JP4832926B2 - Portable data storage device and data read control method - Google Patents

Description

The present invention relates readings out control method for portable data storage devices and data, in particular, to a data storage device and readings out the control method of the data and stores the encrypted data.

A portable data storage device is convenient for the easy movement of data, but there is a concern that the device may be lost during the movement and confidential information inside may be leaked to others.
Conventionally, a technique disclosed in Patent Document 1 or 2 is known as a technique for preventing data leakage to others.
JP-A-10-247906 JP 2003-223367 A

The above Patent Documents 1 and 2 have the following problems.
In Patent Document 1, after an encrypted file is created in a computer based on a fingerprint, the encrypted file is stored.
In the one disclosed in Patent Document 1, in order to decrypt data, a decryption program corresponding to the encryption program when the data is encrypted in the computer is necessary, and an environment in which this program is prepared in advance. Otherwise, it cannot be decrypted.
In Patent Document 2, when key data prepared separately from a medium is held in a computer, decrypted data can be read from the medium using the key data.
If the key data distributed by a predetermined route is not stored in the computer, it cannot be decrypted, and the data cannot be read normally when the medium is taken out.
The present invention has been made in view of the above problems, while reliably preventing the leakage of data, read the troublesome management and operation of possible possible not require carry a data storage device and data The purpose is to provide a dispensing control method.

To achieve the above object, a data writing and reading on the basis of the control of Jo Tokoro and is a storage means, and control means for controlling writing and reading of the memory means provided with a interface for connection to the outside A non-contact type IC chip reader that reads information from an external non-contact type IC chip, and the control means is connected to the external device via the connection interface from the external device. In response to the data write and read requests, the non-contact IC chip reader reads information from the external non-contact IC chip, performs predetermined authentication, and when the authentication is completed, The data is encrypted / decrypted with respect to the storage means by using the same encryption key. It may be configured to correspond to the write and read requests.

In the above configuration , data is written and read from the external device side in a state where the data storage device is connected to the external device. When writing or reading data, the control means reads information from an external non-contact type IC chip by the non-contact type IC chip reader, performs predetermined authentication, and when authentication is completed, The encryption key is generated and the encryption key is used to encrypt / decrypt data to the storage means to respond to the data write / read request.

As described above, the encryption key for encrypting / decrypting data is obtained from the external non-contact type IC chip. For this reason, a non-contact type IC chip is necessary for writing and reading, but since it is non-contact, troublesome management and operation are unnecessary.
Of course, since such a non-contact type IC chip does not need to be an individual one, it is possible to use one already owned by the user. Therefore, unless it is not owned at all, it is possible to easily and surely protect data using an existing non-contact type IC chip.
A general-purpose means can be used to read information from the non-contact type IC chip.
Therefore, the upper Symbol contactless IC chip reader, or a structure for reading information from the contactless IC chip by short-range wireless communication, the non-contact type IC chip reader, from the non-contact IC chip by the RFID It is good also as a structure which reads information .

  The short-range wireless communication is typified by near-field communication, and for example, one that performs bidirectional communication of 100 to 400 kbps at a very short distance of about 10 cm using a radio wave of 13.56 MHz is known. The RF-ID is spelled “Radio Frequency Identification” and is used for identifying an object such as merchandise distribution using a minute wireless IC chip.

In addition, the data storage device includes a storage unit that can write and read data based on predetermined control, a control unit that includes an interface for connection to the outside and controls writing and reading to the storage unit, A non-contact type IC chip reader that reads information from an external non-contact type IC chip, and the control means is connected to the external device via the connection interface and receives data from the external device. Is received, the non-contact type IC chip reader is instructed to read the unique identification number of the non-contact type IC chip from an external non-contact type IC chip. Some of the numbers have commonality based on a predetermined classification standard, and the other part of the number has a predetermined classification standard The unique identification numbers having different specificities are read from the non-contact type IC chip on the basis of, and the control means uses the portion having the commonality in the read unique identification numbers as authentication information to obtain a predetermined number. When authentication is completed, when the authentication is completed, the portion having the specificity in the read unique identification number is used as an encryption key, and the encryption key is used for a request to read the data. Thus, the data read from the storage means is decoded.
As an example of the control means, the control written above means, and said connection interface, and the authentication information holding circuit for storing predetermined authentication information, to an external non-contact type IC chip through the contactless IC chip reader together to execute reading of the unique identification information, authentication information comparison circuit for validating the verification by comparing the above authentication information based on the read out the unique identification information, and authentication information stored in the authentication information holding circuit when the encryption key generation circuit for outputting the encryption key rather based on the unique identification information read from the contactless IC chip when the verification by the authentication information comparing circuit was confirmed, to the encryption key An encryption circuit for encrypting predetermined data based on the data, a decryption circuit for decrypting the predetermined data based on the encryption key, and writing data from the external device. Response to a request for write or data read, while executing the verification by the authentication information comparison circuit, the matching is based on the encryption key by the encryption key generation circuit outputs when it is confirmed, when writing data encryption The encrypted data is encrypted by the encryption circuit using the same encryption key with the same encryption key, the encrypted data is stored in the storage means, and the encrypted data read from the storage means at the time of reading the data And a read / write control circuit for outputting the decrypted data by decrypting the data with the same encryption key by the decryption circuit.

In the above-described configuration , the authentication information comparison circuit, after causing the external non-contact IC chip to read information via the non-contact IC chip reader, authentication information based on the read information; The verification information is compared with the authentication information stored in the authentication information holding circuit to confirm the collation, and when the collation is confirmed, the cryptographic key generation circuit uses the cryptographic key based on the information read from the non-contact type IC chip. When the data is written, the encryption circuit encrypts the predetermined data based on the encryption key, and when the data is read, the decryption circuit decrypts the predetermined data based on the encryption key. Can be made.

  Therefore, the read / write control circuit performs the verification by the authentication information comparison circuit when there is a request for data writing and reading from the external device, and when the verification is confirmed, Based on the encryption key generated by the generation circuit, when the data is stored, the predetermined data that is not encrypted is encrypted by the encryption circuit using the encryption key, and the encrypted data is stored by the encryption circuit. The encrypted data read out from the storage means is decrypted by the decryption circuit by the decryption circuit using the same encryption key, and the decrypted data is output.

As an example of a storage unit, the upper Symbol storage means is a flash memory, an interface for the connection are constituted by USB interface.
In the above configuration , the encrypted data is stored in the flash memory, and the encrypted data is read from the flash memory as necessary.
As an example of the usage information, the top Symbol contactless IC chip reader, information read from the contactless IC chip is a structure which is a unique identification number of the non-contact type IC chip.
In the above configuration , the non-contact type IC chip reader reads the unique identification number of the non-contact type IC chip and uses the same information.
The non-contact type IC chip always stores a unique identification number. If this information is used, it is not necessary to write dedicated information. Moreover, since it is unique, information leakage can be prevented depending on how it is used.
Of course, if it is assumed that such a unique identification number is used, there is no need to write dedicated information, and this does not prevent the use of information other than such a unique identification number.
Preferable examples utilizing such a unique identification number, upper Symbol authentication information, are constituted by a part of the unique identification number.
It is meaningful to make authentication information completely unique, but it is also meaningful to leave room for applying commonality. In the sense of leaving commonality, it can be realized by making it a part of the unique identification number.
The upper SL contactless IC chip, a part of the unique identification number has become common on the basis of a predetermined classification criterion, the authentication information is a part that is the same common, the non In the contact IC chip, some of the unique identification numbers have specificities different from each other based on a predetermined classification standard, and the encryption key is composed of portions having the same specificity. is there.

  More specifically, when a part of the unique identification number is common based on a predetermined classification standard, the common part is used as the authentication information. For example, it is assumed that a non-contact type IC chip is distributed to employees of a company, and the employees are classified according to their department or status. If the authentication information is the information of the part common to each department to which the department belongs, if it belongs to the department to which the department belongs, the storage device of the colleague can be confirmed until authentication. On the other hand, even if the department is different, even authentication cannot be realized. When a storage device is lost in the company, it is possible to identify the department to which the user belongs, which is convenient for identifying the lost person.

In this case, since the encryption key is composed of a part of the unique identification number, even if the department to which it belongs is common, it is encrypted with a different encryption key for each individual. Even if authentication can be realized, decryption and reading of data is prevented.
Since authentication is also performed on the premise that the encryption key is used, it is only necessary that the encryption key can be combined with authentication information to achieve specificity.
Method for holding authentication information is different, the upper Symbol authentication information holding circuit, in certain circumstances through the non-contact type IC chip reader to execute the read information to the external contactless IC chip, the reading The authentication information based on the issued information is acquired and held.

In the above configuration , in a predetermined situation, the authentication information holding circuit causes the information to be read from the external non-contact type IC chip via the non-contact type IC chip reader, and the authentication information based on the read information. Get and hold.

In this way, since the information of the external non-contact type IC chip is read and held as authentication information, the non-contact type IC chip owned by the user can be prepared and the information can be used as the authentication information. .
The upper SL authentication information holding circuit, when the authentication information is not held, in a situation that is connected to the external device through the connection interface, and holds the authentication information based on the read information As a configuration.
Although it is possible to instruct the timing to capture the authentication information with a dedicated utility, etc., in the above configuration , the authentication information is not held and the connection is made to the external device via the connection interface. At this time, the authentication information holding circuit reads the information of the external non-contact type IC chip and holds the authentication information.

Therefore, the user can use the information after it is designated as the authentication information as long as the external non-contact type IC chip is brought close to the storage device when the authentication information is not yet stored.
As described above, it is not always necessary that the method for ensuring the security using the non-contact type IC chip is limited to a substantial apparatus, and it can be easily understood that the method also functions. Therefore, the possible lifting Chi carries, has a non-contact type IC chip reader to perform reading of information with respect to an external noncontact IC chip, an internal storage connected to an external device via the connecting interface a readings out control how data in a viable data storage devices and the data writing and reading with respect to unit, in a state of being connected to an external device through the connection interface, Dogaibu equipment or al Upon receiving a request for readings out of data, and it instructs to read the unique identification number of the non-contact type IC chip from the non-contact type IC chip of the outer portion to the non-contact type IC chip reader, the non-contact In the IC chip reader, some of the numbers have commonality based on a predetermined classification standard, and other parts of the number are mutually connected based on the predetermined classification standard. The unique identification number with different specificities, to read from the non-contact type IC chip, performs predetermined authentication using a portion having the commonality in the read unique identification number as the authentication information, authentication When it is completed, the portion having the specificity in the read unique identification number is used as an encryption key, and the request for reading the data is read from the storage means using the encryption key. it is constituted to perform decrypt the data.

That is, it is not necessarily limited to a substantial apparatus, and there is no difference that the method is also effective.
By the way, such a storage device may exist independently, or may be used in a state of being incorporated in a certain device, but the idea of the invention is not limited to this and includes various aspects. Therefore, it can be changed as appropriate, such as software or hardware.

When the software of the storage device is embodied as an example of the idea of the invention, it naturally exists on the storage medium storing the software and is used.
Of course, the storage medium may be a magnetic storage medium, a magneto-optical storage medium, or any storage medium that will be developed in the future. In addition, the duplication stages such as the primary duplication product and the secondary duplication product are equivalent without any question. In addition, even when the communication method is used as a supply method, the present invention is not changed.

Furthermore, even when a part is software and a part is realized by hardware, it is not completely different in the idea of the invention, and a part is stored on a storage medium, and it is appropriately changed as necessary. It may be in the form of being read.
When the present invention is realized by software, a configuration using hardware or an operating system may be used, or may be realized separately from these. For example, even if it is a variety of arithmetic processing, if it can be processed by calling a predetermined function in the operating system, it can also be input from hardware without calling such a function. is there. And even if it is actually realized under the intervention of an operating system, it can be understood that the present invention can be implemented only by this program in the process of being stored and distributed on the medium.

  When the present invention is implemented by software, the present invention is not only realized as a medium storing a program, but the present invention is naturally realized as a program itself, and the program itself is also included in the present invention.

  As described above, the present invention uses authentication and an encryption key, but such information is obtained from an external non-contact IC chip in a non-contact manner, thereby eliminating the need for troublesome management and operation, and A data storage device capable of reliably preventing leakage can be provided.

In addition, according to the present invention, it is realized as a flash memory connected by a USB interface, and at that time, an external device side does not need a program for encryption / decryption, so that it can be widely used. It becomes possible.
Furthermore, according to the present invention, since the unique identification number that is always held by the non-contact type IC chip is used, it is not necessary to write special information for such a security purpose, and preparation for use is not required. It will be easy to use.
Furthermore, according to the present invention, security can be ensured while maintaining commonness in authentication information and realizing group management, and the convenience of management is further improved.

Furthermore, according to the present invention, authentication information is acquired from a non-contact type IC chip placed nearby, so that the user can select a non-contact type IC chip that the user wants to use as a key, which is extremely convenient.

Furthermore, according to the present invention, for example, if a non-contact type IC chip is set aside when it is used for the first time, no special operation is required, which is convenient.
Furthermore, according to the present invention, by using the short-range wireless communication which is an existing technology, only non-contact type IC chips in a range that is not too far away when using a storage device are targeted, and in parallel around the periphery. Convenience can also be maintained because it does not require strict location management that does not impede use and must be connected exactly.

Furthermore, according to the present invention, by using a wireless IC chip that is expected to be used as a product tag, almost everything purchased as a product is provided and specified by each user. Everything can be used as a so-called key, and nothing special can be required.

Furthermore, according to the present invention, it is possible to provide a readings out control method of the data to obtain the same effect.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a data storage device according to an embodiment of the present invention.
In FIG. 1, a storage device 10 is a so-called portable USB flash memory, and is connected to a host (personal computer) 50 that is an external device via a USB connector 11. The non-contact IC chip 60 is a non-contact IC card that transmits predetermined information in a non-contact manner using a short-range wireless communication (near field communication: NFC) technology.

In this embodiment, a non-contact IC card using short-range wireless communication is used, but a non-contact IC card using RFID technology may be used. Of course, it is not essential that these are card-shaped.
The storage device 10 includes a control unit (corresponding to control means) 20, a memory 30, and a non-contact type IC chip reader 40 therein. A memory (corresponding to storage means) 30 is a non-volatile flash memory, has a predetermined capacity, and can write and read data to and from a storage area specified by an address bus and a data bus. The non-contact type IC chip reader 40 communicates with a non-contact type IC chip 60 located in the vicinity based on the NFC standard, and reads data written in the chip 60. In this embodiment, since only the read function is necessary, the writer function which is the write function is not provided, but the writer function may be provided. The information to be read is not particularly limited, but in this embodiment, since the unique identification number (ID) of the non-contact type IC chip 60 is used as will be described later, the unique identification number can be acquired at least. .

The control unit 20 includes a read / write control circuit 21, an encryption circuit 22, a decryption circuit 23, an encryption key generation circuit 24, an authentication information comparison circuit 25, and an authentication information holding circuit 26. Yes.
The encryption circuit 22 encrypts data using a predetermined encryption key instructed from the read / write control circuit 21. The decryption circuit 23 decrypts the encrypted data using the encryption key instructed from the same read / write control circuit 21. Read / write control circuit 21, whether or not it instructs the encryption key input from the encryption key generation circuit 24 to the decoding circuit 23 and the encryption circuit 22, encryption key in decoding the encryption key during encryption matches There is no need to judge whether. In the decryption circuit 23, if the encryption key at the time of encryption matches the encryption key at the time of decryption , the data before encryption can be restored, and if it does not match, it cannot be restored to the original data. Both the encryption circuit 22 and the decryption circuit 23 hold the encryption key only during the encryption work and the decryption work, and clear them after the work ends. This is because the possibility of data leakage increases if it is held unnecessarily inside. In this embodiment, a part of the ID described later is used as the authentication information and the other part is used as the encryption key. However, the authentication information can be used as it is in the encryption key. The encryption key generation circuit can be omitted.

  Encrypted data is stored in the memory 30, but the quality of the data does not change depending on the presence or absence of the encryption, and the memory 30 is instructed to have a predetermined bit length regardless of the presence or absence of the encryption. Write to or read from the address. In this embodiment, a flash memory is used. However, any data storage device for encrypting / decrypting to secure data can be used, so there is a storage portion and a controller portion. Other storage devices such as a hard disk and an SD memory can also be used.

  The read / write control circuit 21 transmits / receives control commands and data to / from the host 50 via the USB connector 11. In this sense, the read / write control circuit 21 forms a connection interface including the USB connector 11. Of course, this connection interface is a USB interface. When the host 50 instructs the read / write control circuit 21 to write or read data, the read / write control circuit 21 instructs the authentication information comparison circuit 25 to execute authentication.

When there is a request for authentication, the authentication information comparison circuit 25 instructs the non-contact type IC chip reader 40 to read the unique identification number from the non-contact type IC chip 60 in the vicinity. Then, the non-contact type IC chip reader 40 tries to communicate with the non-contact type IC chip 60 in the vicinity according to a protocol according to the standard. This communication is the same even if it has been carried out before that. If communication with the nearby non-contact type IC chip 60 is possible, a unique identification number is obtained for the chip 60 and acquired. The non-contact type IC chip reader 40 outputs the unique identification number as it is to the authentication information comparison circuit 25, and the authentication information comparison circuit 25 recognizes a part of it as authentication information.

Next, the authentication information comparison circuit 25 obtains authentication information held in the authentication information holding circuit 26. The authentication information holding circuit 26 holds authentication information in advance as described later, and outputs it to the authentication information comparison circuit 25.
The authentication information comparison circuit 25 compares the authentication information, which is a part of the unique identification number obtained from the non-contact type IC chip reader 40, with the authentication information obtained from the authentication information holding circuit 26. It is determined that authentication is complete. When the authentication is completed, the authentication information comparison circuit 25 outputs the unique identification number obtained from the non-contact type IC chip reader 40 to the encryption key generation circuit 24, and the encryption key generation circuit 24 outputs the encryption key to the read / write control circuit. To 21.

Here, when the authentication information comparison circuit 25 does not complete the authentication, whether to output the determination that the authentication has not been completed to the read / write control circuit 21 via the encryption key generation circuit 24 is determined. Is also possible.
If the authentication is not completed, the unique identification number is not output, and the encryption key generation circuit 24 cannot generate the encryption key. The encryption key generation circuit 24 generates an encryption key based on the unique identification number given from the authentication information comparison circuit 25. When the encryption key is output, the internal storage area is immediately cleared. Then, unless a unique identification number is given next time, neither a new encryption key nor a previous encryption key can be output.

  Accordingly, if the authentication is not completed, the encryption key generation circuit 24 cannot generate the original encryption key, and in this state, the read / write control circuit 21 has not completed the authentication based on the fact that the encryption key is not generated. It can be judged. As a result, subsequent control of reading and writing of data from the host 50 is rejected.

  On the other hand, when the authentication is completed, the unique identification number is output, and the encryption key generation circuit 24 generates the correct encryption key. Therefore, the encryption circuit acquires the encryption key via the read / write control circuit 21. 22 and the decryption circuit 23 can read and write data with security.

  As will be described later, it is possible to create a situation in which a correct encryption key cannot be generated, although only authentication can be completed by group management of authentication information. In this case, although the authentication is simply completed, it is not a correct non-contact IC chip 60, so the unique identification number is different, and an encryption key different from the original is generated by the encryption key generation circuit 24, and the read / write control circuit An incorrect encryption key is output to the encryption circuit 22 and the decryption circuit 23 via 21. If the data reading itself is performed as it is, reading the data decrypted with an incorrect encryption key has no utility value. Although the data writing itself is performed by encryption, it does not make sense to write the data to a data storage that is not its own. Therefore, any problem does not occur.

  Group management can be performed by setting all or part of the unique identification number of the non-contact type IC chip 60 in accordance with a predetermined classification standard. For example, when the non-contact type IC chip 60 is used as an identification card in a company, a certain part of 5 digits represents the department to which the department belongs, and the other 5 digits are made different within each department. Assign to each individual. If such a classification standard is applied, the common 5 digits are assigned to the authentication information and the unique 5 digits are assigned to the encryption key. You can be able to confirm until. However, since the five digits of the encryption key have a characteristic for each individual, data cannot be read out.

Authentication information, when obtained authentication information from the first authentication information comparing circuit 25, the authentication information part of the unique identification number read from the non-contact type IC chip reader 40 the authentication information holding circuit 26 holds Remember as. In this way, the user simply prepares the non-contact type IC chip 60 that the user wants to use as a key when using it for the first time, and uses the non-contact type IC chip 60 for generating authentication information and an encryption key for subsequent use. It can be used like a key. Of course, the authentication information may be written by other methods. For example, a utility program for rewriting authentication information can be loaded on the host 50 and written via the read / write control circuit 21. Control at the time of writing such data is a write control method, and control at the time of reading the data is a read control method.

Next, the operation of the present embodiment configured as described above will be described.
FIG. 2 is a flowchart showing the operation when the authentication information holding circuit 26 does not hold the authentication information. As shown in the figure, when it is determined that there is no authentication information in the authentication information holding circuit 26 in step S102, the unique identification number (from the non-contact type IC chip reader 40 to the non-contact type IC chip 60 (step S104). (Hereinafter referred to as ID), and a part of the ID read in step S106 is written in the authentication information holding circuit 26 as authentication information.

FIG. 3 is a flowchart showing an operation at the time of reading and writing data in a state where the authentication information is held in the authentication information holding circuit 26.
When there is a data write or read request from the host 50, in step S110, the non-contact IC chip reader 40 performs a process of reading the ID from the non-contact IC chip 60 located in the vicinity. That is, the read / write control circuit 21 receives a control command from the host 50 and instructs the authentication information comparison circuit 25 to execute authentication. Then, the authentication information comparison circuit 25 instructs the non-contact type IC chip reader 40 to read the ID from the non-contact type IC chip 60 in the vicinity, and the non-contact type IC chip reader 40 conforms to the standard. The communication with the non-contact type IC chip 60 in the vicinity is attempted in accordance with the protocol . If communication with the nearby non-contact type IC chip 60 is possible, the non-contact type IC chip reader 40 obtains an ID from the chip 60 and outputs the obtained ID to the authentication information comparison circuit 25 as it is. The authentication information comparison circuit 25 recognizes a part thereof as authentication information.

  In step S112, the authentication information comparison circuit 25 compares the authentication information that is a part of the ID obtained from the non-contact type IC chip reader 40 with the authentication information held by the authentication information holding circuit 26. In step S114, when the comparison result matches, that is, when the authentication is completed, the process proceeds to step S116. If the control command from the host 50 is data write (write), a part of the ID is encrypted in step S118. The data sent out from the host 50 following the control command is encrypted and written to the memory 30. If the control command from the host 50 is a data read (read), a part of the ID is encrypted in step S120. Data corresponding to a control command from the host 50 is decoded as a key while being read from the memory 30 and sent to the host 50. Of course, the data write and read addresses at this time are specified based on separately prescribed processing.

  More specifically, at the time of writing, the ID obtained from the non-contact type IC chip reader 40 is output to the encryption key generation circuit 24, and the encryption key generation circuit 24 reads / writes a part of the ID as an encryption key. Output to the control circuit 21. The read / write control circuit 21 outputs the encryption key to the encryption circuit 22, and then outputs the data sent from the host 50 to the encryption circuit 22. The encryption circuit 22 encrypts the data based on the encryption key. The data is output to the memory 30 and written sequentially. At the time of reading, the encryption key generated by the encryption key generation circuit 24 to the read / write control circuit 21 is output to the decryption circuit 23 based on the ID obtained from the non-contact type IC chip reader 40. The circuit 23 decodes and sequentially outputs the data read from the memory 30, and the decoded data is output to the host 50 through the read / write control circuit 21.

  Here, if an illegally obtained data storage is connected to its own personal computer and attempts to read it, the authentication is not completed unless there is an original non-contact type IC chip. That is, in step S114, it is determined that the authentication information does not match, and in step S122, the writer read / write is disabled, and the process ends.

4 to 6 show another embodiment for realizing a substantially similar object.
FIG. 4 shows a schematic operation. When the data storage (device) is inserted into the USB connector of the host 50 in step S202, it is determined that there is authentication information based on the presence or absence of authentication information in the authentication information holding circuit in step S204. If it is determined, the process proceeds to step S206 to execute the normal operation, and if it is determined that there is no authentication information, the process proceeds to step S208.

  In this embodiment, three operations are shown as operations when there is no authentication information. 1) Operate as a USB flash device that cannot perform normal encryption or decryption. 2) Do not operate at all. 3) Authentication It is possible to cope with whether the host 50 starts the information automatic registration screen. To realize operation as a USB flash device that cannot be decrypted by encryption, the encryption circuit 22 or decryption is performed so that if encryption or decryption is performed without providing an encryption key, encryption or decryption is not performed at all. This can be realized by configuring the circuit 23. Processing that does not operate at all can be realized by preventing the read / write control circuit 21 from performing subsequent processing when there is no authentication information. The activation of the authentication information automatic registration screen on the host 50 can be realized by storing a program to be executed on the host 50 in advance in the data storage and loading the program on the host 50 for execution.

  FIG. 5 shows the data flow and processing during data writing in normal operation. In the figure, the host 50 requests data writing in step S212. Based on the request, the control unit 20 makes an ID acquisition request in step S214. Based on the request, the non-contact type IC chip reader 40 obtains an ID from the nearby non-contact type IC chip 60 in step S216. In step S218, the control unit 20 uses a part of the acquired ID as authentication information and collates it with the authentication information of the authentication information holding circuit. If collation is not possible (NG), an error is notified in step S220. In this embodiment, it is possible to implement one of two types: a response that indicates that the access key (authentication information) is invalid and does not operate, and a response that denies access to the data area.

  On the other hand, when the authentication is completed (OK), the host 50 sequentially writes unencrypted data in step S222, and in the control unit 20, the encryption circuit 22 uses a part of the ID as an encryption key in step S224. Then, the data is encrypted, and the encrypted data is written into the memory 30 in step S226.

  Next, FIG. 6 shows the data flow and processing at the time of data reading in the normal operation. In the figure, the host 50 requests data reading in step S232. Based on the request, the control unit 20 makes an ID acquisition request in step S234. Based on the request, the non-contact type IC chip reader 40 acquires an ID from the nearby non-contact type IC chip 60 in step S236. In step S238, the control unit 20 uses a part of the acquired ID as authentication information and collates it with the authentication information of the authentication information holding circuit. If collation is not possible (NG), an error is notified in step S240. In this embodiment, it is possible to implement one of two types, a response such as displaying that the access key (authentication information) is invalid and denying data access, or a response not decrypting encrypted data. Yes.

  On the other hand, when the authentication is completed (OK), the memory 30 reads the encrypted data in step S242, and in the control unit 20, the decryption circuit 23 uses part of the ID as an encryption key in step S244. The data is decrypted using the data, and the data decrypted in step S246 is read out to the host 50.

In this way, the unique identification number is read from the non-contact type IC chip 60 as a key via the non-contact type IC chip reader 40 at the time of data writing or reading, and the authentication information comparison circuit 25 is read based on the unique identification number. If the authentication is completed, the encryption circuit 22 encrypts the data and the decryption circuit 23 decrypts the data, and the non-encrypted data written from the host 50 is encrypted and recorded. In addition, the encrypted data is read from the memory 30 and decrypted, and then output to the host 50.

It is a block diagram which shows schematic structure of the data storage concerning one Embodiment of this invention. It is a flowchart at the time of making the authentication information holding circuit hold | maintain the authentication information in the data storage device concerning a 1st Example. It is a flowchart at the time of the writing and reading of the data in the data storage device concerning a 1st Example. It is a whole flowchart of the operation | movement in the data storage device concerning a 2nd Example. It is a flowchart at the time of the data writing in the data storage device concerning a 2nd Example. It is a flowchart at the time of the reading of the data in the data storage device concerning a 2nd Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Data storage device 20 ... Control part 30 ... Memory 40 ... Non-contact type IC chip reader 50 ... Host 60 ... Non-contact type IC chip

Claims (8)

Storage means capable of writing and reading data based on predetermined control;
A control means having an interface for connection with the outside and controlling writing and reading with respect to the storage means;
A non-contact type IC chip reader for reading information from an external non-contact type IC chip;
Said control means, in a state of being connected to an external device through the connection interface, when receiving a request for the out readings of Dogaibu equipment or La Defense over data, the external to the contactless IC chip reader Instructing to read the unique identification number of the non -contact type IC chip from the non-contact type IC chip,
In the non-contact type IC chip reader, some of the numbers have commonality based on a predetermined classification standard, and other parts of the number have different specificities based on the predetermined classification standard. Read the unique identification number from the non-contact type IC chip,
The control means performs predetermined authentication using the portion having the commonality in the read unique identification number as authentication information, and when the authentication is completed, in the read unique identification number, and partial encryption key having the specificity for the request for reading data, using the same encryption key, portable, characterized in that to perform decrypt the data read out from the memory means Data storage device. The control means includes
The connection interface;
An authentication information holding circuit for storing predetermined authentication information;
Together to execute reading of the unique identification information for the external non-contact type IC chip through the contactless IC chip reader, and the authentication information based on the read out the unique identification information, stored in the authentication information holding circuit An authentication information comparison circuit for confirming the verification by comparing with the authentication information being performed,
And encryption key generation circuit for outputting the encryption key rather based on the unique identification information read from the contactless IC chip when the verification by the authentication information comparing circuit can be confirmed,
An encryption circuit for encrypting predetermined data based on the encryption key;
A decryption circuit for decrypting predetermined data based on the encryption key;
In response to a request for data writing or data reading from the external device, while performing verification in the authentication information comparison circuit,
Based on the encryption key output from the encryption key generation circuit when the verification is confirmed, the encryption circuit encrypts predetermined data that is not encrypted at the time of data writing with the encryption key, Storing the encrypted data in the storage means,
And a read / write control circuit for outputting the decrypted data by decrypting the encrypted data read from the storage means by the decryption circuit with the same encryption key when reading the data. The data storage device of claim 1 The authentication information holding circuit, in certain circumstances through the non-contact type IC chip reader to execute the reading of the unique identification information for the external non-contact type IC chip, the authentication based on the read out the unique identification information The data storage device according to claim 2 , wherein the information is acquired and held. The authentication information holding circuit, when the authentication information is not held, in a situation that is connected to the external device through the connection interface, holds the authentication information based on the read unique identification information The data storage device according to claim 3 , wherein the data storage device is a data storage device. The storage means is composed of a flash memory,
The data storage device according to any one of claims 1 to 4, wherein the connection interface includes a USB interface. 6. The data storage device according to claim 1, wherein the non-contact type IC chip reader reads information from the non-contact type IC chip by short-range wireless communication. 6. The data storage device according to claim 1, wherein the non-contact type IC chip reader reads information from the non-contact type IC chip by RFID. It has a non-contact type IC chip reader that can be carried and reads information from an external non-contact type IC chip, and is connected to an external device via a connection interface to store data in an internal storage means. a write and read and readings out control how data in a viable data storage devices,
In a state of being connected to an external device through the connection interface, when receiving a request for the out readings of Dogaibu equipment or La Defense over data, the non-contact type IC chip of the outer portion to the non-contact type IC chip reader Instructing to read the unique identification number of the non-contact type IC chip from
In the non-contact type IC chip reader, some of the numbers have commonality based on a predetermined classification standard, and other parts of the number have different specificities based on the predetermined classification standard. Having the unique identification number read from the non-contact type IC chip,
Predetermined authentication is performed using the portion having the commonality in the read unique identification number as authentication information, and when the authentication is completed, the uniqueness in the read unique identification number has the specificity. the partial encryption key, for a request for reading data, using the same encryption key, readings out control method of the data and performing decrypt the data read out from the memory means .

Images