CN103946860B - Storage device - Google Patents

Storage device Download PDF

Info

Publication number
CN103946860B
CN103946860B CN201280056703.5A CN201280056703A CN103946860B CN 103946860 B CN103946860 B CN 103946860B CN 201280056703 A CN201280056703 A CN 201280056703A CN 103946860 B CN103946860 B CN 103946860B
Authority
CN
China
Prior art keywords
information
data
radio signal
storage device
storage
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201280056703.5A
Other languages
Chinese (zh)
Other versions
CN103946860A (en
Inventor
松芝卓二
高山雅夫
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
International Business Machines Corp
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corp filed Critical International Business Machines Corp
Priority claimed from PCT/JP2012/072303 external-priority patent/WO2013073260A1/en
Publication of CN103946860A publication Critical patent/CN103946860A/en
Application granted granted Critical
Publication of CN103946860B publication Critical patent/CN103946860B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Abstract

The present invention provides a kind of and starts so as to the storage device 20 that communicates when attached to computers.This storage device 20 includes: interface 240, for controlling the communication with described computer;Data storage cell 250, the data received from described computer via described interface for storage;Radio signal processing unit 220, for including the radio signal of id information at predetermined timing receipt, and is authenticated the id information received;And control unit 210, for using certified id information as key, data to be encrypted, encryption data is sent to data storage cell, and when radio signal processing unit 220 is not received by the radio signal including certified id information within a predetermined period of time, forbid the communication via interface 240 with described computer.

Description

Storage device
Technical field
The present invention relates to a kind of storage device, more particularly, to for starting when attached to computers so as to The information protection of the storage device communicated.
Background technology
There is storage device (such as USB (flash memory) memorizer or have USB of the USB interface for being connected to computer The portable HDD connected) small and exquisite and portable.Therefore, it is by bigger to loss or stolen probability.Have employed various strategy Prevent when USB storage is lost or be stolen or when user leaves computer in the case of USB storage still connects Time USB storage in information open.
Such as, the key feeding cipher when information is written in the storage device of such as USB storage, and unless this password It is typed to, otherwise can not read information from this storage device.
A kind of information-storing device is disclosed in Kokai Patent publication No.2009-042927 (patent documentation 1), its There is reader/writer (R/W) and the bulk storage for receiving ID from rfid card, and receive based on from rfid card ID change from the addressable region of the terminal with bulk storage and stop from this terminal access R/W.
In Kokai Patent publication No.2005-267533 (patent documentation 2), disclose a kind of storage device, work as detection Moved when reaching isolated state more than preset distance from information processor to this storage device, it is right that this storage device is forbidden The access of the record some or all of data on this storage device, or record data on this storage device are added Close.
Quotation list
Patent documentation
Patent documentation 1 Kokai Patent publication No.2009-042927
Patent documentation 2 Kokai Patent publication No.2005-267533
Summary of the invention
In cipher-code input method, it is necessary to before protection information, driver and application software are incorporated into calculating Machine.During additionally, information is read or written every time, it is necessary to key feeding cipher, and need periodicmaintenance, such as password update.
Storage device in patent documentation 1 does not accounts for the data protection when not receiving ID from rfid card.It is also Do not consider data encryption.
Storage device in patent documentation 2 does not accounts for when storage device does not also move more than pre-from information processor Set a distance reaches data protection during isolated state.It does not also consider if storing data when device is not at isolated state and adding Close.
Therefore, it is an object of the invention to, by starting so as to the storage that communicates when attached to computers Device provide suitable and effective information protection solve or reduce these technical problems.
The solution of problem
The present invention provides a kind of and starts so as to the storage device that communicates when attached to computers.This storage fills Put and include: interface, for controlling the communication with computer;Data storage cell, by storing via described interface based on described The data that calculation machine receives;Radio signal processing unit, for including the radio signal of id information at predetermined timing receipt, and And it is used for the id information that certification is received;And control unit, it is used for using certified id information to come data as key It is encrypted, for encryption data being sent to data storage cell, and for when radio signal processing unit is predetermined When being not received by the radio signal including certified id information in the time period, forbid via described interface and described calculating The communication of machine.
Because the id information received is authenticated by the present invention and it is right to use certified id information to come as key Data are encrypted, it is possible to eliminate the inconvenience of necessary key feeding cipher during data encryption.Because the present invention is in advance It is not received by the section of fixing time during the radio signal including certification id information forbidding and compunication, so when storage dress Put loss or stolen time, or when user store device be being used while leave computer time, can protect storage dress Put the data of inside.The present invention substantially can be used alone under not having computer or the intervention of software that performed by computer Storage device protects data.
In in one aspect of the invention, when have received data read request from computer, control unit is deposited from data Storage unit reads encryption data corresponding with data read request, uses certified id information to come this encryption number as key According to being decrypted, and receive the nothing including certified id information within a predetermined period of time at radio signal processing unit During the line signal of telecommunication, via described interface, solution ciphertext data is sent to computer.
Data are not only encrypted by this aspect of the present invention, and it also uses certified id information as key Data are decrypted.And hence it is also possible to eliminate the inconvenience of necessary key feeding cipher during data deciphering, and permissible Further enhance and strengthen data protection.
In in one aspect of the invention, storage device includes for storing the id information memory element of id information, Yi Jiyong Authentication switch in id information;And when authentication switch is opened, control unit instruction radio signal processing unit will be connect The id information received is stored in id information storage element as registration id information.
In in this aspect of the invention, user can select by using new id information as the id information of new registration Protect id information memory element.This makes to store device can be used again as the only ability when the id information of new registration is used The storage device run.This also make to store device can keeping being used again while data protection function (and weight Multiple use).
In in one aspect of the invention, radio signal processing unit be determined by received id information whether with storage Registration id information coupling in id information memory element performs certification, except when outside when authentication switch is opened.
In in this aspect of the invention, perform to store the institute in device automatically by the comparison with registration id information The certification of the id information received.As a result, it is possible to managing encrypted key and use encryption in the case of the intervention not having computer The certification of key.
In in one aspect of the invention, id information includes carrying distinctive one No. ID and attached of the medium of this id information With the 2nd No. ID of the one No. ID, and control unit uses the one No. ID and/or the 2nd No. ID in certified id information As key.
In in this aspect of the invention, distinctive one No. ID and/or subsidiary one No. ID of the medium of carrying id information The 2nd No. ID with the key acting on deciphering.As a result, carrying can be peculiar with this medium for the medium of the id information of communication No. ID identify (or limit).This is so that data protection more robust.
In in one aspect of the invention, radio signal processing unit includes the reader/writer (R/ for RFID W), and wherein, id information is carried as the RFID label tag that can communicate with R/W by described medium.
In in this aspect of the invention, RFID technique is used to reduce radio signal processing unit and carrying id information The size of medium and reduce power consumption.
Accompanying drawing explanation
Fig. 1 is example and the diagram of communication environment thereof of the configuration of the storage device illustrating the present invention.
Fig. 2 is the block diagram of the example of the configuration of the storage device illustrating the present invention.
Fig. 3 is the diagram of the example of the example of configuration of the storage device illustrating the present invention and signal path.
Fig. 4 is the diagram of the flow process illustrating the poll process performed by the radio signal processing unit of the present invention.
Detailed description of the invention
Explanation referring to the drawings to embodiments of the invention is presented herein below.Fig. 1 is the configuration of the storage device illustrating the present invention Example and the diagram of communication environment.Communication environment in Fig. 1 is by computer 10, USB storage 20 and contactless (nothing Line) ID card 30 composition.Computer 10 is not limited to the notebook shown in Fig. 1.It can be all to take any other form Such as desk computer, flat board or server.Computer 10 may be also connected to network, or independent.
Storage device is not limited to the USB storage 20 shown in Fig. 1.Substantially, it can be when attached to computers Start so as to any storage device of communicating.In other words, it can be to have the interface in addition to USB interface Storage device.Additionally, USB storage 20 needs not to be semiconductor memory (flash memories) type shown in Fig. 1.It is also Can be that there is the HDD that USB connects.In FIG, by the direction of arrow USB interface (terminal) 22 being inserted into computer The usb 12 of 10 starts USB storage 20.Then it can communicate with computer 10.USB storage 20 and ID Card 30 carries out radio communication (B).
ID card 30 include for carry out with USB storage 20 circuit (IC, IC tag) of radio communication, antenna (coil) with And for storing the memorizer of id information.ID card 30 is not limited to the card (flat board) shown in Fig. 1.It can to take any form, Such as dish, pen or name label.Id information includes that distinctive one No. ID of ID card 30 (compile by the product such as, with several numeral Number) and the 2nd No. ID (such as, the alphanumeric character sequence) of subsidiary one No. ID.In order to prevent the duplication of ID card 30, should When the id information being periodically more newly stored in ID card 30 and the storage registration ID for certification in the storage device simultaneously Information (describing below) (being changed into other same id informations).
Fig. 2 is the block diagram of the example of the configuration of the storage device illustrating the present invention.Example in Fig. 1 is to store for USB Device 20 and configure.Element in each piece can be via communication path (bus) 270 and other element communication.Control unit 210 include processor (CPU), RS, and perform following various types of control.Radio signal processes single Unit 220 interval on schedule receives the radio signal including id information, and is authenticated the id information received.ID believes Breath memory element 230 stores id information.Id information memory element 230 can be building up in control unit 210, or id information Memory element 230 is also used as the memorizer in control unit 210.
Interface (I/F) 240 controls the communication (input/output) with computer.Data storage cell 250 manages via interface (I/F) 240 data received from computer.When data storage cell 250 is USB storage 20 as above, it is permissible It is flash memories or HDD.Authentication switch (SW) 260 is to be deposited at id information when id information that is new or that update stores (registration) The switch opened by user time in storage device 230.Authentication switch (SW) 260 be when open and close time change position button or Slide switch.For the present embodiment, can be selected any one.In order to prevent when user surprisingly presses authentication switch SW260 Id information update, device should be configured such that and not export ON signal, be more than unless authentication switch SW260 has kept pressing Predetermined amount of time (such as, two seconds or three seconds).When authentication switch SW260 is pressed, the small-sized light-emitting component of such as LED is permissible Light or flash, have begun to and terminate visually informing the user the registration (renewal) of new id information.Alternately, When authentication switch SW260 is pressed, sound or tone can be produced, acoustically to inform the user the note of new id information Volume (renewal) has begun to and terminates.
Fig. 3 is the diagram of the example of the example of configuration of the storage device illustrating the present invention and signal path.Ginseng is presented herein below Explanation according to the Fig. 3 operation to being performed by the main element constituting the present invention.Radio signal processing unit 220 includes that R/W is controlled Unit 221 processed, timer 222 and antenna 223.R/W control unit 221 is the reader/writer (R/W) for RFID. In RFID R/W, use the ID card with built-in IC (ID) label for RFID.In RFID R/W, via antenna 223 Electromagnetic wave or radio signal are sent to ID card (poll), activate the ID card with the built-in IC tag for RFID, and will The id information being stored in the memorizer of ID card sends as radio signal (electromagnetic wave).R/W control unit 221 is from ID clamping Packet receiving includes the radio signal of id information.Timer 222 from poll start the measurement time.Use timer 222 measure time Between come as described above certification id information and protection data.The id information received is authenticated by R/W control unit 221, And certified id information is stored in id information memory element 230.Poll and id information certification are described further below Control.
It is single that control unit 210 includes that encryption/decryption element 211, memory control unit 212 and I/F and certification control Unit 213.Encryption/decryption element 221 uses certified id information to come sending from computer via I/F240 as key Data are encrypted, and via memory control unit 212, the data of encryption are sent to data storage cell 250.In encryption Period, encryption/decryption element 211 uses distinctive one No. ID of above-mentioned ID card 30 (such as, to have the product of several numeral Product are numbered) and/or attach the 2nd No. ID (such as, the alphanumeric character sequence) of the one No. ID as encrypt or decrypt keys.
Memory control unit 212 includes the function that so-called Memory Controller is total, such as data to data The write of memory element 250 controls, for controlling from the reading of the data of data storage cell 250 and depositing for data The read/write address of storage unit 250 controls.
Certified id information is included when receiving to indicate to receive within a predetermined period of time from R/W control unit 221 The signal of radio signal, and via I/F240 when computer receives data read request, I/F and authentication control unit 213 instruction memory control units 212 read data corresponding with read requests.This predetermined amount of time can be such as ten seconds. The time quantum in past since poll starts that R/W control unit 221 is measured based on timer 222 determines whether to have reached Arrive predetermined amount of time.Memory control unit 212 reads encryption data corresponding with read requests from data storage cell, and This encryption data is sent to encryption/decryption element 211.Encryption/decryption element 211 uses certified id information as key The encryption data sent is decrypted, and via I/F240, the data of deciphering is sent to computer.
Include that certified ID believes when not receiving to indicate to receive within a predetermined period of time from R/W control unit 221 The signal of the radio signal of breath, and via I/F240 when computer receives data read request, I/F and certification control Unit 213 prohibits the use of I/F240 to communicate with computer.This predetermined amount of time can be such as ten seconds.For example, it is possible to it is logical Cross the impedance of the data wire by being used for I/F240 and be set to height (Hi-Z) or low (Low-Z) cuts with computer logically to set up Disconnected state (data transmission-reception illegal state) forbids the communication with computer.Now, perform ongoing affairs until Till end, and the transmission of at least one packet or reception are complete.But, because the data just transmitted be not with Complete form transmits, so this data must be resend after again establishing communication with computer.In order to again Set up the communication with computer, it is necessary to restart storage device 20.In the case of USB storage 20 shown in FIG, must Must be removed it from the USB interface (terminal) 22 of computer 10, and reinsert it.
I/F and authentication control unit 213 also receive and are used for the signal that the authentication switch (SW) 260 of id information has been switched on, And indicate R/W control unit 221 to be stored in id information memory element 230 as registration id information by the id information received. With reference to the registration id information of new storage in the authentication processing performed by R/W control unit 221.In other words, it is determined by Whether exist and perform certification with mating of id information of registration.This information is the most encrypted/and decryption unit 221 is used as encryption/deciphering Key.Therefore, when ID card is lost or be stolen, it is possible to use the id information being stored in new ID card is continuing with storing device 20.Because id information is different, so the data using previous (old) id information encryption can not be accessed.This prevents information (number According to) reveal.When new id information is registered, legacy data can be deleted by reformatting data memory element 250.This is complete Entirely prevent legacy data from revealing.
It is presented herein below with reference to Fig. 4 by storing poll and the explanation of id information certification control that device performs.Fig. 4 is to illustrate to deposit Poll between storage device (memorizer) and ID card (ID card) and the diagram of authentication processing flow process.As mentioned above, in Fig. 4 Poll and certification control actually by the radio signal processing unit 220 (R/W control unit 221) within storage device Perform.In Fig. 4 (a), the certification success of id information.In Fig. 4 (b), authentification failure.
In Fig. 4 (a), activate storage device (powering on), and at predetermined start by set date poll.When ID card can be with storage dress When putting communication, it is replied with Ack, sends id information (A1) simultaneously.Storage device determine received ID whether with registration Id information mates.As its coupling and certification OK, output effective marker (F1).Then during each polling operation, repeat phase Same operation.In the n-th polling operation (Pn) period, do not return Ack, and id information (An) can not be received.Storage device pair The authentification failure of id information, and export invalid flag (Fn).In Fig. 4 (a), authentification failure is repeated twice.But, because recognizing Demonstrate,proving and unsuccessfully occur in predetermined amount of time Δ T1, so maintaining the output of valid flag, and the certification of id information continues.As with Upper mentioned this predetermined amount of time Δ T1 can be ten seconds.When the output of effective marker exceedes pre-timing as mentioned above Between section when continuing, by the signal that indicates this state, (that is, instruction receives within a predetermined period of time and includes certified id information The signal of radio signal) it is sent to I/F and authentication control unit 213 from R/W control unit 221.
In Fig. 4 (b), as in Fig. 4 (a), perform poll in predetermined timing, and perform certification (P1, A1, F1). In the n-th polling operation (Pn) period, do not return Ack, and id information (An) can not be received.Id information is recognized by storage device Demonstrate,prove unsuccessfully, and export invalid flag (Fn).In Fig. 4 (b), different from Fig. 4 (a), thereafter, authentification failure continues to occur. Predetermined amount of time Δ T1 is exceeded, and indicates the invalid flag of authentification failure to export.In this case, by this state of instruction Signal (that is, instruction be not received by including the signal of the radio signal of certified id information in this predetermined amount of time) It is sent to I/F and authentication control unit 213 from R/W control unit 221.As a result, as mentioned above, forbid via I/F240 With compunication (USB release).This prevents the access for storing information (data) in the storage device, and prevents letter Breath is revealed.
Due to following, as a example by the above-mentioned predetermined amount of time for determining certification success or failure is arranged Such as ten seconds: (a) this be to be enough to process the time of business of finishing;B () exists and is attempting it twice or thrice because of radio condition After can not receive the situation of id information;C the transmission of the file of () tens MB can be not many than necessary transmission interference Transmission interference in the case of complete;And (d) third party is difficult to fill from storage in being stuck in ten seconds away from the ID storing device Put duplication file (data).
With reference to the accompanying drawings of embodiments of the invention.But, the invention is not restricted to these embodiments.The technology of this area Personnel can the invention is embodied as including the various improvement without departing from the spirit or scope of the present invention, modifications and changes.
List of numerals
10: computer (PC)
12,22:USB interface (I/F)
20: storage device (USB storage)
270: communication path (bus)

Claims (6)

1. start so as to the storage device that communicates, described storage device bag in the case of being connected to computer Include:
Interface, described interface is for controlling the communication with described computer;
Data storage cell, the data that described data storage cell receives from described computer via described interface for storage;
Radio signal processing unit, described radio signal processing unit for including the nothing of id information at predetermined timing receipt The line signal of telecommunication, and the id information received is authenticated;
Control unit, described control unit is used for using certified id information to be encrypted data as key, will add Ciphertext data is sent to data storage cell, and is not received by within a predetermined period of time including at radio signal processing unit In the case of the radio signal of certified id information, forbid the communication via described interface Yu described computer;
Id information memory element, described id information memory element is used for storing registration id information;With
Authentication switch for id information;
Wherein, in the case of described authentication switch is opened, described control unit instruction radio signal processing unit will be connect The id information received is stored in id information storage element as registration id information.
Storage device the most according to claim 1, wherein, in the feelings that have received data read request from described computer Under condition, described control unit reads encryption data corresponding with data read request from data storage cell, uses certified Encryption data is decrypted by id information as key, and receives within a predetermined period of time at radio signal processing unit In the case of including the radio signal of certified id information, via described interface, solution ciphertext data is sent to described calculating Machine.
Storage device the most according to claim 1, wherein, in addition in the case of authentication switch unlatching, described nothing Line electric signal processing unit is determined by whether received id information is believed with the registration ID being stored in id information memory element Breath coupling performs certification.
Storage device the most according to claim 1 and 2, wherein, described id information includes that the medium carrying id information is peculiar The one No. ID and the 2nd No. ID of subsidiary one No. ID, and wherein, described control unit uses certified id information In the one No. ID and/or the 2nd No. ID as key.
Storage device the most according to claim 4, wherein, described radio signal processing unit includes the reading for RFID Take device/write device (R/W), and wherein, described medium carries described id information as the RFID mark that can communicate with described R/W Sign.
Storage device the most according to claim 1 and 2, wherein, described interface is USB interface, and wherein, described data Memory element includes at least one in semiconductor memory and magnetic storage.
CN201280056703.5A 2011-11-19 2012-09-03 Storage device Expired - Fee Related CN103946860B (en)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
JP2011-253368 2011-11-19
JP2011253368 2011-11-19
PCT/JP2012/072303 WO2013073260A1 (en) 2011-11-19 2012-09-03 Storage device

Publications (2)

Publication Number Publication Date
CN103946860A CN103946860A (en) 2014-07-23
CN103946860B true CN103946860B (en) 2016-11-30

Family

ID=

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5742756A (en) * 1996-02-12 1998-04-21 Microsoft Corporation System and method of using smart cards to perform security-critical operations requiring user authorization
US6470082B1 (en) * 1995-06-19 2002-10-22 Nippon Telegraph And Telephone Corporation Communications system using portable recording medium
CN1838138A (en) * 2005-03-25 2006-09-27 富士通株式会社 Authentication system, method of controlling the authentication system, and portable authentication apparatus

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6470082B1 (en) * 1995-06-19 2002-10-22 Nippon Telegraph And Telephone Corporation Communications system using portable recording medium
US5742756A (en) * 1996-02-12 1998-04-21 Microsoft Corporation System and method of using smart cards to perform security-critical operations requiring user authorization
CN1838138A (en) * 2005-03-25 2006-09-27 富士通株式会社 Authentication system, method of controlling the authentication system, and portable authentication apparatus

Similar Documents

Publication Publication Date Title
CN102983886B (en) The security architecture of main storage is used in the design of safety element
US8909944B2 (en) Storage device
US9198037B2 (en) Identification processing apparatus and mobile device using the same
CN101467158A (en) System and method for activating telephone-based payment instrument
JP2007041954A (en) Value information movement system and value information moving method
CN102609750A (en) Intelligent card provided with input device and output device
US20090141896A1 (en) Processing module operating methods, processing modules, and communications systems
JP6363503B2 (en) Information processing system and information processing method
JP4977543B2 (en) Control device, control system, control method, and control program
WO2007093580A1 (en) Smart card with identity checking
CN101414342B (en) Software dog and method for implementing software protection
CN206515828U (en) The data storage device of safety encryption
JP4578132B2 (en) Portable information storage medium system
JP2008269285A (en) System for managing portable storage medium
CN104899496A (en) Data reading method and terminal for same
JP4978180B2 (en) Wireless tag, tag system, wireless tag control method, and management method
CN104573765B (en) Smart card information processing method and processing device
CN103946860B (en) Storage device
CN204576569U (en) Safety digital storage card embedded with intelligent chip and mobile card reading terminal
JP4601498B2 (en) Authentication apparatus, authentication method, program for realizing the method, and recording medium storing the program
WO2007022358A2 (en) Unified reference id mechanism in a multi-application machine readable credential
JP2007183991A (en) Ic card service information displaying system
AU2006203516A1 (en) Unified reference ID mechanism in a multi-application machine readable credential
CN105103180B (en) Method for handling the distribution of mobile credit card
KR20110029033A (en) System and method for issueing public certificate of attestation using usim information and recording medium

Legal Events

Date Code Title Description
PB01 Publication
SE01 Entry into force of request for substantive examination
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20161130

Termination date: 20200903