CN115098897A - Data storage device and method - Google Patents

Abstract

A data storage device and method, wherein the device comprises: a storage medium; a central processing unit configured to store a bootstrap program of the storage medium and first partition data in the storage medium, the first partition The data includes: authentication data and authentication status; under the condition that the startup condition is satisfied, load the startup bootstrap program of the storage medium and boot the storage medium according to the bootstrap program, and load the first partition data and start the storage medium according to the bootstrap program. The authentication data completes the authentication operation, and the authentication state is updated according to the result of the authentication operation, so as to avoid implementing authentication by adding an external authentication device or installing a driver.

Description

A data storage device and method

technical field

This article relates to data storage technology, especially to a data storage device and method.

Background technique

To ensure data security on the data storage device, it is necessary to perform identity authentication on users accessing the data storage device. At present, in order to realize the user's identity authentication operation, it is necessary to install an external authentication device or a private driver of the device; installing an external authentication device will increase the user's use cost and device power consumption; installing a driver will involve installation The permission problem of the driver and the permission problem of accessing the driver are inconvenient to use.

SUMMARY OF THE INVENTION

The present application provides a data storage device and method, which can realize the authentication operation, and avoids realizing the authentication by adding an external authentication device or installing a driver.

A data storage device provided by this application includes:

storage medium;

a central processing unit, configured to store a bootstrap program of the storage medium and first partition data in the storage medium, where the first partition data includes: authentication data and an authentication state; in the case of satisfying the startup condition , load the bootstrap program of the storage medium and start the storage medium according to the bootstrap program, and load the first partition data and complete the authentication operation according to the authentication data, and update according to the result of the authentication operation the authentication state.

In an exemplary embodiment, the data storage device further includes: an interface for data interaction with an external device;

The central processing unit is configured to complete the authentication operation according to the authentication data and update the authentication state according to the result of the authentication operation, including:

After detecting the write operation to the first partition through the interface, determine whether the authentication data written through the write operation is consistent with the authentication data loaded in the first partition data, and if they are consistent , the authentication status is updated to pass the authentication.

In an exemplary embodiment, the first partition data further includes: configuration data;

The central processing unit is further configured to perform corresponding operations on the other partitions of the storage medium according to the updated authentication state and the configuration data after receiving the read and write instructions for the data of other partitions of the storage medium through the interface.

In an exemplary embodiment, the configuration data includes: whether the condition for performing read and write operations on data in other partitions of the storage medium is that the authentication is passed;

The central processing unit performs corresponding operations on other partitions of the storage medium according to the updated authentication state and the configuration data, including:

When the condition for performing read and write operations on the data of other partitions of the storage medium is that the authentication is passed, only when the authentication state is that the authentication is passed, the corresponding read and write operations are performed for other partitions of the corresponding storage medium according to the configuration data;

When the condition for reading and writing data of other partitions of the storage medium is that the authentication fails, and when the authentication status is that the authentication passes or the authentication fails, the corresponding read and write operations are performed for other partitions of the corresponding storage medium according to the configuration data. write operation.

In an exemplary embodiment, the configuration data further includes: indication information on whether encryption is required to read and write data in other partitions of the storage medium, and an encryption key;

Described central processing unit, when the condition that the read-write operation is performed to other partition data of the storage medium is that the authentication passes, and only when the authentication state is that the authentication passes, executes the corresponding other partitions of the corresponding storage medium according to the configuration data. Read and write operations, including:

When the authentication state is that the authentication has passed, and the corresponding read and write operations are performed on other partitions of the corresponding storage medium, and the read and write needs to be encrypted, the read and write data is decrypted according to the encryption key.

In an exemplary embodiment, the central processing unit is further configured to, after receiving the configuration instruction through the interface, under the condition that the authentication status is authentication passed, perform the configuration instruction according to the configuration instruction. Data is modified and stored.

In an exemplary embodiment, the central processing unit includes:

a flash memory unit, configured to store the bootstrap program of the storage medium and the first partition data in the storage medium;

random access storage unit;

The processor unit is configured to read the data stored in the flash memory unit to the random access storage unit, load the bootstrap program of the storage medium from the random access storage unit, and the first partition data; and modifying and storing the configuration data stored in the flash memory unit and the random access storage unit respectively according to the configuration instruction under the condition that the authentication state is authentication passed.

The embodiment of the present application also provides a method for data storage using the data storage device described in any preceding item, the method comprising:

Loading the bootstrap program of the storage medium and the first partition data in the storage medium under the condition that the startup condition is satisfied;

Start the storage medium according to the startup boot program;

Complete the authentication operation according to the authentication data in the first partition data and update the authentication state according to the result of the authentication operation;

When the authentication status is that the authentication is passed, the data storage operation is performed.

In an exemplary embodiment, completing the authentication operation according to the authentication data in the first partition data and updating the authentication state according to the result of the authentication operation, including:

After detecting the write operation to the first partition, it is judged whether the authentication data written through the write operation is consistent with the authentication data in the loaded first partition data, and if they are consistent, the The authentication status is updated to the authentication passed.

In an exemplary embodiment, when the first partition data includes configuration data, the method further includes:

After receiving the read and write instructions for the data of other partitions of the storage medium, perform corresponding operations on the other partitions of the storage medium according to the updated authentication state and the configuration data.

Compared with the related art, the data storage device provided by the embodiment of the present application can realize the self-starting of the data storage device by loading the startup boot program of the storage medium with its own central processing unit, and it is not necessary to install an additional startup driver. and the central processing unit can store the authentication data and complete the self-loading of the authentication data, thereby realizing the self-authentication function of the data storage device.

Other features and advantages of the present application will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the present application. Other advantages of the present application may be realized and attained by the approaches described in the specification and drawings.

Description of drawings

The accompanying drawings are used to provide an understanding of the technical solutions of the present application, and constitute a part of the specification. They are used to explain the technical solutions of the present application together with the embodiments of the present application, and do not constitute a limitation on the technical solutions of the present application.

1 is a structural diagram of a data storage device provided by an embodiment of the present application;

FIG. 2 is a structural diagram of another data storage device provided by an embodiment of the present application;

3 is a structural diagram of another data storage device provided by an embodiment of the present application;

4 is a flowchart of a data storage method provided by an embodiment of the present application;

5 is a flowchart of a data storage method provided by the application example of this application;

FIG. 6 is a flowchart of a data reading and writing method provided by an application example of this application.

Detailed ways

This application describes a number of embodiments, but the description is exemplary rather than restrictive, and it will be apparent to those of ordinary skill in the art that within the scope of the embodiments described in this application can be There are many more examples and implementations. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are possible. Unless expressly limited, any feature or element of any embodiment may be used in combination with, or may be substituted for, any other feature or element of any other embodiment.

This application includes and contemplates combinations with features and elements known to those of ordinary skill in the art. The embodiments, features and elements that have been disclosed in this application can also be combined with any conventional features or elements to form unique inventive solutions as defined by the claims. Any features or elements of any embodiment may also be combined with features or elements from other inventive arrangements to form another unique inventive arrangement defined by the claims. Accordingly, it should be understood that any of the features shown and/or discussed in this application may be implemented alone or in any suitable combination. Accordingly, the embodiments are not to be limited except in accordance with the appended claims and their equivalents. Furthermore, various modifications and changes may be made within the scope of the appended claims.

Furthermore, in describing representative embodiments, the specification may have presented methods and/or processes as a particular sequence of steps. However, to the extent that the method or process does not depend on the specific order of steps described herein, the method or process should not be limited to the specific order of steps described. Other sequences of steps are possible, as will be understood by those of ordinary skill in the art. Therefore, the specific order of steps set forth in the specification should not be construed as limitations on the claims. Furthermore, the claims directed to the method and/or process should not be limited to performing their steps in the order written, as those skilled in the art will readily appreciate that these orders may be varied and still remain within the spirit and scope of the embodiments of the present application Inside.

An embodiment of the present application provides a data storage device, as shown in FIG. 1 , the device includes:

Storage medium 101

central processing unit 102;

The storage medium 101 is a medium for storing data, which can be Nand Flash, Nor Flash, embedded multimedia card EMMC, hard disk, etc.;

The central processing unit 102 may be a micro control unit (Micro Controller Unit; MCU) with an encryption algorithm function, and the central processing unit 102 is configured to store the bootstrap program of the storage medium 101 and the first step in the storage medium 101 . A partition data, the first partition data includes: authentication data and authentication status; in the case of satisfying the startup condition, loading the bootstrap program of the storage medium 101 and booting the storage medium 101 according to the bootstrap program , and load the first partition data and complete the authentication operation according to the authentication data, and update the authentication state according to the result of the authentication operation;

Wherein, the start condition may be power-on start, or receiving an instruction to start.

The data storage device described in the embodiment of the present application can realize the self-starting of the data storage device by loading the startup boot program of the storage medium with its own central processing unit, without installing an additional startup driver; and the central processing unit The device can store the authentication data and complete the self-loading of the authentication data, realizing the self-authentication function of the data storage device.

As an exemplary embodiment, as shown in FIG. 2 , the data storage device may further include: an interface 103 for data interaction with an external device; the interface 103 may be a USB interface, an SD interface, or an MMC interface, etc.;

The central processing unit 102 is configured to complete the authentication operation according to the authentication data and update the authentication state according to the result of the authentication operation, including:

After detecting the write operation to the first partition through the interface 103, it is determined whether the authentication data written through the write operation is consistent with the authentication data in the loaded first partition data, if If they are consistent, the authentication status is updated to pass the authentication.

In an exemplary embodiment, the first partition data further includes: configuration data;

The central processing unit 102 is further configured to, after receiving the read and write instructions for other partition data of the storage medium 101 through the interface 103, perform other operations on the storage medium 101 according to the updated authentication state and the configuration data. The partition performs the corresponding operation.

The storage medium 101 can be divided into 4 partitions, namely the first partition, the second partition, the third partition and the fourth partition;

The first partition is used to store authentication data, authentication status, and configuration data; the authentication data can include user names and keys, and can be stored in the login.txt file; the authentication status can be stored in status.txt file; the configuration data can be stored in the config.txt file; the first partition data is stored in the central processing unit;

The second to fourth partitions are used to store user data; the second to fourth partitions are stored in a storage medium; in this embodiment of the application, the authentication data and the user data are placed in different partitions, Therefore, the format of the user data area will not be limited, and it can be formatted as FAT32, exFAT, ext4, NTFS, etc.

In an exemplary embodiment, the types of configuration data may include:

The modified username and key, the username and key can be stored in the form of a hash value; the hash algorithm can be SHA256 or SM3, etc.;

Authentication mode, you can configure the authentication data to be presented in plaintext or in the form of hash value when logging in;

The maximum number of retries for authentication failures, and the device will be locked after the number of consecutive authentication failures exceeds the maximum number of retries for the described authentication failures;

Encryption and decryption algorithm type, set the encryption and decryption algorithm when writing/reading data, such as symmetric algorithms such as SM4/AES;

Generate/import the key, which is the encryption/decryption key when writing/reading data;

The working mode of other partitions, whether the data of the second partition to the fourth partition is encrypted when writing data, and whether it is decrypted when reading data;

Access rights of other partitions, whether the data from the second partition to the fourth partition need to be authenticated before they can be accessed.

In an exemplary embodiment, when the configuration data is: whether the condition for performing read and write operations on other partition data of the storage medium 101 is authentication passed, the central processing unit 102, according to the updated authentication status and The configuration data performs corresponding operations on other partitions of the storage medium 101, including:

When the condition of the read and write operations on other partition data of the storage medium 101 is that the authentication is passed, the corresponding read and write operations are performed on other partitions of the corresponding storage medium 101 according to the configuration data only when the authentication state is the authentication passed. operate;

When the condition of the read/write operation for other partition data of the storage medium 101 is that the authentication fails, and when the authentication status is that the authentication passes or the authentication fails, all other partitions of the corresponding storage medium 101 are processed according to the configuration data according to the configuration data. Perform the corresponding read and write operations.

In an exemplary embodiment, when the configuration data is: information indicating whether encryption is required for reading and writing data of other partitions of the storage medium 101, and an encryption key, the central processing unit 102, when the storage medium 101 The condition for other partition data to perform read and write operations is that the authentication passes, and only when the authentication state is that the authentication passes, the corresponding read and write operations are performed for other partitions of the corresponding storage medium 101 according to the configuration data, including:

When the authentication status is the authentication passed, and the corresponding read and write operations are performed on other partitions of the corresponding storage medium 101 and the read and write needs to be encrypted, the read and write data is decrypted according to the encryption key.

In an exemplary embodiment, the central processing unit 102 is further configured to, after receiving the configuration instruction through the interface 103, under the condition that the authentication status is authentication passed, perform the configuration instruction according to the configuration instruction. Data is modified and stored.

In an exemplary embodiment, as shown in FIG. 3 , the central processing unit 102 includes:

The flash memory unit 1021 is configured to store the bootstrap program of the storage medium and the first partition data in the storage medium;

random access storage unit 1022;

The processor unit 1023 is configured to read the data stored in the flash memory unit 1021 to the random access storage unit 1022, and load the storage medium from the random access storage unit 1022 when the startup condition is satisfied. Start the bootstrap program and the first partition data; and under the condition that the authentication state is authentication passed, the configuration stored in the flash memory unit 1021 and the random access storage unit 1022 respectively according to the configuration instruction Data is modified and stored.

In this embodiment of the present application, key information such as the startup boot program, authentication data, and configuration data of the storage medium is stored in the flash memory unit, and the data accessed by the user is the data read from the flash memory unit to the random access storage unit after startup , so even if the data is formatted by the user or deleted by mistake, it can still be recovered after restarting, with high reliability.

An embodiment of the present application further provides a method for data storage based on the data storage device described in the foregoing embodiment, as shown in FIG. 4 , the method includes:

Step S401 loads the bootstrap program of the storage medium and the first partition data in the storage medium under the condition that the startup condition is satisfied;

Step S402 starts the storage medium according to the startup boot program;

Step S403 completes the authentication operation according to the authentication data in the first partition data, and updates the authentication state according to the result of the authentication operation;

In step S404, when the authentication status is that the authentication is passed, a data storage operation is performed.

In an exemplary embodiment, step S403 completes the authentication operation according to the authentication data in the first partition data and updates the authentication state according to the result of the authentication operation, including:

After detecting the write operation to the first partition, it is judged whether the authentication data written through the write operation is consistent with the authentication data in the loaded first partition data, and if they are consistent, the The authentication status is updated to the authentication passed.

In an exemplary embodiment, when the first partition data includes configuration data, the method further includes:

After receiving the read and write instructions for the data of other partitions of the storage medium, perform corresponding operations on the other partitions of the storage medium according to the updated authentication state and the configuration data.

The data storage method described in the embodiment of the present application will be described below with a specific application example.

Taking reading and writing the second partition as an example, the authentication data of the first partition (control partition) is stored in the file login.txt, the configuration data is stored in config.txt, the authentication status is stored in status.txt, and the second partition is configured as authentication. After the authorization, it can read and write, write data encryption, and read data decryption, as shown in Figure 5;

Step 501 starts the device, and loads the startup boot program MBR of the storage medium and the data of the first partition into the RAM space from the Flash;

Step 502 generates 2 disk files after reading the MBR, taking the operating system of the Linux kernel as an example, the files corresponding to the 2 partitions of the device will appear under the /dev path;

Step 503: After the host user mounts the first partition, receive the user name and password written by the user to the login.txt file of the first partition;

Step 504, after detecting the user's write operation to the first partition, determine whether the written file is the login.txt file, if so, convert the written content into a hash value, and compare the written hash value with the saved user name Whether the hash value and the password hash value are consistent; if they are consistent, go to step S505; if they are inconsistent, go to step S506;

Step 505, the authentication is passed, and the user's data read and write operation instruction is received;

After the authentication is passed, the user will obtain the permission to modify the configuration file config.txt of the first partition and read and write other partitions, wherein the configuration file of the first partition can be used to modify the user name, password information, authentication mode, Configuration functions such as encryption algorithm type, modification key, authentication mode, maximum number of retries for authentication failure, and access rights for other partitions. Taking the second partition as an example, if the user configures the Decryption of read data: As shown in Figure 6, the received data written by the user to the second partition will be encrypted first, and then converted into ciphertext input and then written to the storage medium; the received user reads data from the second partition After the data fetch instruction, the data read from the storage medium will be decrypted, and then the decrypted data will be sent to the user;

In step S506, if the authentication fails, the number of times of failure of the authentication operation is recorded. If the authentication is not passed, even if the user initiates a read and write operation on the second partition, the device will not actually read and write the storage medium, such as reading and writing. The operation directly returns 0 data, and the write operation returns failure.

Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, functional modules/units in the systems, and devices can be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those of ordinary skill in the art, the term computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer. In addition, communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .

Claims (10)

1. A data storage device, comprising:

a storage medium;

a central processing unit configured to store a boot program for starting the storage medium and first partition data in the storage medium, the first partition data including: authentication data and authentication status; and loading a starting bootstrap program of the storage medium, starting the storage medium according to the bootstrap program, loading the first partition data, completing authentication operation according to the authentication data and updating the authentication state according to the result of the authentication operation under the condition of meeting the starting condition.

2. The data storage device of claim 1,

the data storage device further comprises: an interface for data interaction with an external device;

the central processing unit is configured to complete authentication operation according to the authentication data and update the authentication state according to the result of the authentication operation, and comprises:

after the interface detects the write operation to the first partition, whether the authentication data written by the write operation is consistent with the authentication data in the loaded first partition data is judged, and if so, the authentication state is updated to be authenticated.

3. The data storage device of claim 2,

the first partition data further includes: configuring data;

the central processing unit is also configured to execute corresponding operations on other partitions of the storage medium according to the updated authentication state and the configuration data after receiving the read-write instruction of the data of other partitions of the storage medium through the interface.

4. The data storage device of claim 3,

the configuration data includes: whether the condition of performing read-write operation on other partition data of the storage medium is that authentication is passed or not is judged;

the central processing unit executes corresponding operations to other partitions of the storage medium according to the updated authentication state and the configuration data, and the operations comprise:

when the condition of performing read-write operation on the data of other partitions of the storage medium is that authentication is passed, corresponding read-write operation is performed on the other partitions of the corresponding storage medium according to the configuration data only when the authentication state is that the authentication is passed;

and when the condition for performing the read-write operation on the data of other partitions of the storage medium is that the authentication is not passed, and when the authentication state is that the authentication is passed or the authentication is not passed, performing corresponding read-write operation on the other partitions of the corresponding storage medium according to the configuration data.

5. The data storage device of claim 4,

the configuration data further comprises: indication information indicating whether the read-write of other partition data of the storage medium needs to be encrypted or not and an encryption key;

the central processing unit, when the condition of performing the read-write operation on the data of other partitions of the storage medium is that the authentication is passed, only when the authentication state is that the authentication is passed, performs corresponding read-write operation on the corresponding other partitions of the storage medium according to the configuration data, including:

and when the authentication state is authentication passing, corresponding read-write operation is executed on other partitions of the corresponding storage medium, and the read-write operation needs to be encrypted, performing decryption processing on the read-write data according to the encryption key.

6. The data storage device of any of claims 3 to 5,

the central processing unit is also configured to modify and store the configuration data according to the configuration instruction under the condition that the authentication state is authentication passing after receiving the configuration instruction through the interface.

7. The data storage device of claim 6,

the central processing unit includes:

a flash memory unit configured to store a boot program for the storage medium and first partition data in the storage medium;

a random access memory cell;

the processor unit is used for reading the data stored in the flash memory unit to the random access memory unit and loading a boot program of the storage medium and the first partition data from the random access memory unit under the condition that a starting condition is met; and modifying and storing the configuration data stored in the flash memory unit and the random access memory unit according to the configuration command under the condition that the authentication state is authenticated.

8. A method of data storage using a data storage device as claimed in any one of claims 1 to 7, the method comprising:

loading a boot program of a storage medium and first partition data in the storage medium under the condition that a starting condition is met;

starting the storage medium according to the starting bootstrap program;

finishing authentication operation according to the authentication data in the first partition data and updating the authentication state according to the result of the authentication operation;

and when the authentication state is that the authentication is passed, performing data storage operation.

9. The method of claim 8,

finishing authentication operation according to the authentication data in the first partition data and updating the authentication state according to the result of the authentication operation, including:

and after the write operation on the first partition is detected, judging whether the authentication data written through the write operation is consistent with the authentication data in the loaded first partition data, and if so, updating the authentication state to be authenticated.

10. The method of claim 9,

when the first partition data comprises configuration data, the method further comprises:

and after receiving a read-write instruction of the data of other partitions of the storage medium, executing corresponding operation on the other partitions of the storage medium according to the updated authentication state and the configuration data.

Images