[go: up one dir, main page]

CN110807186B - Method, device, equipment and storage medium for safe storage of storage equipment - Google Patents

Method, device, equipment and storage medium for safe storage of storage equipment Download PDF

Info

Publication number
CN110807186B
CN110807186B CN201911074672.6A CN201911074672A CN110807186B CN 110807186 B CN110807186 B CN 110807186B CN 201911074672 A CN201911074672 A CN 201911074672A CN 110807186 B CN110807186 B CN 110807186B
Authority
CN
China
Prior art keywords
unlocking
storage
host
storage device
safe
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201911074672.6A
Other languages
Chinese (zh)
Other versions
CN110807186A (en
Inventor
魏凤标
骆建军
梅岳辉
陶航
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sage Microelectronics Corp
Original Assignee
Sage Microelectronics Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sage Microelectronics Corp filed Critical Sage Microelectronics Corp
Priority to CN201911074672.6A priority Critical patent/CN110807186B/en
Publication of CN110807186A publication Critical patent/CN110807186A/en
Application granted granted Critical
Publication of CN110807186B publication Critical patent/CN110807186B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44Program or device authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Lock And Its Accessories (AREA)

Abstract

The invention discloses a method, a device, equipment and a storage medium for safely storing storage equipment, and belongs to the field of information safety. A method for secure storage of a storage device, comprising: receiving an unlocking instruction which is sent by a host and used for unlocking a safe storage area of the storage equipment; when the unlocking instruction passes the verification, unlocking the safe storage area; and returning an unlocking success instruction to the host. The method, the device, the equipment and the storage medium for safely storing the storage equipment can enable the safe partition to be hidden before unlocking, have good privacy, and in addition, the safe storage equipment can adopt domestic storage equipment, hardware encryption is adopted, and the safety is high.

Description

Method, device, equipment and storage medium for safe storage of storage equipment
Technical Field
The present invention relates to the field of information security, and in particular, to a method, an apparatus, a device, and a storage medium for secure storage of a storage device.
Background
At present, a security computer usually inputs a password when a storage device is started to acquire the authority to start a PC, and because the storage device is not made in China generally, an encryption algorithm cannot be completely controlled by the storage device, and a security risk exists. In addition, files and directories to be stored are encrypted through special encryption and decryption software and then stored in the storage device, the encryption software needs to be encrypted and decrypted by a CPU of a computer, the utilization rate of the CPU is reduced, the access speed of the storage device is reduced, the software encryption is easier to be utilized and cracked by hackers compared with the hardware encryption, and the security is not good enough.
The prior art also provides a method for installing an encryption component, such as an encryption card, on a secure computer, before data is written in, the data is encrypted by the encryption component and then stored in a storage device; when reading, the read data is sent to the encryption component for decryption, and then the correct data is obtained. The scheme adds a hardware encryption card, improves the hardware cost of the system, and influences the storage performance of the storage device because all read data and write data need to be encrypted or decrypted by the encryption card.
The prior art also provides a method for performing security protection on a storage device by using an encryption mechanism in the storage device, and most of the existing mechanical storage devices and SSDs are foreign. The encryption disk is unlocked by running an unlocking software firstly, and then can be read and written as a normal disk. Since the security of the foreign storage device cannot be guaranteed, the encrypted data can be easily read and decrypted even in the encrypted state, and the security needs to be improved.
Therefore, a solution to the above-mentioned problems is desired.
Disclosure of Invention
In order to solve the above problems, the present invention provides a method, an apparatus, a device and a storage medium for secure storage of a storage device.
In a first aspect, the present invention provides a method for secure storage of a storage device, including:
receiving an unlocking instruction which is sent by a host and used for unlocking a safe storage area of the storage equipment;
when the unlocking instruction passes the verification, unlocking the safe storage area;
and returning an unlocking success instruction to the host.
In a second aspect, the present invention provides a device for securely storing a storage device, including a receiving module, an unlocking device, and a feedback module, wherein:
the receiving module is used for receiving an unlocking instruction which is sent by the host computer and used for unlocking the safe storage area of the storage device;
the unlocking module is used for unlocking the safe storage area when the unlocking instruction passes the verification;
the feedback module is used for returning an unlocking success instruction to the host.
In a third aspect, the present invention provides a storage device comprising: memory, a processor and a computer program stored on the memory and executable on the processor, the computer program, when executed by the processor, implementing the steps of the method as claimed in any one of the above.
In a fourth aspect, the invention provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method as defined in any one of the above.
By adopting the method, the device, the equipment and the storage medium for safely storing the storage equipment, the safe partition can be hidden before unlocking, the privacy is good, and in addition, the safe storage equipment can adopt domestic storage equipment, the hardware is encrypted, and the safety is high.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the invention and not to limit the invention. In the drawings:
FIG. 1 is a diagram illustrating an example of a storage device partition according to the present invention;
FIG. 2 is a flow chart of a method for secure storage of a storage device in an exemplary embodiment of the invention;
FIG. 3 is a flowchart illustrating the authentication process between the host and the storage device according to the present invention;
fig. 4 is an apparatus for secure storage of a storage device in an exemplary embodiment of the invention.
Reference numerals:
41-a receiving module; 42-an unlocking module; 43-feedback Module.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the technical solutions of the present invention will be clearly and completely described below with reference to the specific embodiments of the present invention and the accompanying drawings. It is to be understood that the described embodiments are merely exemplary of the invention, and not restrictive of the full scope of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The invention relates to a safe storage device which is used for binding hardware resources of a storage device by adopting an encrypted storage device on a mobile storage device and needs to unlock a safe storage space on the encrypted storage device through a special command interface. The storage space in the encrypted storage device is divided into 2 parts, and one part is reserved for a boot startup program which provides an interface for unlocking other storage spaces. The other part is a safe storage area which stores the safety data of the user and comprises an operating system. And when the boot program is started, receiving unlocking information of a user, pairing the unlocking information with the binding information in the storage equipment, if the pairing is correct, quitting the boot program, hiding a storage area where the boot program is located, unlocking the secure storage area, restarting the system, and rebooting and starting from the secure storage area. The storage device includes, but is not limited to, a storage medium such as an HDD, SSD, etc.
As shown in fig. 1, one is a boot area 11, which is visible when the host is started, and the other is a secure storage area 12, which is not physically visible, and data in the secure storage area cannot be read or written by any command. After the safe storage area 12 is unlocked, when the system is not powered off, that is, under the condition that the storage device is not powered off, the storage device always works in the safe storage area 12, and only when the host is powered off and is started again, the safe storage area 12 is actively hidden, and is switched to the boot area 11, and the storage device is booted again to unlock.
Fig. 2 is a flowchart of a method for secure storage of a storage device according to an exemplary embodiment of the present invention, including:
s202: receiving an unlocking instruction which is sent by a host and used for unlocking a safe storage area of the storage equipment;
s204: when the unlocking instruction passes the verification, unlocking the safe storage area;
s206: and returning an unlocking success instruction to the host.
The host comprises electronic equipment such as a portable computer, a desktop computer and a mobile terminal, unlocking the safe storage area comprises setting an unlocking mark, hiding a guide area of the storage equipment and unlocking the safe storage area.
Specifically, the host sends a self-defined command for unlocking the secure storage area to the storage device, data in the data is encrypted by using a random number, namely a private key, recorded during authentication, the storage device unlocks by using the random number, namely the private key, recorded during authentication after receiving the unlocking command, whether the command data is correct is checked, and if the command data is correct, unlocking is performed, an unlocking mark is juxtaposed, the boot area is hidden, and the secure storage area is unlocked. The unlock mark can be distinguished by setting an identifier, and the address range of the secure storage area, such as 0x1000-0x1 fffffff, is mapped to the logical address 0x0000-0x1effff of the storage device, and the address range 0x0000-0xffff of the boot area is shifted out of the address range of the storage device to hide the boot area. The host sees a physical disk with an address range of 0x0000-0x1 effff. After the host receives the successful state of the unlocking command, the information of the storage device is refreshed, the system can also be started in a hot mode, at the moment, a boot area of the host is not seen, only a safe storage area can be seen, and the safe storage area is a normal storage device for the host and can perform normal partitioning, formatting, reading and writing and other processing.
In another exemplary embodiment of the present invention, before the receiving an unlocking instruction sent by a host to unlock a secure storage area of a storage device, the method further includes: receiving an authentication instruction for reading the feature information sent by the host, encrypting the feature information and the generated random number and returning the encrypted feature information and the generated random number to the host; and receiving and decrypting the preprocessed feature information and the preprocessed random number, verifying whether the feature information and the preprocessed random number are correct or not, and returning an authentication success instruction when the feature information and the preprocessed random number are verified to be correct.
Before the boot program completes the communication between the storage device and the host, authentication processing needs to be performed, and the authentication flow is shown in fig. 3:
s301, the host sends a special command to the storage device;
s302, reading a specific information word and a group of random numbers of the storage device, encrypting the data by using an agreed public key and then sending the encrypted data to a host for reading;
s303, the host decrypts by using the public key, checks whether the specific information words are matched, if not, the authentication fails, otherwise, the random number is recorded, predefined processing is carried out on some data in the group of data (such as changing the position of the random number, negating some data and the like), and the data is encrypted by using the public key and then sent to the storage device; the preprocessing comprises AES, SM4, DES and other algorithms.
S304, the storage device decrypts after obtaining the data and checks whether the group of data is correct, if the data is correct, the authentication is successful, the random number is recorded as a private key, the writing success state is returned to the host, and if the data is not correct, the failure state is returned to the host.
S305, after the host computer reads the success state, the authentication is finished, the recorded random number is also used as a private key, and the private key is used for carrying out encryption and decryption processing on command data in subsequent commands.
After the authentication is finished, the host reads the configuration data encrypted by the private key, the data comprises bound host hardware information, the host reads the current hardware information and compares the current hardware information with the bound information in the read hardware information, the next operation of unlocking the safe storage area can be carried out only if the comparison information is consistent, otherwise, the safe storage area cannot be unlocked. The hardware information of the host is bound through the storage device with hardware encryption to ensure the security of the data stored in the storage device, wherein the storage device comprises but is not limited to a domestic storage device. Because the storage equipment is bound with the computer storage equipment resources, the storage equipment is disassembled and installed on other computers and cannot run, and compared with the prior art, the method has the advantages that the binding and cracking probability of hardware resources is not reduced, and the safety performance is improved.
The read-write command in the authentication process is a storage device manufacturer self-defined command, the data content is also self-defined, and the read-write command is encrypted in the transmission process so as to ensure that the authentication process is not decoded and the data safety of the storage device is ensured.
When the storage equipment is powered off, the storage equipment can automatically enter a locking state, namely the guide subarea is visible and the safe storage area is invisible, and after the storage equipment receives a power-off signal, the storage equipment can be locked through a hardware switch of the storage equipment. Normal reading and writing can be carried out on the safe storage area of the storage device only by re-authenticating and unlocking the safe storage area.
The safe storage partition can be divided into a plurality of partitions according to the needs of users, an unlocking password is set for each partition, and an unlocking password can be set for a plurality of connected partitions. After that, the host can see a normal working disk with the capacity of one or a plurality of continuous partitions by refreshing the information of the storage device, and other safe partitions are continuously processed in a hidden state, so that a user cannot read and write the hidden partitions.
In the above exemplary embodiments of the present invention, the boot start program is installed in the boot area, and is used to detect whether the hardware in the host is consistent with the binding information in the storage device, if not, the host stops working, otherwise, an unlock secure storage area password input window is popped up, and a user is required to input an unlock password, when the password is correct, the secure storage area is unlocked, and the boot area is hidden, and at this time, the host can see all the information in the secure storage area, and can perform normal read-write operation as in a normal storage device.
Fig. 4 is a device for securely storing a storage device according to another exemplary embodiment of the present invention, which includes a receiving module 41, an unlocking device 42, and a feedback module 43, where:
the receiving module 41 is configured to receive an unlocking instruction sent by a host to unlock a secure storage area of a storage device;
the unlocking module 42 is used for unlocking the secure storage area when the unlocking instruction passes the verification;
the feedback module 43 is configured to return an unlocking success command to the host.
Each module in the apparatus for securely storing storage devices provided in the embodiments of the present invention may also be used to implement the functions corresponding to each method step in the embodiments described above, which are not described herein again.
An embodiment of the present invention further provides a storage device, including: the storage device comprises a memory, a processor and a computer program which is stored on the memory and can run on the processor, wherein the computer program realizes the steps of the safe storage method of the storage device when being executed by the processor.
The embodiment of the present invention further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the computer program implements each process of the above-mentioned storage device secure storage method embodiment, and can achieve the same technical effect, and in order to avoid repetition, details are not repeated here. The computer-readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the present invention, and any modifications, equivalents, improvements and the like made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (7)

1. A method for secure storage of a storage device, wherein a storage space of the storage device comprises a boot area and a secure storage area, the method comprising:
booting a boot program through the boot area;
receiving an unlocking instruction which is sent by a host and used for unlocking a safe storage area of the storage equipment;
when the unlocking instruction passes the verification, unlocking the safe storage area;
returning an unlocking success instruction to the host;
the unlocking the secure storage area comprises:
setting an unlocking mark, hiding a boot area of the storage device, and unlocking the safe storage area;
before the receiving host sends an unlocking instruction for unlocking the secure storage area of the storage device, the method further comprises the following steps:
receiving an authentication instruction for reading the characteristic information sent by the host,
encrypting and returning the feature information and the generated random number to the host;
receiving and decrypting the preprocessed feature information and the random number,
verifying whether the characteristic information and the random number are correct or not, and returning an authentication success instruction when the verification is passed;
sending storage device configuration data encrypted by the random number to the host, wherein the storage device configuration data is used for verifying whether hardware information bound with the host is consistent or not;
and when the verification is consistent, unlocking the safe storage area of the storage equipment.
2. The method of claim 1, wherein the pre-processing comprises one or more of the following encryption algorithms: AES, SM4, DES.
3. The method of claim 1, further comprising:
and when the storage equipment is powered off, automatically entering a locking state.
4. The method according to any one of claims 1 to 3, wherein the secure storage area comprises at least one partition, and the at least one partition is at least correspondingly provided with different unlocking passwords.
5. The device for the safe storage of the storage equipment is characterized in that the storage space of the storage equipment comprises a boot area and a safe storage area, the device comprises a receiving module, an unlocking device and a feedback module, wherein:
the receiving module is used for receiving an unlocking instruction which is sent by a host and used for unlocking the safe storage area of the storage device when the boot program is booted through the boot area;
the unlocking module is used for unlocking the safe storage area when the unlocking instruction passes the verification;
the feedback module is used for returning an unlocking success instruction to the host;
the unlocking module is specifically used for setting an unlocking mark, hiding a guide area of the storage device and unlocking the safe storage area when the unlocking instruction passes the verification;
a verification module for receiving the authentication instruction of reading the characteristic information sent by the host,
encrypting and returning the feature information and the generated random number to the host;
receiving and decrypting the preprocessed feature information and the random number,
verifying whether the characteristic information and the random number are correct or not, and returning an authentication success instruction when the verification is passed;
the unlocking module is further configured to send storage device configuration data encrypted by the random number to the host, where the storage device configuration data is used to verify whether hardware information bound to the host is consistent; and when the verification is consistent, unlocking the safe storage area of the storage equipment.
6. A storage device, comprising: memory, processor and computer program stored on the memory and executable on the processor, which computer program, when executed by the processor, carries out the steps of the method according to any one of claims 1 to 4.
7. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, which computer program, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 4.
CN201911074672.6A 2019-11-06 2019-11-06 Method, device, equipment and storage medium for safe storage of storage equipment Active CN110807186B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201911074672.6A CN110807186B (en) 2019-11-06 2019-11-06 Method, device, equipment and storage medium for safe storage of storage equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201911074672.6A CN110807186B (en) 2019-11-06 2019-11-06 Method, device, equipment and storage medium for safe storage of storage equipment

Publications (2)

Publication Number Publication Date
CN110807186A CN110807186A (en) 2020-02-18
CN110807186B true CN110807186B (en) 2022-04-15

Family

ID=69501345

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201911074672.6A Active CN110807186B (en) 2019-11-06 2019-11-06 Method, device, equipment and storage medium for safe storage of storage equipment

Country Status (1)

Country Link
CN (1) CN110807186B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113378216A (en) * 2021-05-29 2021-09-10 深圳市得一微电子有限责任公司 eMMC control method, system and storage medium thereof
CN114978689A (en) * 2022-05-23 2022-08-30 江苏芯盛智能科技有限公司 Storage device remote management method and system and storage device

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101916342A (en) * 2010-08-16 2010-12-15 武汉天喻信息产业股份有限公司 Secure mobile storage device and method for realizing secure data exchange by using same
CN102084373A (en) * 2008-08-04 2011-06-01 桑迪士克以色列有限公司 Backing up digital content that is stored in a secured storage device
CN107403109A (en) * 2017-08-09 2017-11-28 苏州中科安源信息技术有限公司 Encryption method and encryption system
CN109271813A (en) * 2018-10-26 2019-01-25 杭州华澜微电子股份有限公司 A kind of safety storage apparatus, mobile memory system and method for secure storing

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1241125C (en) * 2002-05-08 2006-02-08 联想(北京)有限公司 Hard disc data duplicating and reproducing method
JP4762292B2 (en) * 2008-10-29 2011-08-31 東芝ストレージデバイス株式会社 Storage apparatus, storage system, and unlock processing method
JP5604929B2 (en) * 2010-03-29 2014-10-15 ソニー株式会社 Memory device and memory system
CN102819705B (en) * 2012-07-26 2014-11-19 郑州信大捷安信息技术股份有限公司 System and method for realizing system file integrity verification in master boot sector
US8732470B2 (en) * 2012-07-26 2014-05-20 Kabushiki Kaisha Toshiba Storage system in which fictitious information is prevented
CN109327444B (en) * 2014-03-27 2021-12-07 创新先进技术有限公司 Account information registration and authentication method and device
CN110392030B (en) * 2018-04-20 2021-12-14 武汉真元生物数据有限公司 Identity authentication and service processing method and system based on biological characteristics

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102084373A (en) * 2008-08-04 2011-06-01 桑迪士克以色列有限公司 Backing up digital content that is stored in a secured storage device
CN101916342A (en) * 2010-08-16 2010-12-15 武汉天喻信息产业股份有限公司 Secure mobile storage device and method for realizing secure data exchange by using same
CN107403109A (en) * 2017-08-09 2017-11-28 苏州中科安源信息技术有限公司 Encryption method and encryption system
CN109271813A (en) * 2018-10-26 2019-01-25 杭州华澜微电子股份有限公司 A kind of safety storage apparatus, mobile memory system and method for secure storing

Also Published As

Publication number Publication date
CN110807186A (en) 2020-02-18

Similar Documents

Publication Publication Date Title
US8695087B2 (en) Access control for a memory device
JP5643303B2 (en) Remote access control of storage device
US8230207B2 (en) System and method of providing security to an external attachment device
EP3525127B1 (en) System for blocking phishing or ransomware attack
US20120198538A1 (en) Multi-enclave token
KR20080071528A (en) Method and system for storage data encryption and data access
CN112083879B (en) Physical partition isolation and hiding method for storage space of solid state disk
CN108256302B (en) Data security access method and device
CN105354479A (en) USB flash disk authentication based solid state disk and data hiding method
US10783088B2 (en) Systems and methods for providing connected anti-malware backup storage
US8695085B2 (en) Self-protecting storage
US8181006B2 (en) Method and device for securely configuring a terminal by means of a startup external data storage device
CN112966276B (en) Method, device and medium for safely starting computer
CN110807186B (en) Method, device, equipment and storage medium for safe storage of storage equipment
CN115906196A (en) Mobile storage method, device, equipment and storage medium
CN103930894A (en) Storage device reader having security function and security method using same
JP4993114B2 (en) Shared management method for portable storage device and portable storage device
EP4006758B1 (en) Data storage apparatus with variable computer file system
CN109190364A (en) A kind of safe U disc for solid state hard disk authentication
US11782610B2 (en) Write and compare only data storage
JP4561213B2 (en) Hard disk security management system and method thereof
CN109190365A (en) A kind of solid state hard disk data protection system based on USB flash disk authentication
CN110851881B (en) Security detection method and device for terminal equipment, electronic equipment and storage medium
CN102426555A (en) Mobile memory, access control method and system of mobile memory
KR101936194B1 (en) SD Memory Control Method having Authentication-based Selective-Activation Function of Multi-Partitioned Memory

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant