decryption keys.

Based on the above, the data protection method of the present invention obtains the identification code from the electronic device through the secure channel established on the wireless communication network, uses the identification code and the key pre-stored in the memory storage device to obtain the encryption and decryption key, and uses the encryption and decryption The key decodes the data of the memory storage device. If no confirmation signal is received from the secure channel within a predetermined time, it can be judged that the memory storage device is far away from the electronic device, then the encryption and decryption key is cleared, and the memory storage device is set to a no-media state.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail with reference to the accompanying drawings.

Description of drawings

FIG. 1 shows a host system, a memory storage device and an electronic device according to an exemplary embodiment of the present invention;

FIG. 2 is a schematic diagram of a host system and an input/output device according to an exemplary embodiment of the present invention;

3 is a schematic diagram of a host system and a memory storage device according to an exemplary embodiment of the present invention;

FIG. 4 is a schematic block diagram showing the memory storage device shown in FIG. 1;

FIG. 5 is a schematic block diagram of a memory control circuit unit according to an exemplary embodiment of the present invention;

FIG. 6 is a flowchart of a data protection method according to an exemplary embodiment of the present invention;

Fig. 7 is a flowchart of a data protection method according to another exemplary embodiment of the present invention.

Explanation of reference signs:

1000: host system;

1100: computer;

1102: microprocessor;

1104: random access memory;

1106: input/output device;

1108: system bus;

1110: data transmission interface;

1202: mouse;

1204: keyboard;

1206: display;

1208: printer;

1212: U disk;

1214: memory card;

1216: SSD;

1310: digital camera;

1312: SD card;

1314: MMC card;

1316: memory stick;

1318: CF card;

1320: embedded storage device;

2000: electronic devices;

100: memory storage device;

102: connect the interface unit;

104: memory control circuit unit;

106: a rewritable non-volatile memory module;

108: wireless communication interface;

410(0)～410(N): Entity erasing unit;

202: memory management circuit;

204: host interface;

206: memory interface;

252: buffer memory;

254: power management circuit;

256: error checking and correction circuit;

S602, S604, S606, S608, S610, S612, S702, S704, S706, S708, S710, S712, S714, S716: steps.

detailed description

Generally speaking, a memory storage device (also called a memory storage system) includes a rewritable non-volatile memory module and a controller (also called a control circuit). Typically memory storage devices are used with a host system such that the host system can write data to or read data from the memory storage device.

FIG. 1 shows a host system, a memory storage device and an electronic device according to an exemplary embodiment of the present invention. FIG. 2 is a schematic diagram of a host system and an input/output device according to an exemplary embodiment of the present invention

Referring to FIG. 1 , the electronic device 2000 may be a portable electronic device such as a mobile phone or a tablet computer, and communicates wirelessly with the memory storage device 100 through a wireless network. The electronic device 2000 can also be a server, which communicates wirelessly with the memory storage device 100 through a wireless network access point. However, the present invention is not limited thereto, and the electronic device 2000 may also be other devices with a wireless communication network function, and perform wireless communication with the memory storage device 100 through a wireless network.

The host system 1000 generally includes a computer 1100 and an input/output (input/output, I/O for short) device 1106 . The computer 1100 includes a microprocessor 1102 , a random access memory (random access memory, RAM for short) 1104 , a system bus 1108 and a data transmission interface 1110 . The input/output device 1106 includes a mouse 1202 , a keyboard 1204 , a monitor 1206 and a printer 1208 as shown in FIG. 2 . It must be understood that the device shown in FIG. 2 is not limited to the input/output device 1106, and the input/output device 1106 may also include other devices.

In an exemplary embodiment, the memory storage device 100 is electrically connected with other components of the host system 1000 through the data transmission interface 1110 . Data can be written into or read from the memory storage device 100 through the operation of the microprocessor 1102 , the random access memory 1104 and the input/output device 1106 . For example, the memory storage device 100 may be a rewritable non-volatile memory storage device such as a USB flash drive 1212, a memory card 1214, or a solid state drive (Solid State Drive, SSD for short) 1216 as shown in FIG. 2 .

FIG. 3 is a schematic diagram of a host system and a memory storage device according to an exemplary embodiment of the present invention.

In general, host system 1000 is any system that can cooperate substantially with memory storage device 100 to store data. Although in this exemplary embodiment, the host system 1000 is described as a computer system, however, in another exemplary embodiment, the host system 1000 may be a digital camera, video camera, communication device, audio player or video player, etc. system. For example, when the host system is a digital camera (video camera) 1310, the rewritable non-volatile memory storage device is a secure digital (Secure Digital, referred to as SD) card 1312, a multimedia memory card (Multi Media Card, MMC for short) 1314, memory stick (memory stick) 1316, compact flash (Compact Flash, CF) card 1318 or embedded storage device 1320 (as shown in FIG. 3 ). The embedded storage device 1320 includes an embedded multimedia card (Embedded MMC, eMMC for short). It is worth mentioning that the embedded multimedia card is directly electrically connected to the substrate of the host system.

FIG. 4 is a schematic block diagram showing the memory storage device shown in FIG. 1 .

Referring to FIG. 4 , the memory storage device 100 includes a connection interface unit 102 , a memory control circuit unit 104 , a rewritable non-volatile memory module 106 and a wireless communication interface 108 . In this exemplary embodiment, the memory storage device 100 is a USB flash drive. But it must be understood that, in another exemplary embodiment, the memory storage device 100 may also be a memory card or a solid state drive (Solid State Drive, SSD for short).

In this exemplary embodiment, the connection interface unit 102 is compatible with the Universal Serial Bus (USB) standard. However, it must be understood that the present invention is not limited thereto, and the connection interface unit 102 may also be a device that complies with the Parallel Advanced Technology Attachment (PATA) standard, the Institute of Electrical and Electronic Engineers (IEEE) 1394 standard, Peripheral Component Interconnect Express (PCI Express for short) standard, Serial Advanced Technology Attachment (SATA for short) standard, Ultra High Speed-I (UHS-I for short) interface Standard, Ultra High Speed-II (UHS-II for short) interface standard, Secure Digital (SD for short) interface standard, Memory Stick (MS for short) interface standard, Multimedia memory card (Multi Media Card (MMC for short) interface standard, Compact Flash (CF for short) interface standard, Integrated Device Electronics (IDE for short) standard or other suitable standards. In this exemplary embodiment, the connection interface unit 102 and the memory control circuit unit 104 can be packaged in one chip, or arranged outside a chip including the memory control circuit unit 104 .

The memory control circuit unit 104 is used to execute a plurality of logic gates or control instructions implemented in the form of hardware or firmware, and write data in the rewritable non-volatile memory module 106 according to the instructions of the host system 1000, Read and erase operations.

The rewritable non-volatile memory module 106 is electrically connected to the memory control circuit unit 104 and used for storing data written by the host system 1000 . The rewritable non-volatile memory module 106 has physical erasing units 410(0)˜410(N). For example, the physical erase units 410(0)˜410(N) may belong to the same memory die or belong to different memory dies. Each physical erasing unit has a plurality of physical programming units, and the physical programming units belonging to the same physical erasing unit can be written independently and erased simultaneously. For example, each physical erasing unit is composed of 128 physical programming units. However, it must be understood that the present invention is not limited thereto, and each physical erasing unit may be composed of 64 physical programming units, 256 physical programming units, or any other number of physical programming units.

More specifically, each physical erasing unit includes a plurality of word lines and a plurality of bit lines, and a storage unit is arranged at the intersection of each word line and each bit line. Each memory cell can store one or more bits. In the same physical erasing unit, all storage units will be erased together. In this exemplary embodiment, the physical erasing unit is the smallest unit of erasing. That is, each physical erase unit contains a minimum number of memory cells that are erased. For example, the physical erasing unit is a physical block. On the other hand, storage units on the same word line will form one or more physical programming units. If each storage unit can store more than 2 bits, the physical programming units on the same word line can be classified into lower physical programming units and upper physical programming units. Generally speaking, the writing speed of the lower physical programming unit is greater than that of the upper physical programming unit. In this exemplary embodiment, the entity programming unit is the smallest unit of programming. That is, the entity programming unit is the smallest unit for writing data. For example, the entity programming unit is an entity page or an entity sector. If the physical programming unit is a physical page, each physical programming unit usually includes a data bit area and a redundant bit area. The data bit area includes a plurality of physical sectors for storing user data, and the redundant bit area is used for storing system data (eg, error correction code). In this exemplary embodiment, each data bit area includes 32 physical sectors, and the size of one physical sector is 512 bytes (byte, B for short). However, in other exemplary embodiments, the data bit area may also include 8, 16 or more or less physical sectors, and the present invention does not limit the size and number of physical sectors.

In this exemplary embodiment, the rewritable non-volatile memory module 106 is a multi-level cell (MLC) NAND flash memory module, that is, at least 2 bits can be stored in one memory cell. However, the present invention is not limited thereto, and the rewritable non-volatile memory module 106 may also be a single-level storage unit (Single Level Cell, referred to as SLC) NAND flash memory module, a multi-level storage unit (Trinary Level Cell, referred to as TLC) ) NAND-type flash memory modules, other flash memory modules, or other memory modules with the same characteristics.

The wireless communication interface 108 is electrically connected to the memory control circuit unit 104 and has a short-distance wireless communication function. The wireless communication interface 108 may support short-lived devices such as Bluetooth (Bluetooth), Wireless Fidelity (WiFi for short), Near Field Communication (NFC for short), and Radio Frequency Identification (RFID for short). Communication chip with distance wireless communication function.

FIG. 5 is a schematic block diagram of a memory control circuit unit according to an exemplary embodiment of the present invention.

Referring to FIG. 5 , the memory control circuit unit 104 includes a memory management circuit 202 , a host interface 204 and a memory interface 206 .

The memory management circuit 202 is used to control the overall operation of the memory control circuit unit 104 . Specifically, the memory management circuit 202 has a plurality of control instructions, and when the memory storage device 100 is operating, these control instructions are executed to perform operations such as writing, reading, and erasing data. The following description of the operation of the memory management circuit 202 is equivalent to the description of the operation of the memory control circuit unit 104 , which will not be repeated below.

In an exemplary embodiment, the control commands of the memory management circuit 202 are implemented in the form of firmware. For example, the memory management circuit 202 has a microprocessor unit (not shown), a read-only memory (not shown) and a random access memory (not shown), and these control instructions are programmed into the read-only memory . When the memory storage device 100 is in operation, these control instructions will be executed by the microprocessor unit to perform operations such as writing, reading and erasing data.

In another exemplary embodiment, the control instructions of the memory management circuit 202 may also be stored in a specific area of the rewritable non-volatile memory module 106 in the form of program code (for example, the rewritable non-volatile memory module is dedicated to system area where system data is stored). In addition, the memory management circuit 202 has a microprocessor unit (not shown), a read only memory (not shown) and a random access memory (not shown). In particular, the ROM has a boot code (boot code), and when the memory control circuit unit 104 is triggered, the microprocessor unit will first execute the boot code to store the boot code in the rewritable non-volatile memory module 106. The control instructions in are loaded into the random access memory of the memory management circuit 202 . Afterwards, the microprocessor unit will execute these control instructions to perform operations such as writing, reading and erasing data.

In addition, in another exemplary embodiment, the control instructions of the memory management circuit 202 may also be implemented in a hardware form. For example, the memory management circuit 202 includes a microcontroller, a memory management unit, a memory writing unit, a memory reading unit, a memory erasing unit and a data processing unit. The memory management unit, the memory writing unit, the memory reading unit, the memory erasing unit and the data processing unit are electrically connected to the microcontroller. Wherein, the memory management unit is used to manage the physical erasing unit of the rewritable non-volatile memory module 106; the memory write unit is used to issue a write command to the rewritable non-volatile memory module 106 to write data In the rewritable non-volatile memory module 106; the memory reading unit is used to issue a read instruction to the rewritable non-volatile memory module 106 to read data from the rewritable non-volatile memory module 106 ; The memory erasing unit is used to issue an erase command to the rewritable non-volatile memory module 106 to erase data from the rewritable non-volatile memory module 106; and the data processing unit is used to process the write-in Data to the rewritable nonvolatile memory module 106 and data read from the rewritable nonvolatile memory module 106 .

The host interface 204 is electrically connected to the memory management circuit 202 and used for receiving and identifying commands and data transmitted by the host system 1000 . That is to say, the commands and data transmitted by the host system 1000 are transmitted to the memory management circuit 202 through the host interface 204 . In this exemplary embodiment, the host interface 204 is compatible with the USB standard. However, it must be understood that the present invention is not limited thereto, and the host interface 204 may also be compatible with PATA standard, IEEE 1394 standard, PCI Express standard, SATA standard, SD standard, UHS-I standard, UHS-II standard, MS standard , MMC standard, eMMC standard, UFS standard, CF standard, IDE standard or other suitable data transmission standards.

The memory interface 206 is electrically connected to the memory management circuit 202 and used for accessing the rewritable non-volatile memory module 106 . That is to say, the data to be written into the rewritable nonvolatile memory module 106 will be converted into a format acceptable to the rewritable nonvolatile memory module 106 through the memory interface 206 .

The buffer memory 252 is electrically connected to the memory management circuit 202 and used for temporarily storing data and instructions from the host system 1000 or data from the rewritable non-volatile memory module 106 .

In an exemplary embodiment, the memory management circuit 202 establishes a secure channel with the electronic device 2000 (eg, a user's mobile phone) through the wireless communication interface 108 . For example, in an example where the wireless communication interface 108 supports the Bluetooth standard, the secure channel can be established after transmitting the Bluetooth pairing password through the wireless communication interface 108 and confirming it through the electronic device 2000 .

The memory management circuit 202 can also obtain the identification code from the secure channel established in Bluetooth communication through the wireless communication interface 108 . Here, the identification code can be one or a combination of user identification code, user password, mobile phone identification code or mobile phone password, and can be input by the user through the electronic device 2000, but the present invention is not limited thereto. The identification code can also be automatically input through an application program on the electronic device 2000 .

When the memory management circuit 202 obtains the identification code, the memory management circuit 202 can use the identification code to obtain the encryption and decryption key, and store the encryption and decryption key in the buffer memory 252 . Specifically, the rewritable non-volatile memory module 106 stores a personal identification number message digest and an encrypted key. The memory management circuit 202 has a one-way hash function, and can use the one-way hash function to calculate a message digest corresponding to the above identification code. In this exemplary embodiment, the above-mentioned one-way hash function is implemented in the memory management circuit 202 by using SHA-256. However, the present invention is not limited thereto. In another exemplary embodiment of the present invention, the one-way hash function in the memory management circuit 202 may also be implemented by MD5, RIPEMD-160, SHA1, SHA-386, SHA-512 or other suitable functions. Afterwards, the memory management circuit 202 will compare the calculated information digest with the personal identification code information digest stored in the rewritable non-volatile memory module 106, if the calculated information digest is consistent with the rewritable non-volatile memory module 106 When the digest of the personal identification code information stored in the volatile memory module 106 matches, the memory management circuit 202 will use the encryption and decryption function to decode the key according to the identification code to obtain the encryption and decryption key. After the memory management circuit 202 obtains the encryption and decryption key, the encryption and decryption key can be used to decode the data read from the rewritable non-volatile memory module 106 . Similarly, after the memory management circuit 202 obtains the encryption and decryption key, it can use the encryption and decryption key to encrypt data to be written into the rewritable non-volatile memory module 106 .

In this exemplary embodiment, the encryption and decryption functions in the memory management circuit 202 are implemented by the Advanced Encryption Standard (AES for short) 128 , however, the present invention is not limited thereto. In another exemplary embodiment of the present invention, AES256 or Data Encryption Standard (DES for short) may also be used to implement the encryption and decryption functions in the memory management circuit 202 .

It is worth mentioning that the PIN information digest stored in the rewritable non-volatile memory module 106 is generated by the user of the memory storage device 100 setting the PIN and using the above-mentioned one-way hash function. For example, when the memory storage device 100 leaves the factory, a set of personal identification code information abstracts will be pre-stored by the manufacturer, and the manufacturer will provide the personal identification code corresponding to the personal identification code information abstracts to the user. Thereafter, the user can successfully authenticate to the memory storage device 100 using the PIN provided by the manufacturer. In addition, when the user resets a new set of personal identification codes, the memory management circuit 202 will recalculate a set of new personal identification code information abstracts according to the user's new personal identification codes with a one-way hash function, and store the new personal identification codes The message digest is stored in the rewritable non-volatile memory module 106 in place of the original PIN message digest. Afterwards, the memory management circuit 202 will use the latest PIN information digest to verify the PIN input by the user.

In addition, the encryption/decryption key is randomly generated by a random number generator (not shown) when the memory storage device 100 leaves the factory. In particular, the memory management circuit 202 encrypts the encryption and decryption key according to the personal identification code using an encryption and decryption function, and stores the key obtained by encrypting the encryption and decryption key in the memory storage device 100 . Therefore, when the identification code passes the above verification, the identification code can correctly decode the key stored in the memory storage device 100 to obtain the encryption and decryption key.

In this exemplary embodiment, after the memory management circuit 202 establishes a secure channel with the electronic device 2000 through the wireless communication interface 108, the memory storage device 100 may send a polling signal to the When the electronic device 2000 receives the polling signal, it will return an acknowledgment (ack) signal to the memory storage device 100 to confirm the wireless connection status between the electronic device 2000 and the memory storage device 100 . As long as the memory storage device 100 regularly receives the confirmation signal from the electronic device 2000 in response to the polling signal in this environment, the memory management circuit 202 can use the encryption and decryption key to access the rewritable non-volatile memory module 106 .

Conversely, when the memory storage device 100 leaves the environment, if the memory storage device 100 does not receive an acknowledgment signal from the electronic device 2000 to respond to the polling signal within a predetermined time, the memory management circuit 202 will clear the encryption and decryption key in the buffer memory 252 And the memory storage device 100 is set to the no-media state. Specifically, when the memory storage device 100 is set to the no-media state, if the memory management circuit 202 receives the access signal sent by the host system 1000, the memory management circuit 202 will respond a no-media signal to the host system 1000, This makes it impossible for the host system 1000 to recognize or access the memory storage device 100 , that is, the operating system of the host system 1000 will determine that the memory storage device 100 is in a disconnected state. In this way, it is difficult for others to obtain the data in the rewritable nonvolatile memory module 106. Even if the data is obtained, since the encryption and decryption key has been deleted from the buffer memory 252, others cannot decode the rewritable nonvolatile memory module 106. The encrypted data in the volatile memory module 106.

Although it has been described above that the user inputs the identification code from the electronic device 2000 and transmits the identification code through the Bluetooth wireless communication network to ensure the security of the memory storage device 100 , the present invention is not limited thereto. In another exemplary embodiment, the memory storage device 100 can utilize the PIN information abstract stored therein to log into a Wi-Fi wireless communication network environment of an access point (AP). In this embodiment, the electronic device 2000 can for the server connected to the access point. After the memory storage device 100 logs into Wi-Fi with the PIN information abstract, the server can search for an identification code corresponding to the PIN information abstract, and transmit the identification code to the memory storage device 100 through the access point. The memory storage device 100 receives the identification code and generates an information digest corresponding to the identification code by using a one-way hash function. If the information digest is the same as the personal identification code information digest stored in the memory storage device 100, the identification code can correctly decode the key stored in the memory storage device 100, thereby obtaining the encryption and decryption key. Therefore, the user can access the memory storage device 100 through the encryption and decryption key.

In yet another exemplary embodiment, the memory storage device 100 can use a preset login code to log into the access point. Here, the electronic device 2000 may be a server connected to an access point. After the memory storage device 100 successfully logs into the access point and establishes a Wi-Fi network connection, the user can directly input the identification code through the input device at the access point, so that the identification code is transmitted to the memory storage device 100 through the access point. Next, the memory storage device 100 can receive the identification code and generate an information digest corresponding to the identification code by using a single-term hash function. If the information digest is the same as the personal identification code information digest stored in the memory storage device 100, the identification code can correctly decode the key stored in the memory storage device 100, thereby obtaining the encryption and decryption key. Therefore, the user can access the memory storage device 100 through the encryption and decryption key.

It is worth noting that when the memory storage device 100 enters the above-mentioned Wi-Fi wireless communication network environment, a data transmission key can be obtained from the electronic device 2000 at the same time, so as to encrypt the data transmitted or received in the wireless communication network environment or decrypt. For example, when the memory storage device 100 successfully logs into the aforementioned Wi-Fi wireless communication network environment, the memory storage device 100 may receive a data transmission key from the electronic device 2000 and store it in the buffer memory 252 . The electronic device 2000 will use the data transmission key to encrypt before transmitting the identification code. When the memory storage device 100 receives the data transmitted by the electronic device 2000 in the Wi-Fi environment, that is, the identification code encrypted by the data transmission key, the memory storage device 100 can use the data transmission key in the buffer memory 252 to decrypt data to get the ID.

In an exemplary embodiment of the invention, the memory control circuit unit 104 further includes a power management circuit 254 and an error checking and correction circuit 256 .

The power management circuit 254 is electrically connected to the memory management circuit 202 and used to control the power of the memory storage device 100 .

The error checking and correcting circuit 256 is electrically connected to the memory management circuit 202 and used for executing error checking and correcting procedures to ensure the correctness of data. Specifically, when the memory management circuit 202 receives a write command from the host system 1000, the error checking and correction circuit 256 will generate a corresponding Error Correcting Code (ECC) for the data corresponding to the write command. , and the memory management circuit 202 writes the data corresponding to the write command and the corresponding error correction code into the rewritable non-volatile memory module 106 . Afterwards, when the memory management circuit 202 reads data from the rewritable non-volatile memory module 106, it will read the error correction code corresponding to the data at the same time, and the error checking and correction circuit 256 will check all the data according to the error correction code. The read data is subjected to error checking and correction procedures.

Fig. 6 is a flowchart of a data protection method according to an exemplary embodiment of the present invention.

Please refer to FIG. 6 , in step S602, the memory management circuit 202 establishes a secure channel with the electronic device 2000 through the wireless communication interface 108, and the secure channel can transmit the wireless network pairing identification code through the wireless communication interface 108 and confirm with the electronic device 2000 And build.

After establishing the secure channel between the memory storage device 100 and the electronic device, enter step S604 , where the memory management circuit 202 obtains the identification code from the secure channel through the wireless communication interface 108 . Here, the identification code may be input by the user through the electronic device 2000 or automatically through an application program on the electronic device 2000 .

In step S606 , the memory management circuit 202 obtains the encryption and decryption key by using the identification code, and stores the encryption and decryption key in the buffer memory 252 .

After the memory management circuit 202 obtains the encryption and decryption key, it will enter step S608 to use the encryption and decryption key and the encryption and decryption function to access the data in the rewritable non-volatile memory module 106 . In detail, when the user wants to write data into the rewritable non-volatile memory module 106, the memory management circuit 202 can use the Advanced Encryption Standard (AES) to encrypt the written data according to the encryption and decryption key, and then encrypt the encrypted data. The overwritten data is written into the rewritable non-volatile memory module 106. Similarly, when the user wants to read data from the rewritable non-volatile memory module 106, the memory management circuit 202 can use the Advanced Encryption Standard (AES) to decrypt the data according to the encryption and decryption key, and then read the decrypted data. It is worth noting that, in addition to accessing the data in the rewritable non-volatile memory module 106 through a wired interface such as USB or SATA, the user can also access the rewritable non-volatile memory module 106 from a remote end through a wireless network through the wireless communication interface 108. data in the non-volatile memory module 106.

After the memory management circuit 202 establishes a secure channel with the electronic device 2000 through the wireless communication interface 108, the electronic device 2000 sends a confirmation signal to the memory storage device 100 by responding to the polling signal of the memory storage device 100 to confirm that the electronic device 2000 is connected with the electronic device 2000. The wireless connection status of the memory storage device 100 . In step S610, the wireless communication interface 108 detects whether a confirmation signal from the electronic device 2000 is received through the secure channel established on the wireless communication network. If the wireless communication interface 108 detects the confirmation signal, return to step S608 and continue to access the data in the rewritable non-volatile memory module 106 .

If the wireless communication interface 108 of the memory storage device 100 does not receive the confirmation signal sent by the electronic device 2000 within a predetermined period of time, such as 10 seconds, it means that the electronic device 2000 is no longer within the short-distance communication range of the wireless communication interface 108 Then, in step S612, the memory management circuit 202 clears the encryption and decryption keys in the buffer memory 252, and sets the memory storage device 100 to the no-media state. Specifically, when the memory storage device 100 is set to the no-media state, if the memory management circuit 202 receives the access signal sent by the host system 1000, the memory management circuit 202 will respond a no-media signal to the host system 1000, This makes it impossible for the host system 1000 to recognize or access the memory storage device 100 , that is, the operating system of the host system 1000 will determine that the memory storage device 100 is in a disconnected state. In this way, it is difficult for others to obtain the data in the rewritable nonvolatile memory module 106. Even if the data is obtained, since the encryption and decryption key has been deleted from the buffer memory 252, others cannot decode the rewritable nonvolatile memory module 106. The encrypted data in the volatile memory module 106.

Fig. 7 is a flowchart of a data protection method according to another exemplary embodiment of the present invention.

Please refer to FIG. 7 , in step S702, the memory management circuit 202 establishes a secure channel with the electronic device 2000 through the wireless communication interface 108, and the secure channel can transmit the wireless network pairing password through the wireless communication interface 108 and confirm it with the electronic device 2000. Establish.

After establishing the secure channel between the memory storage device 100 and the electronic device, in step S704 , the memory management circuit 202 obtains the identification code from the secure channel through the wireless communication interface 108 . Here, the identification code may be input by the user through the electronic device 2000 or automatically through an application program on the electronic device 2000 .

In step S706, the memory management circuit 202 will use a hash function to operate on the received identification code to generate a corresponding information summary, and then in step S708, the memory management circuit 202 will determine whether the above information summary matches the personal identification information summary . Here, the personal identification number information abstract and the key are pre-stored in the rewritable non-volatile memory module 106, wherein the personal identification code information abstract is initially generated according to the personal identification code through a one-way hash function, and the key It is initially based on the personal identification code, using encryption and decryption functions such as Advanced Encryption Standard or Data Encryption Standard, and encryption is generated by an encryption and decryption key generated in a random manner.

If the memory management circuit 202 determines that the above-mentioned information summary does not match the personal identification information summary, it returns to step S704 to obtain the identification code from the electronic device 2000 again. If the memory management circuit 202 judges that the above-mentioned information abstract matches the personal identification information abstract, then in step S710, the memory management circuit 202 decodes the ciphertext according to the identification code using the encryption and decryption function to obtain the encryption and decryption key, and converts the encryption and decryption key stored in the buffer memory 252.

After obtaining the encryption and decryption key, in step S712 , the memory management circuit 202 uses the encryption and decryption key and the encryption and decryption function to access the data in the rewritable non-volatile memory module 106 . Since the process of using the encryption/decryption key and the encryption/decryption function to access the data in the rewritable non-volatile memory module 106 has been described in FIG. 6 , it will not be repeated here.

After the memory management circuit 202 establishes a secure channel with the electronic device 2000 through the wireless communication interface 108, the electronic device 2000 will send a confirmation signal to the memory storage device 100 by responding to the polling signal of the memory storage device 100 to confirm that the electronic device 2000 and the memory The wireless connection status of the storage device 100 . In step S714, the wireless communication interface 108 detects whether a confirmation signal from the electronic device 2000 is received through the secure channel established on the wireless communication network. If the wireless communication interface 108 detects the confirmation signal, return to step S712 to continue accessing the data in the rewritable non-volatile memory module 106 .

If the wireless communication interface 108 of the memory storage device 100 does not receive the confirmation signal sent by the electronic device 2000 within a predetermined period of time, such as 10 seconds, it means that the electronic device 2000 is no longer connected to the wireless communication interface 108 of the short-distance wireless communication network. If it is within the range, then in step S716, the memory management circuit 202 clears the encryption and decryption keys in the buffer memory 252 and sets the memory storage device 100 to the no-media state. Specifically, when the memory storage device 100 is set to the no-media state, if the memory management circuit 202 receives the access signal sent by the host system 1000, the memory management circuit 202 will respond a no-media signal to the host system 1000, This makes it impossible for the host system 1000 to recognize or access the memory storage device 100 , that is, the operating system of the host system 1000 will determine that the memory storage device 100 is in a disconnected state. In this way, it is difficult for others to obtain the data in the rewritable nonvolatile memory module 106. Even if the data is obtained, since the encryption and decryption key has been deleted from the buffer memory 252, others cannot decode the rewritable nonvolatile memory module 106. The encrypted data in the volatile memory module 106 can achieve the effect of protecting the data in the storage device.

To sum up, the data protection method, the memory control circuit unit and the memory storage device of the exemplary embodiments of the present invention establish a secure channel between the memory storage device and the electronic device, and use the identification code transmitted by the electronic device through the wireless network to obtain encrypted data. The decryption key is used to access the rewritable non-volatile memory module. When no confirmation signal is received from the electronic device within a certain period of time, the memory storage device judges that it is no longer within the range of the short-distance wireless communication network of the electronic device, and deletes the encryption and decryption key in the buffer memory. In this way, once the memory storage device is far away from the user's handheld electronic device or is not in a specific wireless network environment, it will not work. Even if the memory storage device is held by others, the encrypted data in the rewritable non-volatile memory module cannot be decoded because the encryption and decryption key has been deleted, thereby ensuring the security of the data in the memory storage device.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (22)

1. A data protection method, characterized in that, for protecting the data of a rewritable non-volatile memory module in a memory storage device, the data protection method comprises: Establish secure channels with electronic devices through wireless communication networks; obtaining an identification code through the secure channel established on the wireless communication network; Use the identification code to obtain the encryption and decryption key and store the encryption and decryption key in the buffer memory; decoding data read from the rewritable non-volatile memory module using the encryption and decryption key, wherein the data of the rewritable non-volatile memory module is encrypted with the encryption and decryption key; Detecting whether an acknowledgment signal from the electronic device is received from the secure channel established on the wireless communication network; and If the confirmation signal from the electronic device is not received within a predetermined time, the encryption and decryption key stored in the buffer memory is cleared. 2. The data protection method according to claim 1, further comprising: After clearing the encryption and decryption key stored in the buffer memory, the memory storage device is set to a no-media state. 3. The data protection method according to claim 1, wherein the step of obtaining the identification code through the secure channel established on the wireless communication network comprises: The identification code input from the electronic device is obtained through the secure channel established on the wireless communication network, wherein the electronic device is a handheld electronic device. 4. The data protection method according to claim 1, wherein the step of obtaining the identification code through the secure channel established on the wireless communication network comprises: The identification code generated by the electronic device is obtained through the secure channel established on the wireless communication network, wherein the electronic device is a server and is electrically connected to a wireless network access point. 5. The data protection method according to claim 1, wherein the wireless communication network is a Bluetooth network, a wireless compatibility certification network, a near field communication network or a radio frequency identification network. 6. The data protection method according to claim 1, wherein the step of using the identification code to obtain the encryption and decryption key and storing the encryption and decryption key in the buffer memory comprises: storing a summary of personal identification code information and a key in the rewritable non-volatile memory module; using a one-way hash function to generate a message digest corresponding to the identifier; and Judging whether the information digest matches the personal identification code information digest, wherein when the information digest matches the personal identification code information digest, decode the key according to the identification code using an encryption and decryption function to obtain the encryption and decryption key. 7. The data protection method according to claim 6, further comprising: initially generating the PIN information digest from the PIN by the one-way hash function; and Initially encrypting the encryption/decryption key according to the PIN using the encryption/decryption function to generate the key. 8. The data protection method according to claim 7, wherein the step of initially encrypting the encryption and decryption key using the encryption and decryption function according to the personal identification code to generate the key further comprises: The encryption decryption key is initially generated randomly. 9. The data protection method according to claim 1, wherein the step of using the encryption and decryption key to decode the data read from the rewritable non-volatile memory module comprises: Decoding data read from the rewritable non-volatile memory module using an encryption and decryption function according to the encryption and decryption key, wherein the data of the rewritable non-volatile memory module is encrypted using the encryption and decryption key The decryption function is encrypted. 10. A memory control circuit unit, characterized in that, for controlling a rewritable non-volatile memory module, the memory control circuit unit comprises: Host interface, electrically connected to the host system; a memory interface electrically connected to the rewritable non-volatile memory module; and a memory management circuit electrically connected to the host interface and the memory interface; Wherein the memory control circuit unit establishes a secure channel with the electronic device through a wireless communication network through a wireless communication interface, Wherein the wireless communication interface obtains the identification code through the secure channel established on the wireless communication network, Wherein the memory management circuit uses the identification code to obtain the encryption and decryption key and store the encryption and decryption key in the buffer memory, Wherein the memory management circuit uses the encryption and decryption key to decode the data read from the rewritable non-volatile memory module, wherein the data of the rewritable non-volatile memory module is encrypted with the encryption and decryption key encryption, Wherein the wireless communication interface detects whether a confirmation signal from the electronic device is received from the secure channel established on the wireless communication network, Wherein, if the wireless communication interface does not receive the confirmation signal from the electronic device within a predetermined time, the memory management circuit clears the encryption and decryption key stored in the buffer memory. 11. The memory control circuit unit according to claim 10, characterized in that, after the memory management circuit clears the encryption and decryption key stored in the buffer memory, when the memory management circuit receives the storage key of the host system When fetching, the memory management circuit transmits no media signal to the host system. 12. The memory control circuit unit according to claim 10, wherein the wireless communication network is a Bluetooth network, a wireless compatibility certification network, a near field communication network or a radio frequency identification network. 13. The memory control circuit unit according to claim 10, wherein the memory management circuit stores a PIN information summary and a key in the rewritable non-volatile memory module, Wherein the memory management circuit uses a one-way hash function to generate an information digest corresponding to the identification code, Wherein the memory management circuit judges whether the information digest matches the personal identification code information digest, wherein when the information digest and the personal identification code information digest match, the memory management circuit decodes the key according to the identification code using an encryption and decryption function to obtain the encrypted decryption key. 14. A memory storage device, comprising: Connect the interface unit and electrically connect to the host system; Rewritable non-volatile memory module; a memory control circuit unit electrically connected to the connection interface unit and the rewritable non-volatile memory module; and a wireless communication interface, electrically connected to the memory control circuit unit, Wherein the memory control circuit unit establishes a secure channel with the electronic device through the wireless communication interface through the wireless communication network, wherein the memory control circuit unit obtains the identification code through the secure channel established on the wireless communication network, Wherein the memory control circuit unit uses the identification code to obtain the encryption and decryption key and store the encryption and decryption key in the buffer memory, Wherein the memory control circuit unit uses the encryption and decryption key to decode the data read from the rewritable non-volatile memory module, wherein the data of the rewritable non-volatile memory module is decoded with the encryption and decryption key is encrypted, Wherein the memory control circuit unit detects whether a confirmation signal from the electronic device is received from the secure channel established on the wireless communication network, Wherein, if the memory control circuit unit does not receive the confirmation signal from the electronic device within a predetermined time, the memory control circuit unit clears the encryption and decryption key stored in the buffer memory. 15. The memory storage device according to claim 14, characterized in that, after the memory control circuit unit clears the encryption and decryption key stored in the buffer memory, when the memory control circuit unit receives the memory of the host system When fetching a signal, the memory control circuit unit transmits a no-media signal to the host system. 16. The memory storage device according to claim 14, wherein the memory control circuit unit obtains the identification code input from the electronic device through the secure channel established on the wireless communication network, wherein the electronic device is Handheld Electronic Devices. 17. The memory storage device according to claim 14, wherein the memory control circuit unit obtains the identification code generated by the electronic device through the secure channel established on the wireless communication network, wherein the electronic device is a server and electrically connected to a wireless network access point. 18. The memory storage device according to claim 14, wherein the wireless communication network is a Bluetooth network, a wireless compatibility authentication network, a near field communication network or a radio frequency identification network. 19. The memory storage device according to claim 14, wherein the memory control circuit unit stores a PIN information summary and a key in the rewritable non-volatile memory module, Wherein the memory control circuit unit uses a one-way hash function to generate an information summary corresponding to the identification code, Wherein the memory control circuit unit judges whether the information digest matches the personal identification code information digest, wherein when the information digest and the personal identification code information digest match, the memory control circuit unit decodes the personal identification code using an encryption and decryption function key to obtain the encryption and decryption key. 20. The memory storage device according to claim 19, wherein the memory control circuit unit initially generates the PIN information digest according to the PIN through the one-way hash function, Wherein the memory control circuit unit initially encrypts the encryption/decryption key according to the personal identification code using the encryption/decryption function to generate the key. 21. The memory storage device according to claim 20, wherein the memory control circuit unit initially generates the encryption/decryption key in a random manner. 22. The memory storage device according to claim 14, wherein the memory control circuit unit uses an encryption and decryption function to decode the data read from the rewritable non-volatile memory module according to the encryption and decryption key, Wherein the data of the rewritable non-volatile memory module is encrypted using the encryption and decryption function according to the encryption and decryption key.