CN1210654C - Safety data storage equipment and method for preventing data lest in data transaction system - Google Patents
Safety data storage equipment and method for preventing data lest in data transaction system Download PDFInfo
- Publication number
- CN1210654C CN1210654C CN 02117970 CN02117970A CN1210654C CN 1210654 C CN1210654 C CN 1210654C CN 02117970 CN02117970 CN 02117970 CN 02117970 A CN02117970 A CN 02117970A CN 1210654 C CN1210654 C CN 1210654C
- Authority
- CN
- China
- Prior art keywords
- data
- module
- cpu
- secure storage
- storage module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The present invention discloses a safety data storage device and a method for preventing data in a data transaction system from losing. The safety data storage device comprises a CPU module, a data storage module and a system interface circuit, wherein the CPU module is directly connected with the system interface circuit; the CPU module is connected with the data storage module through signal wires. The present invention is characterized in that the safety data storage device comprises a safety storage module which comprises a CPU, a read-write memory, a static memory RAM and an interface circuit; the CPU of the safety storage module is directly connected with the interface circuit of the safety storage module; the CPU is connected with the read-write memory and the RAM through signal wires; the safety storage module is directly connected with the CPU module through the interface circuit of the safety storage module. The present invention has the characteristics that the safety storage device is used for safely storing and recovering data, the data can not be lost, and the system is normally operated.
Description
Technical field
The present invention relates to the data storage device of data transacting system, particularly a kind of safety storage apparatus and method that prevents the data transacting system loss of data.
Background technology
At present, the structure of the data storage device that data transacting system generally adopts is referring to Fig. 1, prior art data storage device structural drawing.This data storage device mainly by the CPU module 102 that is used to carry out Data Control, be used to store the data memory module 103 of data and the system interface circuit 101 that is used for communicating with data transacting system is formed, this CPU module 102 directly links to each other with system interface circuit 101, and this CPU module links to each other with data memory module 103 by signal wire, wherein adopt data memory module 103 (FLASH MEMORY, be called for short FMEM) come memory system data, it includes only FLASH storer 1031 and the interface circuit 1032 with data storage function.
The process of this device data storage, referring to Fig. 2 prior art data storage process flow diagram, at first, execution in step 201 is when the CPU module detects instruction data storage; Execution in step 202 again, and the CPU module receives data through the system interface circuit; Execution in step 203 again, in the temporary static data memory RAM (not shown in figure 1) in the CPU module of data; Execution in step 204 again, and RAM calculates earlier and verification Cyclic Redundancy Code CRC, and execution in step 205 again, calculate and checking authentication of message sign indicating number MAC; To be checked measure result of calculation correct after, execution in step 206 again, the CPU in the CPU module carries out cryptographic calculation with the secret key cryptographic algorithm of self to data, enciphered data is sent in the FLASH storer by the interface circuit in the data memory module stores;
The process of reading of data, referring to Fig. 3 prior art data read process flow diagram, at first execution in step 301, when the CPU module detects the data read instruction; Execution in step 302 again, and the CPU module is read the data in the FLASH storer in the data memory module through interface circuit; Execution in step 303 again, and the data of reading are temporary in RAM; Execution in step 304 CPU modules are decrypted data again, output to data transacting system by the system interface circuit.
After though this encrypted memory device has taked the encryption function of use CPU module that data are carried out encryption, again enciphered data is deposited the encryption storage means of data memory module, but it can only realize the function of the storage of data, can not guarantee system data destroyed or FMEM in FLASH during by maliciously damage, data are not lost with data and are recovered.This shows that at present the data storage device self of data transacting system does not have restorability, after being subjected to outside world or other and destroying operation, can not the recovery system data, make data transacting system recover normal operation.
Summary of the invention
In view of this, fundamental purpose of the present invention is to provide a kind of safety storage apparatus and method that prevents the data transacting system loss of data.Guarantee when system data is destroyed, can the recovery system data and loopback give system, thereby system recovery is normally moved.
An aspect according to above-mentioned purpose, the invention provides a kind of safety storage apparatus that prevents the data transacting system loss of data, comprise a CPU module that is used to carry out Data Control, one is used to the system interface circuit storing the data memory module of data and be used for communicating with data transacting system, this CPU module directly links to each other with the system interface circuit, and this CPU module links to each other with data memory module by signal wire, it is characterized in that: described equipment further comprises a secure storage module that is used for data backup and data recovery, described secure storage module comprises the CPU of a control data storage or data recovery, a read-write memory that is used for data backup, a static memory RAM who is used for temporal data, with the interface circuit that is used for communicating with the CPU module, the CPU of described secure storage module directly links to each other with its interface circuit, and this CPU links to each other with RAM with read-write memory by signal wire; Described secure storage module directly links to each other with the CPU module by its interface circuit.
CPU in the secure storage module wherein can be the CPU of common grade; Or CPU with self-encryption function; Or has the CPU of self-encryption function and private key simultaneously.
And this secure storage module may further include one and is used for when the data transacting system power down, is the standby power supply of RAM power supply.
The interface circuit of this secure storage module can link to each other with the serial ports of CPU module.
This secure storage module can be circuit-board card, also it can be installed in the seal casinghousing, and interface circuit can be the circuit board interface connector.
Safety storage apparatus of the present invention can be circuit-board card, and its system interface circuit can be the circuit board interface connector; Also it can be installed in the housing, its system interface circuit can be the standard IDE interface.
According to above-mentioned purpose on the other hand, the invention provides a kind of method that prevents the data transacting system loss of data, it is characterized in that: use an above-mentioned safety storage apparatus that data are carried out safe storage and data recovery, the process of its safe storage comprises following step at least:
1) data of data transacting system send in the CPU module by the system interface circuit, after the CPU module receives data, earlier with data storage in data memory module;
2) the CPU module with the data that receive, sends to the CPU in the secure storage module again, and this CPU is temporary in the RAM of secure storage module with data;
3) CPU of secure storage module again with the data storage among the RAM in the read-write memory of secure storage module;
The process that its data are recovered comprises following step at least:
When 4) the CPU module detected data in the data memory module and destroyed, the log-on data recovery operation was carried out the bidirectional identification checking by instruction between CPU module and the secure storage module;
5) integrality and the legitimacy of data in the read-write memory in the CPU module check secure storage module;
6) CPU of secure storage module reads the data in the read-write memory, and is temporary in the RAM of secure storage module;
The data of 7) reading send to the CPU module by interface circuit, the CPU module with this data storage in data memory module.
Wherein, the step 2 of this method) can also comprise that RAM calculates and verification Cyclic Redundancy Code CRC data, and calculate and checking authentication of message sign indicating number MAC.
The CPU that the step 3) of this method can further include secure storage module adopts key and cryptographic algorithm to carry out encryption to data or adopts the CPU with self-encryption function to carry out encryption or adopt the CPU that has self-encryption function and private key simultaneously to carry out encryption; The CPU that also may further include secure storage module with step 6) is decrypted the The data key in the read-write memory and decipherment algorithm and handles or adopt the CPU with self-encryption function to be decrypted to handle or adopt the CPU that has self-encryption function and private key simultaneously to be decrypted processing.
By such scheme as can be seen, key of the present invention is: use a secure storage module in safety storage apparatus, the system data back-up that the CPU of this module sends system by interface circuit is in read-write memory, when system data suffers extraneous destruction, data in the read-write memory are recovered also loopback give safety storage apparatus, the assurance data are not lost, and can make the system recovery operate as normal.
Therefore, safety storage apparatus and the method that prevents the data transacting system loss of data provided by the present invention.Data are done carrying out safety backup, in case system is destroyed by malicious attack, can fetch backed up data from secure storage module wherein, the recovery system operate as normal has guaranteed that system data do not lose, and has improved safety of data, reliability.
Description of drawings
Fig. 1 is the data storage device structural representation of prior art.
Fig. 2 is a prior art data storage process flow diagram.
Fig. 3 is a prior art data read process flow diagram.
Fig. 4 is the structural representation of safety storage apparatus of the present invention.
Fig. 5 is the structural representation of a preferred embodiment of the present invention.
Fig. 6 is the structural representation of the secure storage module 506 of preferred embodiment shown in Figure 5.
Fig. 7 is the data storage process flow diagram of preferred embodiment shown in Figure 5.
Fig. 8 is the data read process flow diagram of preferred embodiment shown in Figure 5.
Embodiment
For making the purpose, technical solutions and advantages of the present invention clearer, by the following examples, and with reference to accompanying drawing, the present invention is described in more detail.
Referring to Fig. 4, the structural representation of safety storage apparatus of the present invention.Among Fig. 4, comprise the CPU module 102 that is used for Data Control, data memory module (the FLASH MEMORY that is used to store data at the legacy data memory device, be called for short FMEM) 103 and be used for the basis of the system interface circuit 101 that communicates with data transacting system, increased secure storage module (SAFE MEMORY, be called for short SMEM) 404, this CPU module 102 directly links to each other with system interface circuit 101, and links to each other with FMEM103 and SMEM module 404 by signal wire; This SMEM module 404 plays secure data backup in safety storage apparatus, in case system is destroyed by malicious attack, can fetch backed up data from secure storage module, has guaranteed that like this data do not lose, and can make the system recovery operate as normal.
Referring to Fig. 5, the structural representation of a preferred embodiment of the present invention.Safety storage apparatus of the present invention can be circuit-board card, and its system interface circuit can be the circuit board interface connector; Also it can be installed in the housing, its system interface circuit can be the standard IDE interface.The safety storage apparatus of present embodiment is the modularization data vault that is used for dispenser system, and it is a kind of equipment that the IC-card data are carried out the safety encipher storage, has adopted the form that is installed in a housing, links to each other with dispenser system by the standard IDE interface.As shown in Figure 5, the legacy data strong-room has comprised 503, one of data memory modules (FMEM module) that a safe CPU module that is used to carry out Data Control 502, one be used to store data and has been used to read device and gets the IC standard card reader 504 of IC-card, be used for the ide interface 501 and the power interface 505 that communicate with dispenser system, in order further to improve and strengthen the security of data vault, increased secure storage module (SAFE MEMORY is called for short the SMEM module) 506.This safe CPU module directly links to each other with ide interface, and links to each other with SMEM module 506, FMEM module 503 and IC standard card reader 504 by signal wire.Because this data vault links to each other with dispenser system by the standard IDE interface, therefore, its installation is simple and convenient.Secure storage module is applied to data vault, in total system, play the safe storage backup, sensitive data in the system, important information are backuped to secure storage module, like this, in case system is destroyed by malicious attack, can fetch backed up data from secure storage module, the recovery system operate as normal.
Referring to Fig. 6, the structural representation of the secure storage module of preferred embodiment shown in Figure 5.Comprise CPU602 that storage of control data or data recover, non-volatile FLASH storer that is used for data backup 603, an interface circuit 601 that is used for the static memory RAM604 of temporal data and is used for communicating with the CPU module, the CPU602 of described secure storage module directly links to each other with its interface circuit 601, and this CPU602 links to each other with RAM604 with FLASH storer 603 by signal wire; Secure storage module directly links to each other with the serial ports of the CPU module of data vault by its interface circuit 601, carries out two-way communication with the asynchronous serial half-duplex mode.Data vault is to the storage of data in the secure storage module and read, and is to realize by data storage, the read operation of its inner microprocessor CPU control FLASH storer, strengthens safety of data and confidentiality so greatly; The static data memory RAM of SMEM inside has been taked the power down protection measure, uses an external reserve battery power supply 605, even power down like this, data still obtain preserving, and can not lose, and have guaranteed the continuity and the accuracy of data.Its interface circuit 601 adopts the safeguard protection device; adjunction current-limiting resistance and clamp diode; design filtering circuit, amplified buffer circuit; removal is crosstalked; amplifying signal is because the data-interface end takes the voltage stabilizing interference protection measure, even occur some abnormal condition such as high pressure like this; system also can operate as normal, guarantees the validity and the continuation of data communication.Secure storage module can be designed to the form of circuit-board card or add the forms such as module of the plug and play of capsul, in the present embodiment, secure storage module is the module that adds the plug and play of capsul, as long as it is inserted on the circuit board interface connector that data vault provides, it just can carry out its related data storage and read operation.Because whole module sealing is in capsul, and adopted the CPU that self has encryption function and private key, in data storage with read in the process data have been carried out encryption/decryption process, effectively guaranteed to leave in the data security in the secure storage module.
Referring to Fig. 7, the system data Stored Procedure figure of preferred embodiment shown in Figure 5.Be the data flowchart of dispenser system data storage to data vault.At first, execution in step 701, the system CPU in the CPU module detects the instruction data storage that external system sends; With regard to execution in step 702, the data vault system receives data by ide interface; Execution in step 703 again, among the temporary earlier RAM in the CPU module of the data that receive, through after the verification, carry out data transmission through the CPU module encrypt to FMEM again, FMEM with data storage in the FLASH of inside; Above-mentioned steps is same as the prior art, can be referring to Fig. 2; Execution in step 704 again, and after storage completed successfully, the CPU module of data vault was transmitted the interface circuit of external data by SMEM to the SMEM module, and SMEM is temporary in its inner static data memory RAM with data earlier; Execution in step 705 again, RAM calculation check and CRC; Execution in step 706 again, calculate authentication of message sign indicating number MAC; Execution in step 707 again, and after result of calculation to be detected was correct, CPU encrypted data and stores among the FLASH; Last execution in step 708 after SMEM stores successfully, is stored as function signal to the dispenser system transmission, and dispenser system is removed outside temporal data, has finished the data transfer operation of dispenser system and data vault.When data vault is carried out data transmission, have only FMEM and SMEM two modules all successfully after the storage, dispenser system is just removed temporal data, guarantees integrity of data storage and correctness.
With reference to Fig. 8, the system data of preferred embodiment shown in Figure 5 reads process flow diagram.Be the Data Recovery Process figure of data vault.When data among the FMEM of data vault are suffered extraneous destruction, can be from the SMEM module restore data.At first execution in step 801, destroyed or lose when the CPU module detects in the FMEM module data; With regard to execution in step 802, the recovery operation of CPU module log-on data, carry out bi-directional verification between CPU module and the SMEM module, promptly whether the CPU module is authorized to by the security of instruction checking SMEM module and the legitimacy and the checking of reliability and SMEM module detecting operation; Behind to be verified being passed through, SMEM module agreement system reads and restore data, execution in step 803, the CPU module will detect the integrality and the legitimacy of SMEM inside modules data earlier, have only when restore data be complete legal, system just can recover data; If data are illegal, then execution in step 808, and system returns the code of makeing mistakes according to error reason; Otherwise when data are legal, execution in step 804, reading of data and deciphering among the FLASH of the CPU in the SMEM module from the SMEM module; Execution in step 805 then, and data back is to the CPU module of data vault; Execution in step 806 again, and data recovered stores among the FMEM after safety CPU module encrypt again; Execution in step 807 again, detect the restore data success, after the success, finish data and recover.If system is in rejuvenation, when unexpected or other reason wrong occurring, system makes mistakes prompting, need carry out system data again and recover.
In sum, safety storage apparatus and the method that prevents the data transacting system loss of data provided by the present invention.Data are done carrying out safety backup, in case system is destroyed by malicious attack, the secure storage module in can slave unit is fetched backed up data, and the recovery system operate as normal has guaranteed that system data do not lose, and has improved safety of data, reliability.Therefore, this Apparatus and method for is suitable for the data storage of the data transacting system that bank, security, the tax, insurance and various requirement guarantee data security very much.
More than lift preferred embodiment; the purpose, technical solutions and advantages of the present invention are further described; institute is understood that; the above only is preferred embodiment of the present invention; not in order to restriction the present invention; within the spirit and principles in the present invention all, any modification of being done, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (12)
1, a kind of safety storage apparatus that prevents the data transacting system loss of data, comprise a CPU module that is used to carry out Data Control, one is used to the system interface circuit storing the data memory module of data and be used for communicating with data transacting system, this CPU module directly links to each other with the system interface circuit, and this CPU module links to each other with data memory module by signal wire, it is characterized in that: described equipment further comprises a secure storage module that is used for data backup and data recovery, described secure storage module comprises the CPU of a control data storage or data recovery, a read-write memory that is used for data backup, a static memory RAM who is used for temporal data, with the interface circuit that is used for communicating with the CPU module, the CPU of described secure storage module directly links to each other with its interface circuit, and this CPU links to each other with RAM with read-write memory by signal wire; Described secure storage module directly links to each other with the CPU module by its interface circuit.
2, the safety storage apparatus that prevents the data transacting system loss of data as claimed in claim 1 is characterized in that: the CPU in the described secure storage module is the CPU of common grade; Or CPU with self-encryption function; Or has the CPU of self-encryption function and private key simultaneously.
3, the safety storage apparatus that prevents the data transacting system loss of data as claimed in claim 1 is characterized in that: described secure storage module comprises that further one is used for when the data transacting system power down, is the standby power supply of RAM power supply.
4, the safety storage apparatus that prevents the data transacting system loss of data as claimed in claim 1 is characterized in that: the interface circuit of described secure storage module links to each other with the serial ports of CPU module.
5, the safety storage apparatus that prevents the data transacting system loss of data as claimed in claim 1 is characterized in that: this equipment is circuit-board card, and its system interface circuit is the circuit board interface connector.
6, the safety storage apparatus that prevents the data transacting system loss of data as claimed in claim 1 is characterized in that: described safety storage apparatus is installed in the housing, and its system interface circuit is the standard IDE interface.
7, the safety storage apparatus that prevents the data transacting system loss of data as claimed in claim 1 is characterized in that: described secure storage module is a circuit-board card, and its interface circuit is the circuit board interface connector.
8, as claim 1 or the 7 described safety storage apparatus that prevent the data transacting system loss of data, it is characterized in that: described secure storage module is the module that adds seal casinghousing.
9, a kind of method that prevents the data transacting system loss of data is characterized in that: use a described safety storage apparatus of claim 1 that data are carried out safe storage and data recovery, the process of its safe storage comprises following step at least:
1) data of data transacting system send in the CPU module by the system interface circuit, after the CPU module receives data, earlier with data storage in data memory module;
2) the CPU module with the data that receive, sends to the CPU in the secure storage module again, and this CPU is temporary in the RAM of secure storage module with data;
3) CPU of secure storage module again with the data storage among the RAM in the read-write memory of secure storage module;
The process that its data are recovered comprises following step at least:
When 4) the CPU module detected data in the data memory module and destroyed, the log-on data recovery operation was carried out the bidirectional identification checking by instruction between CPU module and the secure storage module;
5) integrality and the legitimacy of data in the read-write memory in the CPU module check secure storage module;
6) CPU of secure storage module reads the data in the read-write memory, and is temporary in the RAM of secure storage module;
The data of 7) reading send to the CPU module by interface circuit, the CPU module with this data storage in data memory module.
10, the method that prevents the data transacting system loss of data as claimed in claim 9 is characterized in that: comprise that this method step 2) RAM calculates and verification Cyclic Redundancy Code CRC data, and calculate and checking authentication of message sign indicating number MAC.
11, the method that prevents the data transacting system loss of data as claimed in claim 9 is characterized in that: the CPU that this method step 3) further comprises secure storage module carries out encryption to data; The CPU that further comprises secure storage module with step 6) is decrypted processing to the data in the read-write memory.
12, the method that prevents the data transacting system loss of data as claimed in claim 11 is characterized in that: secure storage module adopts key and encryption/decryption algorithm that data are carried out encryption/decryption process; Or adopt CPU that data are carried out encryption/decryption process with self-encryption function; Or adopt the CPU that has self-encryption function and private key simultaneously that data are carried out encryption/decryption process.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02117970 CN1210654C (en) | 2002-05-27 | 2002-05-27 | Safety data storage equipment and method for preventing data lest in data transaction system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02117970 CN1210654C (en) | 2002-05-27 | 2002-05-27 | Safety data storage equipment and method for preventing data lest in data transaction system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1462001A CN1462001A (en) | 2003-12-17 |
| CN1210654C true CN1210654C (en) | 2005-07-13 |
Family
ID=29742425
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 02117970 Expired - Fee Related CN1210654C (en) | 2002-05-27 | 2002-05-27 | Safety data storage equipment and method for preventing data lest in data transaction system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1210654C (en) |
Families Citing this family (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7913100B2 (en) * | 2007-09-29 | 2011-03-22 | Intel Corporation | Opportunistic initiation of data traffic |
| CN102749883A (en) * | 2011-04-21 | 2012-10-24 | 武汉奥特先锋数控技术有限公司 | Control system for numerical control cutting machine |
| CN102722919B (en) * | 2012-05-31 | 2015-08-19 | 株洲南车时代电气股份有限公司 | A kind of train supervision pen recorder data updating device and method thereof |
| CN105808153B (en) * | 2014-12-31 | 2018-11-13 | 深圳市硅格半导体有限公司 | Storage system and its read-write operation method |
| CN105893281A (en) * | 2016-03-30 | 2016-08-24 | 苏州美天网络科技有限公司 | Intelligent data storage system of computer |
| CN108062480A (en) * | 2017-12-14 | 2018-05-22 | 徐州汇尔康食品有限公司 | A kind of electric business platform website data protects system |
-
2002
- 2002-05-27 CN CN 02117970 patent/CN1210654C/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CN1462001A (en) | 2003-12-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1035085C (en) | Equipment for protection of code character of core card | |
| CN103580872B (en) | A kind of system and method generating for key and managing | |
| US8135135B2 (en) | Secure data protection during disasters | |
| WO2011004829A1 (en) | Detection method for detecting fraud | |
| US20080215955A1 (en) | Semiconductor storage device | |
| CN101351807A (en) | Methods and systems for associating an embedded security chip with a computer | |
| CN110245466B (en) | Software integrity protection and verification method, system, device and storage medium | |
| WO2002078248A1 (en) | Portable information storage medium and its authentification method | |
| CN102855161A (en) | Data interleaving scheme for an external memory of a secure microcontroller | |
| CN103034801A (en) | Safety microcontroller based on mode | |
| CN1210654C (en) | Safety data storage equipment and method for preventing data lest in data transaction system | |
| US8738919B2 (en) | Control of the integrity of a memory external to a microprocessor | |
| CN101589399A (en) | System and method for securing data | |
| JPS5947646A (en) | Computer data processing apparatus and method | |
| CN107609427A (en) | A kind of storage method and system of EEPROM data | |
| CN111539042B (en) | Safe operation method based on trusted storage of core data files | |
| CN114785503B (en) | Cipher card, root key protection method thereof and computer readable storage medium | |
| CN107861892B (en) | Method and terminal for realizing data processing | |
| US20090024887A1 (en) | Semiconductor storage device, data write method and data read method | |
| CN105512560A (en) | Disposable programmable storage chip and control method thereof | |
| CN110311773B (en) | Method for preventing injection type attack of advanced encryption standard coprocessor | |
| CN110096909B (en) | Method and system for ensuring stability of EFUSE key | |
| WO2009087970A1 (en) | Memory monitoring method | |
| CN102368220A (en) | Method for recovering transaction data | |
| WO2000028493A1 (en) | A method of encryption and apparatus therefor |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C17 | Cessation of patent right | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20050713 Termination date: 20110527 |