JP2007249263A - Portable data storage device and data writing and reading control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem wherein only a computer in which prescribed program is prepared could be used, and it is impossible to decode data, unless key data that are to be distributed through a predetermined route are not stored in a computer. <P>SOLUTION: A peculiar identification number is read from a non-contact type IC chip 60 as a key via a non-contact IC chip reader 40 when writing or reading data, and authentication is carried out by an authentication information comparator circuit 25, on the basis of the unique identification number; and when authentication has been completed, the data are encrypted by an encryption circuit 22, and the data are decoded by a decoding circuit 23, and non-encrypted data to be written from a host 50 are encrypted, and written in a memory 30, and the encrypted data are read from the memory 30, and decoded and then, output to the host 50. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a portable data storage device and a data writing / reading control method, and more particularly to a data storage device for encrypting and storing data and a data writing / reading control method.

A portable data storage device is convenient for the easy movement of data, but there is a concern that the device may be lost during the movement and confidential information inside may be leaked to others.
Conventionally, a technique disclosed in Patent Document 1 or 2 is known as a technique for preventing data leakage to others.
JP-A-10-247906 JP 2003-223367 A

The above Patent Documents 1 and 2 have the following problems.
In Patent Document 1, after an encrypted file is created in a computer based on a fingerprint, the encrypted file is stored.
In the one disclosed in Patent Document 1, in order to decrypt data, a decryption program corresponding to the encryption program when the data is encrypted in the computer is necessary, and an environment in which this program is prepared in advance. Otherwise, it cannot be decrypted.
In Patent Document 2, when key data prepared separately from a medium is held in a computer, decrypted data can be read from the medium using the key data.
If the key data distributed by a predetermined route is not stored in the computer, it cannot be decrypted, and the data cannot be read normally when the medium is taken out.
The present invention has been made in view of the above problems. A portable data storage device capable of reliably preventing data leakage while avoiding cumbersome management and operation, and data writing and An object is to provide a reading control method.

In order to achieve the above object, the invention according to claim 1
Storage means capable of writing and reading data based on predetermined control;
A control means having an interface for connection with the outside and controlling writing and reading with respect to the storage means;
A non-contact type IC chip reader for reading information from an external non-contact type IC chip;
The control means is connected to an external device through the connection interface, and responds to data write and read requests from the external device by the non-contact IC chip reader. Information is read from the chip, predetermined authentication is performed, and when the authentication is completed, a predetermined encryption key is generated and the encryption key is used to encrypt / decrypt data to the storage means. To cope with the data write and read requests.

  In the invention according to claim 1 configured as described above, the data storage device is connected to the external device, and data is written or read from the external device side. When writing or reading data, the control means reads information from an external non-contact type IC chip by the non-contact type IC chip reader, performs predetermined authentication, and when authentication is completed, The encryption key is generated and the encryption key is used to encrypt / decrypt data to the storage means to respond to the data write / read request.

In this way, the encryption key for data encryption / decryption is obtained from the external non-contact IC chip. For this reason, a non-contact type IC chip is necessary for writing and reading, but since it is non-contact, troublesome management and operation are unnecessary.
Of course, since such a non-contact type IC chip does not need to be an individual one, it is possible to use one already owned by the user. Therefore, unless it is not owned at all, it is possible to easily and surely protect data using an existing non-contact type IC chip.
A general-purpose means can be used to read information from the non-contact type IC chip.
Therefore, the invention according to claim 9 is configured such that the non-contact IC chip reader reads information from the non-contact IC chip by short-range wireless communication, and the invention according to claim 10 is the non-contact type. The type IC chip reader is configured to read information from the non-contact type IC chip by RFID.

  The short-range wireless communication is typified by near-field communication, and for example, one that performs bidirectional communication of 100 to 400 kbps at a very short distance of about 10 cm using a radio wave of 13.56 MHz is known. The RF-ID is spelled “Radio Frequency Identification” and is used for identifying an object such as merchandise distribution using a minute wireless IC chip.

As an example of the control means, in the invention according to claim 2,
The control means includes
The connection interface;
An authentication information holding circuit for storing predetermined authentication information;
The information is read from the external non-contact type IC chip via the non-contact type IC chip reader, and the authentication information based on the read information and the authentication information stored in the authentication information holding circuit An authentication information comparison circuit for confirming verification by comparing
An encryption key generation circuit for generating an encryption key based on information read from the non-contact type IC chip when verification is confirmed by the authentication information comparison circuit;
An encryption circuit for encrypting predetermined data based on the encryption key;
A decryption circuit for decrypting predetermined data based on the encryption key;
In response to data write and read requests from the external device, while performing verification in the authentication information comparison circuit,
Based on the encryption key generated by the encryption key generation circuit when the verification is confirmed, the encryption circuit encrypts predetermined data that is not encrypted at the time of data writing with the encryption key. And store the encrypted data in the storage means,
And a read / write control circuit for outputting the decrypted data by decrypting the encrypted data read from the storage means by the decryption circuit with the same encryption key when reading the data. .

  In the invention according to claim 2 configured as described above, the authentication information comparison circuit reads out information from an external non-contact type IC chip via the non-contact type IC chip reader, and then reads the information. The authentication information based on the issued information is compared with the authentication information stored in the authentication information holding circuit to confirm the collation, and when the collation is confirmed, the encryption key generation circuit detects from the non-contact type IC chip. When an encryption key is generated based on the read information and data is written, the encryption circuit encrypts predetermined data based on the encryption key, and when the data is read, the decryption circuit The predetermined data can be decrypted based on the encryption key.

  Therefore, the read / write control circuit performs the verification by the authentication information comparison circuit when there is a request for data writing and reading from the external device, and when the verification is confirmed, Based on the encryption key generated by the generation circuit, when the data is stored, the predetermined data that is not encrypted is encrypted by the encryption circuit using the encryption key, and the encrypted data is stored by the encryption circuit. The encrypted data read out from the storage means is decrypted by the decryption circuit by the decryption circuit using the same encryption key, and the decrypted data is output.

As an example of the storage means, in the invention according to claim 3, the storage means is constituted by a flash memory, and the connection interface is constituted by a USB interface.
In the invention according to claim 3 configured as described above, the encrypted data is stored in the flash memory, and the encrypted data is read from the flash memory as necessary.
As an example of information to be used, the invention according to claim 4 is configured such that the information read from the non-contact type IC chip by the non-contact type IC chip reader is a unique identification number of the non-contact type IC chip.
In the invention according to claim 4 configured as described above, the non-contact type IC chip reader reads the unique identification number of the non-contact type IC chip and uses the same information.
The non-contact type IC chip always stores a unique identification number. If this information is used, it is not necessary to write dedicated information. Moreover, since it is unique, information leakage can be prevented depending on how it is used.
Of course, if it is assumed that such a unique identification number is used, there is no need to write dedicated information, and this does not prevent the use of information other than such a unique identification number.
As a preferred example of using such a unique identification number, in the invention according to claim 5, the authentication information is constituted by a part of the unique identification number.
It is meaningful to make authentication information completely unique, but it is also meaningful to leave room for applying commonality. In the sense of leaving commonality, it can be realized by making it a part of the unique identification number.
According to a sixth aspect of the present invention, in the non-contact type IC chip, a part of the unique identification number is common based on a predetermined classification standard, and the authentication information is common. The non-contact type IC chip has a part of the unique identification number having a different specificity based on a predetermined classification standard, and the encryption key has the same specificity. It consists of a certain part.

  More specifically, when a part of the unique identification number is common based on a predetermined classification standard, the common part is used as the authentication information. For example, it is assumed that a non-contact type IC chip is distributed to employees of a company, and the employees are classified according to their department or status. If the authentication information is the information of the part common to each department to which the department belongs, if it belongs to the department to which the department belongs, the storage device of the colleague can be confirmed until the authentication. On the other hand, even if the department is different, even authentication cannot be realized. When a storage device is lost in the company, it is possible to identify the department to which the user belongs, which is convenient for identifying the lost person.

In this case, since the encryption key is composed of a part of the unique identification number, even if the department to which it belongs is common, it is encrypted with a different encryption key for each individual. Even if authentication can be realized, decryption and reading of data is prevented.
Since authentication is also performed on the premise that the encryption key is used, it is only necessary that the encryption key can be combined with authentication information to achieve specificity.
There are various methods for holding the authentication information, and the invention according to claim 7 is that the authentication information holding circuit is configured to store information on an external non-contact IC chip via the non-contact IC chip reader in a predetermined situation. Reading is executed, and authentication information based on the read information is acquired and held.

  In the invention according to claim 7 configured as described above, in a predetermined situation, the authentication information holding circuit executes reading of information with respect to an external non-contact type IC chip via the non-contact type IC chip reader, Authentication information based on the read information is acquired and held.

In this way, since the information of the external non-contact type IC chip is read and held as authentication information, the non-contact type IC chip owned by the user can be prepared and the information can be used as the authentication information. .
In the invention according to claim 8, the authentication information holding circuit is configured to read the read information in a situation where the authentication information is not held and is connected to the external device through the connection interface. Is configured to hold authentication information based on.
Although it is possible to instruct the timing for fetching the authentication information with a dedicated utility or the like, in the invention according to claim 8 configured as described above, the authentication information is not held and the connection interface is used. When connected to the external device via the authentication information holding circuit, the information of the external non-contact type IC chip is read and the authentication information is held.

Therefore, the user can use the information after it is designated as the authentication information as long as the external non-contact type IC chip is brought close to the storage device when the authentication information is not yet stored.
As described above, it is not always necessary that the method for ensuring the security using the non-contact type IC chip is limited to a substantial apparatus, and it can be easily understood that the method also functions. Therefore, the invention according to claim 11 is portable and has a non-contact type IC chip reader that reads information from an external non-contact type IC chip, and is connected to an external device via a connection interface. A data writing and reading control method in a data storage device for connecting and writing data to and reading data from an internal storage means, wherein the data storage device is connected to an external device via the connection interface. In response to a data write / read request from an external device, information is read from the external non-contact IC chip by the non-contact IC chip reader, and predetermined authentication is performed. Data for the storage means using the encryption key while generating the encryption key Performing encryption and decryption is a configuration corresponding to the request of the write and read of the data.

That is, it is not necessarily limited to a substantial apparatus, and there is no difference that the method is effective.
By the way, such a storage device may exist independently, or may be used in a state of being incorporated in a certain device, but the idea of the invention is not limited to this and includes various aspects. Therefore, it can be changed as appropriate, such as software or hardware.

When the software of the storage device is embodied as an example of the idea of the invention, it naturally exists on the storage medium storing the software and is used.
Of course, the storage medium may be a magnetic storage medium, a magneto-optical storage medium, or any storage medium that will be developed in the future. In addition, the duplication stages such as the primary duplication product and the secondary duplication product are equivalent without any question. In addition, even when the communication method is used as a supply method, the present invention is not changed.

Furthermore, even when a part is software and a part is realized by hardware, it is not completely different in the idea of the invention, and a part is stored on a storage medium, and it is appropriately changed as necessary. It may be in the form of being read.
When the present invention is implemented by software, a configuration using hardware or an operating system may be used, or may be implemented separately from these. For example, even if it is a variety of arithmetic processing, if it can be processed by calling a predetermined function in the operating system, it can also be input from hardware without calling such a function. is there. And even if it is actually realized under the intervention of an operating system, it can be understood that the present invention can be implemented only by this program in the process of being stored and distributed on the medium.

  When the present invention is implemented by software, the present invention is not only realized as a medium storing a program, but the present invention is naturally realized as a program itself, and the program itself is also included in the present invention.

  As described above, the present invention uses authentication and an encryption key, but such information is obtained from an external non-contact IC chip in a non-contact manner, thereby eliminating the need for troublesome management and operation, and A data storage device capable of reliably preventing leakage can be provided.

Further, according to the invention of claim 3, since it is realized as a flash memory connected by a USB interface, and no program for encryption / decryption is required on the external device side at that time, it is widely used. It can be used.
Further, according to the invention according to claim 4, since the unique identification number that is always held by the non-contact type IC chip is used, it is not necessary to write special information for such a security purpose. This makes it easier to use.
Further, according to the inventions according to claims 5 and 6, security can be ensured while maintaining commonness in authentication information and realizing group management and the like, and the convenience of management is further enhanced. improves.

Further, according to the seventh aspect of the invention, since the authentication information is obtained from the non-contact type IC chip placed nearby, the non-contact type IC chip that the user wants to use as a key can be selected, which is very convenient.

Furthermore, according to the eighth aspect of the invention, for example, as long as the non-contact type IC chip is set aside when it is used for the first time, no special operation is required, which is convenient.
Furthermore, according to the invention of claim 9, by using the short-range wireless communication which is an existing technology, only a non-contact type IC chip in a range that is not too far away when using a storage device is targeted. Therefore, it is possible to maintain convenience because it does not require strict location management that does not prevent parallel use and must be connected exactly.

  Further, according to the invention of claim 10, by using a wireless IC chip expected to be used as a product tag, almost all items purchased as products are provided, Everything specified by the user can be used as a so-called key, and no special thing can be required.

  Furthermore, according to the eleventh aspect of the present invention, it is possible to provide a data writing and reading control method that exhibits the same effect.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a data storage device according to an embodiment of the present invention.
In FIG. 1, a storage device 10 is a so-called portable USB flash memory, and is connected to a host (personal computer) 50 that is an external device via a USB connector 11. The non-contact IC chip 60 is a non-contact IC card that transmits predetermined information in a non-contact manner using a short-range wireless communication (near field communication: NFC) technology.

In this embodiment, a non-contact IC card using short-range wireless communication is used, but a non-contact IC card using RFID technology may be used. Of course, it is not essential that these are card-shaped.
The storage device 10 includes a control unit (corresponding to control means) 20, a memory 30, and a non-contact type IC chip reader 40 therein. A memory (corresponding to storage means) 30 is a non-volatile flash memory, has a predetermined capacity, and can write and read data to and from a storage area specified by an address bus and a data bus. The non-contact type IC chip reader 40 communicates with a non-contact type IC chip 60 located in the vicinity based on the NFC standard, and reads data written in the chip 60. In this embodiment, since only the read function is necessary, the writer function which is the write function is not provided, but the writer function may be provided. The information to be read is not particularly limited, but in this embodiment, since the unique identification number (ID) of the non-contact type IC chip 60 is used as will be described later, the unique identification number can be acquired at least. .

The control unit 20 includes a read / write control circuit 21, an encryption circuit 22, a decryption circuit 23, an encryption key generation circuit 24, an authentication information comparison circuit 25, and an authentication information holding circuit 26. Yes.
The encryption circuit 22 encrypts data using a predetermined encryption key instructed from the read / write control circuit 21. The decryption circuit 23 decrypts the encrypted data using the encryption key instructed from the same read / write control circuit 21. The read / write control circuit 21 instructs the encryption circuit 22 and the decryption circuit 23 about the encryption key input from the encryption key generation circuit 24. Whether the encryption key at the time of encryption matches the encryption key at the time of compounding or not is determined. There is no need to judge whether. In the decryption circuit 23, if the encryption key at the time of encryption matches the encryption key at the time of encryption, the data before encryption can be restored, and if it does not match, it cannot be restored to the original data. Both the encryption circuit 22 and the decryption circuit 23 hold the encryption key only during the encryption work and the decryption work, and clear them after the work ends. This is because the possibility of data leakage increases if it is held unnecessarily inside. In this embodiment, a part of the ID described later is used as the authentication information and the other part is used as the encryption key. However, the authentication information can be used as it is in the encryption key. The encryption key generation circuit can be omitted.

  Encrypted data is stored in the memory 30, but the quality of the data does not change depending on the presence or absence of the encryption, and the memory 30 is instructed to have a predetermined bit length regardless of the presence or absence of the encryption. Write to or read from the address. In this embodiment, a flash memory is used. However, any data storage device for encrypting / decrypting to secure data can be used, so there is a storage portion and a controller portion. Other storage devices such as a hard disk and an SD memory can also be used.

  The read / write control circuit 21 transmits / receives control commands and data to / from the host 50 via the USB connector 11. In this sense, the read / write control circuit 21 forms a connection interface including the USB connector 11. Of course, this connection interface is a USB interface. When the host 50 instructs the read / write control circuit 21 to write or read data, the read / write control circuit 21 instructs the authentication information comparison circuit 25 to execute authentication.

  When there is a request for authentication, the authentication information comparison circuit 25 instructs the non-contact type IC chip reader 40 to read the unique identification number from the non-contact type IC chip 60 in the vicinity. Then, the non-contact type IC chip reader 40 tries to communicate with the non-contact type IC chip 60 in the vicinity according to a professional and a call according to the standard. This communication is the same even if it has been carried out before that. If communication with the nearby non-contact type IC chip 60 is possible, a unique identification number is obtained for the chip 60 and acquired. The non-contact type IC chip reader 40 outputs the unique identification number as it is to the authentication information comparison circuit 25, and the authentication information comparison circuit 25 recognizes a part of it as authentication information.

Next, the authentication information comparison circuit 25 obtains authentication information held in the authentication information holding circuit 26. The authentication information holding circuit 26 holds authentication information in advance as described later, and outputs it to the authentication information comparison circuit 25.
The authentication information comparison circuit 25 compares the authentication information, which is a part of the unique identification number obtained from the non-contact type IC chip reader 40, with the authentication information obtained from the authentication information holding circuit 26. It is determined that authentication is complete. When the authentication is completed, the authentication information comparison circuit 25 outputs the unique identification number obtained from the non-contact type IC chip reader 40 to the encryption key generation circuit 24, and the encryption key generation circuit 24 outputs the encryption key to the read / write control circuit. To 21.

Here, when the authentication information comparison circuit 25 does not complete the authentication, whether to output the determination that the authentication has not been completed to the read / write control circuit 21 via the encryption key generation circuit 24 is determined. Is also possible.
If the authentication is not completed, the unique identification number is not output, and the encryption key generation circuit 24 cannot generate the encryption key. The encryption key generation circuit 24 generates an encryption key based on the unique identification number given from the authentication information comparison circuit 25. When the encryption key is output, the internal storage area is immediately cleared. Then, unless a unique identification number is given next time, neither a new encryption key nor a previous encryption key can be output.

  Accordingly, if the authentication is not completed, the encryption key generation circuit 24 cannot generate the original encryption key, and in this state, the read / write control circuit 21 has not completed the authentication based on the fact that the encryption key is not generated. It can be judged. As a result, subsequent control of reading and writing of data from the host 50 is rejected.

  On the other hand, when the authentication is completed, the unique identification number is output, and the encryption key generation circuit 24 generates the correct encryption key. Therefore, the encryption circuit acquires the encryption key via the read / write control circuit 21. 22 and the decryption circuit 23 can read and write data with security.

  As will be described later, it is possible to create a situation in which a correct encryption key cannot be generated, although only authentication can be completed by group management of authentication information. In this case, although the authentication is simply completed, it is not a correct non-contact IC chip 60, so the unique identification number is different, and an encryption key different from the original is generated by the encryption key generation circuit 24, and the read / write control circuit An incorrect encryption key is output to the encryption circuit 22 and the decryption circuit 23 via 21. If the data reading itself is performed as it is, reading the data decrypted with an incorrect encryption key has no utility value. Although the data writing itself is performed by encryption, it does not make sense to write the data to a data storage that is not its own. Therefore, any problem does not occur.

  Group management can be performed by setting all or part of the unique identification number of the non-contact type IC chip 60 in accordance with a predetermined classification standard. For example, when the non-contact type IC chip 60 is used as an identification card in a company, a certain part of 5 digits represents the department to which the department belongs, and the other 5 digits are made different within each department. Assign to each individual. If such a classification standard is applied, the common 5 digits are assigned to the authentication information and the unique 5 digits are assigned to the encryption key. You can be able to confirm until. However, since the five digits of the encryption key have a characteristic for each individual, data cannot be read out.

  The authentication information held by the authentication information holding circuit 26 is a part of the unique identification number read from the non-contact type IC chip reader 40 when authentication information is first requested from the authentication information comparison circuit 25. Remember as. In this way, the user simply prepares the non-contact type IC chip 60 that the user wants to use as a key when using it for the first time. It can be used like a key. Of course, the authentication information may be written by other methods. For example, it is also possible to load a utility program for rewriting authentication information into the host 50 and write it via the read / write control circuit 21. The control at the time of writing the data is a write control method, and the control at the time of reading the data is the read control method.

Next, the operation of the present embodiment configured as described above will be described.
FIG. 2 is a flowchart showing the operation when the authentication information holding circuit 26 does not hold the authentication information. As shown in the figure, when it is determined that there is no authentication information in the authentication information holding circuit 26 in step S102, the unique identification number (from the non-contact type IC chip reader 40 to the non-contact type IC chip 60 (step S104). (Hereinafter referred to as ID), and a part of the ID read in step S106 is written in the authentication information holding circuit 26 as authentication information.

FIG. 3 is a flowchart showing an operation at the time of reading and writing data in a state where the authentication information is held in the authentication information holding circuit 26.
When there is a data write or read request from the host 50, in step S110, the non-contact IC chip reader 40 performs a process of reading the ID from the non-contact IC chip 60 located in the vicinity. That is, the read / write control circuit 21 receives a control command from the host 50 and instructs the authentication information comparison circuit 25 to execute authentication. Then, the authentication information comparison circuit 25 instructs the non-contact type IC chip reader 40 to read the ID from the non-contact type IC chip 60 in the vicinity, and the non-contact type IC chip reader 40 conforms to the standard. The communication with the non-contact type IC chip 60 in the vicinity is attempted according to the call with the professional. If communication with the nearby non-contact type IC chip 60 is possible, the non-contact type IC chip reader 40 obtains an ID from the chip 60 and outputs the obtained ID to the authentication information comparison circuit 25 as it is. The authentication information comparison circuit 25 recognizes a part thereof as authentication information.

  In step S112, the authentication information comparison circuit 25 compares the authentication information that is a part of the ID obtained from the non-contact type IC chip reader 40 with the authentication information held by the authentication information holding circuit 26. In step S114, when the comparison result matches, that is, when the authentication is completed, the process proceeds to step S116. If the control command from the host 50 is data write (write), a part of the ID is encrypted in step S118. The data sent out from the host 50 following the control command is encrypted and written to the memory 30. If the control command from the host 50 is a data read (read), a part of the ID is encrypted in step S120. Data corresponding to a control command from the host 50 is decoded as a key while being read from the memory 30 and sent to the host 50. Of course, the data write and read addresses at this time are specified based on separately prescribed processing.

  More specifically, at the time of writing, the ID obtained from the non-contact type IC chip reader 40 is output to the encryption key generation circuit 24, and the encryption key generation circuit 24 reads / writes a part of the ID as an encryption key. Output to the control circuit 21. The read / write control circuit 21 outputs the encryption key to the encryption circuit 22, and then outputs the data sent from the host 50 to the encryption circuit 22. The encryption circuit 22 encrypts the data based on the encryption key. The data is output to the memory 30 and written sequentially. At the time of reading, the encryption key generated by the encryption key generation circuit 24 to the read / write control circuit 21 is output to the decryption circuit 23 based on the ID obtained from the non-contact type IC chip reader 40. The circuit 23 decodes and sequentially outputs the data read from the memory 30, and the decoded data is output to the host 50 through the read / write control circuit 21.

  Here, if an illegally obtained data storage is connected to its own personal computer and attempts to read it, the authentication is not completed unless there is an original non-contact type IC chip. That is, in step S114, it is determined that the authentication information does not match, and in step S122, the writer read / write is disabled, and the process ends.

4 to 6 show another embodiment for realizing a substantially similar object.
FIG. 4 shows a schematic operation. When the data storage (device) is inserted into the USB connector of the host 50 in step S202, it is determined that there is authentication information based on the presence or absence of authentication information in the authentication information holding circuit in step S204. If it is determined, the process proceeds to step S206 to execute the normal operation, and if it is determined that there is no authentication information, the process proceeds to step S208.

  In this embodiment, three operations are shown as operations when there is no authentication information. 1) Operate as a USB flash device that cannot perform normal encryption or decryption. 2) Do not operate at all. 3) Authentication It is possible to cope with whether the host 50 starts the information automatic registration screen. To realize operation as a USB flash device that cannot be decrypted by encryption, the encryption circuit 22 or decryption is performed so that if encryption or decryption is performed without providing an encryption key, encryption or decryption is not performed at all. This can be realized by configuring the circuit 23. Processing that does not operate at all can be realized by preventing the read / write control circuit 21 from performing subsequent processing when there is no authentication information. The activation of the authentication information automatic registration screen on the host 50 can be realized by storing a program to be executed on the host 50 in advance in the data storage and loading the program on the host 50 for execution.

  FIG. 5 shows the data flow and processing during data writing in normal operation. In the figure, the host 50 requests data writing in step S212. Based on the request, the control unit 20 makes an ID acquisition request in step S214. Based on the request, the non-contact type IC chip reader 40 acquires an ID from the nearby non-contact type IC chip 60 in step S216. In step S218, the control unit 20 uses a part of the acquired ID as authentication information, and collates it with the authentication information of the authentication information holding circuit. If collation is not possible (NG), an error is notified in step S220. In this embodiment, it is possible to implement one of two types: a response that indicates that the access key (authentication information) is invalid and does not operate, and a response that denies access to the data area.

  On the other hand, when the authentication is completed (OK), the host 50 sequentially writes unencrypted data in step S222, and in the control unit 20, the encryption circuit 22 uses a part of the ID as an encryption key in step S224. Then, the data is encrypted, and the encrypted data is written into the memory 30 in step S226.

  Next, FIG. 6 shows the data flow and processing at the time of data reading in the normal operation. In the figure, the host 50 requests data reading in step S232. Based on the request, the control unit 20 makes an ID acquisition request in step S234. Based on the request, the non-contact type IC chip reader 40 acquires an ID from the nearby non-contact type IC chip 60 in step S236. In step S238, the control unit 20 uses a part of the acquired ID as authentication information and collates it with the authentication information of the authentication information holding circuit. If collation is not possible (NG), an error is notified in step S240. In this embodiment, it is possible to implement one of two types, a response such as displaying that the access key (authentication information) is invalid and denying data access, or a response not decrypting encrypted data. Yes.

  On the other hand, when the authentication is completed (OK), the memory 30 reads the encrypted data in step S242, and in the control unit 20, the decryption circuit 23 uses part of the ID as an encryption key in step S244. The data is decrypted using the data, and the data decrypted in step S246 is read out to the host 50.

  In this way, the unique identification number is read from the non-contact type IC chip 60 as a key via the non-contact type IC chip reader 40 at the time of data writing or reading, and the authentication information comparison circuit 25 is read based on the unique identification number. When authentication is completed, encryption is performed by the encryption circuit 22, decryption is performed by the decryption circuit 23, and unencrypted data written from the host 50 is encrypted and recorded. In addition, the encrypted data is read from the memory 30 and decrypted, and then output to the host 50.

It is a block diagram which shows schematic structure of the data storage concerning one Embodiment of this invention. It is a flowchart at the time of making the authentication information holding circuit hold | maintain the authentication information in the data storage device concerning a 1st Example. It is a flowchart at the time of the writing and reading of the data in the data storage device concerning a 1st Example. It is a whole flowchart of the operation | movement in the data storage device concerning a 2nd Example. It is a flowchart at the time of the data writing in the data storage device concerning a 2nd Example. It is a flowchart at the time of the reading of the data in the data storage device concerning a 2nd Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Data storage device 20 ... Control part 30 ... Memory 40 ... Non-contact type IC chip reader 50 ... Host 60 ... Non-contact type IC chip

Claims (11)

Storage means capable of writing and reading data based on predetermined control;
A control means having an interface for connection with the outside and controlling writing and reading with respect to the storage means;
A non-contact type IC chip reader for reading information from an external non-contact type IC chip;
The control means is connected to an external device through the connection interface, and responds to data write and read requests from the external device by the non-contact IC chip reader. Information is read from the chip, predetermined authentication is performed, and when the authentication is completed, a predetermined encryption key is generated and the encryption key is used to encrypt / decrypt data to the storage means. A portable data storage device characterized by performing the above-mentioned data write and read requests. The control means includes
The connection interface;
An authentication information holding circuit for storing predetermined authentication information;
The information is read from the external non-contact type IC chip via the non-contact type IC chip reader, and the authentication information based on the read information and the authentication information stored in the authentication information holding circuit An authentication information comparison circuit for confirming verification by comparing
An encryption key generation circuit for generating an encryption key based on information read from the non-contact type IC chip when verification is confirmed by the authentication information comparison circuit;
An encryption circuit for encrypting predetermined data based on the encryption key;
A decryption circuit for decrypting predetermined data based on the encryption key;
In response to data write and read requests from the external device, while performing verification in the authentication information comparison circuit,
Based on the encryption key generated by the encryption key generation circuit when the verification is confirmed, the encryption circuit encrypts predetermined data that is not encrypted at the time of data writing with the encryption key. And store the encrypted data in the storage means,
And a read / write control circuit for outputting the decrypted data by decrypting the encrypted data read from the storage means by the decryption circuit with the same encryption key when reading the data. The data storage device according to claim 1. The storage means is composed of a flash memory,
3. The data storage device according to claim 2, wherein the connection interface is a USB interface.   4. The data storage device according to claim 2, wherein the information read from the non-contact type IC chip by the non-contact type IC chip reader is a unique identification number of the non-contact type IC chip. .   The data storage device according to claim 4, wherein the authentication information is a part of the unique identification number. In the non-contact type IC chip, a part of the unique identification number is common based on a predetermined classification standard,
The authentication information is a common part,
In the non-contact type IC chip, some of the unique identification numbers have different specificities based on a predetermined classification standard,
6. The data storage device according to claim 5, wherein the encryption key is a part having the same specificity.   The authentication information holding circuit reads out information with respect to an external non-contact type IC chip via the non-contact type IC chip reader in a predetermined situation, and acquires authentication information based on the read information. The data storage device according to any one of claims 2 to 6, wherein the data storage device is held.   The authentication information holding circuit holds authentication information based on the read information in a situation where the authentication information is not held and is connected to the external device via the connection interface. The data storage device according to claim 7.   9. The data storage device according to claim 1, wherein the non-contact type IC chip reader reads information from the non-contact type IC chip by short-range wireless communication.   9. The data storage device according to claim 1, wherein the non-contact type IC chip reader reads information from the non-contact type IC chip by RFID. It has a non-contact type IC chip reader that can be carried and reads information from an external non-contact type IC chip, and is connected to an external device via a connection interface to store data in an internal storage means. A method of controlling data writing and reading in a data storage device that performs writing and reading of
In response to a data write / read request from the external device while connected to the external device via the connection interface, the non-contact IC chip reader reads information from the external non-contact IC chip. In addition to performing the predetermined authentication and generating the predetermined encryption key when the authentication is completed, the data is encrypted / decrypted with respect to the storage means using the encryption key A data writing and reading control method characterized by responding to a request for writing and reading data.

Images