CN1696865A - Information security equipment and communication method based on MMC/SDIO interface - Google Patents

Abstract

An information safety device makes software copyright protection and information safety based on MMC / SDIO possible by applying CPU to process data and by connecting chip having MMC / SDIO interface, CPU and storage to host with MMC / SDIO interface for communication. The safety device is small in size and low in power consumption so it can be used in hot insertion way as well as in plug and play way.

Description

Information security equipment and communication method based on MMC/SDIO interface

technical field

The invention relates to the design of an information security device and a communication method, in particular to an information security device based on an MMC/SDIO interface and a communication method thereof.

technical background

In today's increasingly developed information technology, the security and confidentiality of data information are increasingly valued by people. Among them, software copyright protection products, as an information security device, play an important role in the field of software copyright protection. It protects the interests of software developers, increases revenue, protects the interests of legitimate users, and can also control software distribution. At the same time, with the development of the Internet, more and more information involving personal privacy and business secrets needs to be transmitted through the network, and the importance of information security is increasingly recognized by people. Information security products are used in network identity authentication, data security storage, access, control, transmission, data encryption and decryption, etc., and have very broad application prospects in e-commerce, e-government, online banking and other fields.

At the same time, MMC (MultiMediaCard) interface and SD (Secure Digital I/O) are two interface standards. Due to the application advantages of small size and easy portability, MMC/SD interface is widely used.

MMC interfaces mainly appear in digital video, music, mobile phones, PDAs, e-books, toys and other products, and are widely used. MMC interface devices can achieve low power consumption, high data throughput, support hot swap, and have good compatibility and reliability. SD cards are widely used in digital home appliances, mobile phones and other industries, and SD interface technology is more and more widely used in people's lives. The SDIO protocol is based on the SD interface, and the SD interface that supports SDIO can also be called the SDIO interface, and all of the following are called SDIO interfaces. SDIO devices support plug and play like USB devices, with high communication speed, and full-speed devices can reach 100Mb/second. Low power consumption, suitable for various mobile devices. Compared with earlier interfaces such as MMC/SDIO and CF, MMC/SDIO is more power-saving and more miniaturized than other early interfaces, and it has become a trend of application.

But at present, there is no device and method for realizing information security protection by using the MMC/SDIO interface, so as to realize functions such as software protection and identity authentication.

Contents of the invention

The invention utilizes many advantages of the MMC/SDIO interface to provide an information security device based on the MMC/SDIO interface with a simple structure and convenient use and a data transmission method through the device.

The technical scheme adopted by the present invention to solve its technical problems is: a kind of information security equipment based on MMC/SDIO interface, comprising

CPU: used to run firmware programs and user programs,

MMC/SDIO interface: used for communication between the device and the host,

Memory: used to store device firmware program, user data and state information, the CPU is connected to the MMC/SDIO interface chip and memory respectively.

It may also include an integrated MCU chip, which integrates the CPU, MMC/SDIO interface chip and memory.

An integrated MCU chip may also be included, and the integrated MCU chip includes the integrated CPU and memory.

The CPU can be a single chip microcomputer.

The memory may include RAM, ROM, EPROM, EEPROM, FLASH.

The MCU chip can be a security designed chip, including a smart card chip.

A data communication method using the above-mentioned equipment, the data transmission process includes the following steps:

1) The host recognizes the device and initializes the device;

2) The host sends commands to the device;

3) The device parses and processes commands;

4) The device returns the result to the host.

When the host sends commands to the device, the host can send the command to the driver in the device CPU, and the driver sends the command to the device through the MMC/SDIO interface in accordance with the requirements of the interface protocol.

The parsing and processing of the command by the device described in step 3) may include the following process:

A. The device receives data from the MMC/SDIO interface;

B. The device performs corresponding operations according to the received data.

In the step B), during the execution of relevant instructions, the operations may include safe storage of data, access control, and data processing.

In the data processing process, the calculation process for data may include custom processing process and standard processing process, and standard processing process may include: RSA, DES, 3DES, MD5, SHA-1, SSF33, AES, elliptic curve algorithm.

The present invention connects and communicates with a host computer with an MMC/SDIO interface by adopting a device including an MMC/SDIO interface chip, a CPU, and a memory, and processes data through the CPU, so that information security and software copyright based on the MMC/SDIO interface are Protection becomes possible, and at the same time, it has the advantages of small and portable, high speed, low power consumption, hot-swappable, and plug-and-play.

Description of drawings

Fig. 1 is the flowchart of embodiment 1 among the present invention

Fig. 2 is the flowchart of embodiment 2 in the present invention

Fig. 3 is the hardware block diagram of embodiment 2

Fig. 4 is the hardware block diagram of embodiment 3

Fig. 5 is the hardware block diagram of embodiment 1

Detailed ways

The first preferred embodiment of the present invention provides a software protection device and a communication method thereof.

As shown in Figure 5, described software protection device 502 comprises MMC/SDIO interface chip 503, CPU 505 and expansion memory 504 that are connected in sequence, and described expansion memory can select arbitrary RAM, ROM, EPROM, FLASH etc. for use Store the corresponding encryption algorithm. The memory should have enough storage space for storing the preset encryption algorithm, or the algorithm can be selected or downloaded by the user. If it is necessary to store part of the user code, it needs to have a large enough storage space, which can be on-chip FLASH, etc.

The firmware program part includes: the identification part of the device, the device waiting for and receiving data from the host, the device parsing and processing the data, the device returning data to the host and waiting for the next instruction, and the part of disconnecting the device from the host. The device is recognized by the host with MMC/SDIO interface, establishes the connection between the host and the device through the information of the registers built into the MCU, and declares it as a certain MMC/SDIO communication type for subsequent communication, the communication part Comply with MMC/SDIO communication protocol completely.

In the above program, the communication part between the device and the host is the core part, and the communication process between the device and the host will be described in detail below in conjunction with Figure 1 .

First, after step 101, the host completes the initialization of the device, and then in step 102, the host verifies the product manufacturer ID of the device. If it is correct, the device executes step 103; otherwise, it goes to step 110 to disconnect the device from the host. Verify the user password in step 103. If it is correct, the device waits for the command from the application to execute step 104, otherwise it also goes to step 110. After receiving the command, the device executes step 104, parses the command and proceeds to step 105 according to different application requirements Data encryption and decryption, or step 106 uses preset codes to perform operations on data. After the data processing is completed, return the data to step 107, wait for the command from the application, if the application no longer responds, then enter step 110, disconnect the connection with the host, otherwise, if there are new commands, then go to step 108 , if it is judged that the communication is over, then execute step 109 to disconnect the device from the host, otherwise go to step 104 and continue to wait for the command to be accepted.

The function of implementing step 106 by using preset codes to calculate data will be further described below.

The appliance acts as a device that provides software encryption. It can be used to save some fragments of user software to ensure the safety of these fragments without being read out, and make them run inside the device and interact with external software, and in turn control the software to ensure its legal operation. The device interacts frequently with external programs, and computing speed and communication speed are important speed performance indicators.

According to the function of this embodiment, the following software protection functions can be realized:

1. Obtain equipment information, this information refers to the information of this device. This information is stored in the internal memory, providing users with the ability to remember and identify their own devices. Such as step 102.

2. Formatting, the user can format the device, and after formatting, all settings and data will be restored to the factory state.

3. Write a file, this type of file includes the user's code fragment, or the data required for the fragment to run.

4. Read the file, this type of file can be the data file when the code segment is running but not the code segment itself.

5. Running files, this kind of files refer to the code fragments written by the user, let these code fragments run in the device and ensure that all the data and memory information of their operation are kept in the device and only return the result.

6. Encryption and decryption, providing users with encryption and decryption of user data RSA, DES, 3DES, etc. inside the hardware, and returning the encryption and decryption results to the user.

The preset code also includes a software protection application interface function. The software protection application interface function is an interface level between the software protection device and a third-party application. This application interface function is mainly used by developers and mainly provides the following functions:

1. Open the device Open the handle of the device and establish a communication channel with the device.

2. Close the device When the device is ready to be no longer used, clear the handle and device status information of the device.

3. Send command This is the core part of this software protection product, which realizes all the settings of the device, that is, the realization of all software protection functions.

The main function of the software protection device is to protect the program part from appearing in the memory of the host computer. The benefits brought by this are:

1. To prevent illegal copying of the program, the program on the host is incomplete without the software protection key, and the software distribution must have the existence of the software protection key.

2. To prevent the program from being illegally tracked or debugged, the code of an important part of the software will not run in the host, and all debugging software cannot obtain the running status of this segment of the program.

3. To prevent being dumped, the most vulnerable situation for software to be cracked is when it is running. Traditional packaged protection software often restores the code when it is dumped by memory.

4. Prevent decompilation, no matter how high the technology of decompilation is, the code fragments inside the device of this embodiment cannot be obtained, so the complete functions of the software itself cannot be realized.

The second preferred embodiment of the present invention provides a user identification device and a communication method thereof. It is mainly responsible for saving user sensitive data, such as passwords, digital certificates, etc.

The hardware part of the identity recognition device is as shown in Figure 3, 301 among the figure is a host, 302 is an identity recognition device, 303 is an MCU arranged in the identity recognition device, and the inside of the MCU integrates a CPU and an MMC/SDIO interface A chip and a RAM memory in which the algorithm is built. There should be enough on-chip RAM space in the MCU for preset algorithms, including RSA, DES, 3DES, MD5 algorithms, etc., or the algorithm can be selected or downloaded by the user. If you need to store part of the user code, it needs to be large enough The storage space can be on-chip FLASH, etc. It can be realized by using Intel xscale series chips, or STR710 series and STR720 series.

The firmware program part of the identification device can combine smart card technology and modern cryptography technology, can support third-party algorithm download, and support multi-level file management and access.

As shown in flow chart 2. The overall function is as follows: in step 201 in Figure 2, the host completes the initialization of the identity recognition device; in step 202, the identity recognition device obtains the password A entered by the user; in step 203, the identity recognition device reads the password from the password storage area and passes a specific If B is obtained through processing, A and B are compared in step 204. If they are different, the identity authentication fails. Go to step 211. The identity recognition device disconnects the connection with the host. If they are the same, the identity recognition device assigns a certain authority to the user, so The authority is associated with the user's password level, and the user can perform application-side operations within the scope of the authorized identity, that is, the identity recognition device receives commands from the application as in step 205, and parses the commands as in step 206. Data encryption processing and steps 207 calculates the data with preset codes, then returns to the application, and then executes step 208 to continue waiting for commands from the application. If there is no legal response from the application, go to step 211 to disconnect the device from the host, otherwise receive the command from the application layer, if it is judged through step 208 that the communication ends, then go to step 210 to disconnect and end the communication process normally. Otherwise, go to step 205 and continue to execute. The three modules of step 202, step 203, and step 204 can also directly read the password from the identification device, and the host side determines whether the password is correct.

This embodiment can realize the following functions including:

1. Control access to the network: use the ID information and user verification information contained in the identification device to log in to the network.

2. The digital signature or certificate used to verify and authenticate the identity of the sender of the file, and prevent it from being tampered with in the middle.

3. Store password information, store user password information, and prevent risks caused by users manually entering passwords.

4. Remote login, the bank's website can use the signature information to identify the legitimacy of the user.

5. To control the access of files, access control information can be added to some files, which can prevent illegal access or operation in the case of identification equipment.

6. Control login to a specific application system. Developers can use this function for their own products, and this product can use the device of this embodiment to log in.

The above 3 means that the password information contained in the identification device is sent to the host to identify the lock holder information.

The preset code also includes the identity recognition device application interface function, the identity recognition device application interface function is the interface level between the identity recognition device and the third party application, this application interface function is mainly used by developers, the application interface The function mainly provides the following functions:

1. Open the device Open the handle of the device and establish a communication channel with the device.

2. Close the device When the device is no longer used, the handle and device status information of the device will be cleared.

3. Send command This is the core part of the identification device, which realizes all the setting work of the device, that is, the realization of the smart card function of all the identification devices.

The main function of the digital identification device is to protect important and sensitive data from being read out of the key device such as the memory of the host. The benefits brought by this are:

1. Users do not need to memorize lengthy passwords. A secure password must have a sufficiently complex string of letters and numbers, and it must be updated frequently. Using an identification device to store password information can save users trouble.

2. Provide two-factor authentication insurance measures, even if the user's password or one of the digital identification devices is lost, it will not bring risks to the user.

3. The key cannot be exported, which ensures the security of the user key.

4. Built-in algorithm.

The third embodiment of the present invention provides another identity recognition device, as shown in Figure 4, the identity recognition device 402 is provided with an MMC/SDIO interface chip 403, and integrated CPU and memory connected thereto The MCU404 is connected with the host 401 by the MMC/SDIO interface chip, which is mainly used to complete the translation of the MMC/SDIO interface protocol, so that the realization of the MCU part 404 can be simpler, and the interface chip 403 can be configured with the AC21C00 SDIO Controller of ARASAN Realized by common MCU.

The communication between the host computer and the device in this embodiment is exactly the same as that in Embodiment 2, and realizes the same

Embodiment 2 has the same function.

A data communication method based on the MMC/SDIO interface that realizes software copyright protection and information security provided by the present invention has been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The descriptions of the above embodiments are only used to help understand the method of the present invention and its realization ideas; at the same time, for those of ordinary skill in the art, according to the ideas of the present invention, there will be changes in the specific implementation and application scope. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims (10)

1. An information security device based on an MMC/SDIO interface, characterized in that: comprising CPU: used to run firmware programs and user programs, MMC/SDIO interface chip: used for communication between the device and the host, Memory: used to store device firmware programs and user data and status information, The CPU is connected to the MMC/SDIO interface chip and memory respectively. 2. The information security device based on the MMC/SDIO interface according to claim 1, characterized in that: it includes an integrated MCU chip, and the integrated MCU chip integrates the CPU, MMC/SDIO interface chip and memory. 3. The MMC/SDIO interface-based information security device according to claim 1, characterized in that it includes an integrated MCU chip, and the integrated MCU chip includes the integrated CPU and memory. 4. The MMC/SDIO interface-based information security device according to claim 2 or 3, characterized in that: the MCU chip is a security-designed chip, including a smart card chip. 5. The information security device based on MMC/SDIO interface according to claim 1, 2 or 3, characterized in that: the CPU is a single-chip microcomputer, and the memory includes RAM, ROM, EPROM, EEPROM, and FLASH. 6. A method for data communication using an information security device based on an MMC/SDIO interface, characterized in that: the data transmission process includes the following steps: 1) The host recognizes the device and initializes the device; 2) The host sends commands to the device; 3) The device parses and processes commands; 4) The device returns the result to the host. 7. The data communication method according to claim 6, characterized in that: the host sends instructions to the device through the MMC/SDIO interface in accordance with the requirements of the interface protocol. 8. The data communication method according to claim 6 or 7, characterized in that: the parsing and processing of the command by the device in the step 3) includes the following process: A) The device receives data from the MMC/SDIO interface; B) The device performs corresponding operations according to the received data. 9. The data communication method according to claim 8, characterized in that: in the step B), during the execution of corresponding operations, the operations include safe storage of data, access control, and data processing. 10. The data communication method according to claim 9, characterized in that: in the data processing process, the calculation and processing of data includes self-defined processing process and standard processing process, and the standard processing process includes: RSA, DES, 3DES, MD5, SHA-1, SSF33, AES, elliptic curve algorithm.

Images