JP2001256004A - Information storage and reproduction system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable restriction of access of a host system to user data in a storage device with respect to the storage device to be attachably/detachably connected with the host system. SOLUTION: Authentication data for access control to be used in judgment of propriety of the access of the host system to the user data in the storage device are created in cooperation with the storage system and the host system and stored in both. And the storage device controls the access of the host system to the user data in the storage device based on the authentication data for access control stored in the host system and the authentication data for access control stored in the storage device in the case of judgment of the propriety of the access.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information storage / reproduction system having a storage device for storing user data and a host system for removably connecting the storage device to access the storage device. The present invention relates to an information storage / reproduction system capable of limiting a host system that accesses a computer to a specific system.

[0002]

2. Description of the Related Art Recent hard disk drives (HD)
D) and a storage device such as a CD-ROM can be used in a detachable form with a host system such as a personal computer. For example, by removing the storage device from the currently connected host system, another storage device can be used. It can also be used by connecting to a host system.

For this reason, another host system can access the storage device, and there is a problem in security.

In order to solve this problem, conventionally,
A security method for restricting access from a host system to a storage device has been realized. In this conventional security method, a password created by a host system (entered by a user in the host system)
Is stored in the storage device in advance. When the host system accesses the storage device, whether the password (input by the user in the host system) transmitted from the host system in the storage device matches that stored in the storage device in advance. It is determined whether or not the access is permitted, and if they match, access is permitted to the host system.

However, in this security system, even if the host system is different, if the password transmitted from the host system to the storage device matches, the storage device permits access regardless of the difference between the host systems. Therefore, if the password previously stored in the storage device is known to another person, there is a problem that another person can illegally access the password from another host system.

As a technique for controlling access to user data recorded on a recording medium, Japanese Patent Laid-Open No.
No. 24456 describes a method of controlling access of an information processing apparatus to an optical disk. In this conventional technique, the ID of an optical disc and a random number generated when the optical disc is accessed are stored in an information processing apparatus.
The same random numbers as those described above and the ID of the information processing device are stored on the optical disk. Then, when the information processing apparatus accesses the optical disc again, the information processing apparatus determines whether all three pieces of information (the optical disc ID, the random number, and the information processing apparatus ID) stored in both of them match, If they do not match, access to the optical disk is rejected.

However, according to this method, the access from the information processing device cannot be controlled on the optical disk on which access is performed. Therefore, for example, when an information processing device that is illegally configured to access the optical disk by ignoring the above-described control is used, and the optical disk is illegally accessed, the optical disk side performs unauthorized access from the information processing device. Cannot be suppressed.

[0008]

As described above, in the conventional security method, access to the storage device is permitted if the password is correct regardless of the difference in the host system to be accessed. Knows the password, and the password may be used for unauthorized access from a host system owned by another person, but there is a problem that unauthorized access from a host system owned by another person cannot be suppressed. . Further, in the method described in Japanese Patent Application Laid-Open No. H11-224456, there is a problem that if an unauthorized information access is performed by the accessing information processing apparatus, the unauthorized access cannot be suppressed on the accessed optical disk.

The present invention has been made in view of the above circumstances, and has a storage device and a host system that can restrict access to the storage device to a specific host system on the storage device side. It is an object to provide an information storage and reproduction system.

[0010]

According to the information storage / reproduction system of the present invention, the access data created by the storage device based on the authentication data created by the host system is stored in the authentication data storage means of each of the host system and the storage device. The authentication data for control or the authentication data for access control created by the host system based on the authentication data created by the storage device is stored. The control unit of the storage device controls access to the user data from the host system based on the access control authentication data stored in the host system and the access control authentication data stored in the storage unit. .

As described above, by using the access control authentication data created by both the host system and the storage device, it is possible to restrict access to the user data of the storage device to only a specific host system. Become.

[0012]

DESCRIPTION OF THE PREFERRED EMBODIMENTS (Configuration of Storage Device) First, the configuration of a storage device according to the present embodiment will be described. Here, the storage device is, for example, a magnetic disk device such as an HDD and an FDD,
It is used by being detachably connected to a host system, such as a magneto-optical disk device such as a DVD, an MO, a CD-ROM, and an MD, a magnetic tape storage device, and a storage device using a semiconductor memory.

In this embodiment, an HDD is assumed as a storage device as shown in FIG. The HDD is roughly divided into a disk 1 as a storage medium for storing user data.
And a head 3 for executing a data read / write operation, a read / write data signal processing system, and a control system. The disk 1 is rotated by a spindle motor (SPM) 2. In the head 3, a read head and a write head are usually mounted on the same slider. The head 3 is mounted on an actuator 4 and is moved in the radial direction of the disk 1. The actuator 4 is configured to be driven to rotate by using a voice coil motor (VCM) 5 as a drive source. The SPM 2 and VCM 5 control the SP under the control of the CPU 12 described later.
A drive current is supplied from the M / VCM driver 6 to drive. The SPM / VCM driver 6 normally has the CPU 12
, A digital control value is input through the gate array 11, and a drive current is output according to the control value.

The signal processing system has a head amplifier 7 and a read / write channel 8. The head amplifier 7 amplifies the read signal read from the head 3 and sends it to the read / write channel 8. Also, the head amplifier 7
The write signal (encoded recording data) processed by the read / write channel 8 is converted into a current and supplied to the head 3. The read / write channel 8 has an encoder and a decoder, and converts write data from the host system 200 into a write signal and decodes a read signal read from the disk 1 into original write data. Execute various signal processing.

The control system has a hard disk controller (HDC) 9, a CPU 12, and a gate array 11. The HDC 9 controls data transfer to and from the host system 200.
0 is temporarily stored in the buffer memory 10.
The control is performed such as to be stored in the memory. HDC9
Has various registers required to execute the ATA command, as shown in FIG. The CPU 12 executes an authentication process according to the present embodiment, which will be described later, according to a control program stored in the ROM 13. The gate array 11 mainly corresponds to an interface control circuit that controls input / output of control signals of the CPU 12 and servo data from the read / write channel 8. (Authentication Process on Storage Device) The authentication process on the storage device will be described below.

As shown in FIG. 2, the HDC 9 of the ATA interface specification has various registers necessary for executing the command. Of these various registers, the HDC 9 is used in the authentication processing of the present embodiment. Registers are a command register, a sector count register, and an error register. The command register is stored in the host system 20.
Various commands transmitted from 0 are stored. The sector count register stores information indicating the data size transmitted from the host system 200 and the data size transmitted from the storage device 100. The error register is
Information indicating a response of the storage device 100 to a command transmitted from the host system 200 is stored.

Hereinafter, the authentication processing on the storage device side will be described.
Here, the authentication processing in the storage device 100 is executed after the storage system 100 is powered on from the host system 200 side, and responds to various commands transmitted from the host system 200. Performed in form. (Operation for confirming presence / absence of storage of secondary authentication data in storage device)
FIG. 3 is a flowchart illustrating a process in the storage device that responds to the host system 200 as to whether or not secondary authentication data is stored.

The secondary authentication data is authentication data created jointly by the storage device 100 and the host system 200 using the unique information of both. In the storage device 100, the secondary authentication data stored in both are stored. By comparing the data, it is determined whether to permit access to the host system 200. Also, here, the description will be given below on the assumption that neither the storage device 100 nor the host system 200 stores the secondary authentication data.

First, an authentication data confirmation command (8Dh) is transmitted from the host system 200 to the storage device 100 to confirm whether or not the secondary authentication data is stored in the storage device 100. And the storage device 10
In the HDC 9 of 0, the authentication data confirmation command (8Dh) is written in the command register.

Here, the authentication command is (8D
h), the combination of three character codes is described as an example.
Any combination other than the combination of the character codes of the characters may be used. Further, in the following description, various commands transmitted by the host system 200 are exemplified by a combination of predetermined three-character character codes, but these are the three-character character codes currently employed in the ATA command. Are shown as examples other than the combination of
Any combination may be used as long as it is not adopted in the A command.

When the authentication data confirmation command (8Dh) is written in the command register of the HDC 9, the CPU 12 of the storage device 100 reads the authentication data confirmation command (8Dh) from the command register of the HDC 9 (step S1). The contents of the command are confirmed (step S2). The command is an authentication data confirmation command (8D
If not h), a process corresponding to another command that has been read is performed (No in step S2), but in this case, it is confirmed that the command is an authentication data confirmation command (8Dh) (Yes in step S2). And then the CPU 12
Confirms whether the secondary authentication data is stored, and writes the confirmation result into the error register of the HDC 9 (step S3). Here, the secondary authentication data may be stored in any one of the disk 1, the ROM 13 (a rewritable ROM such as a flash ROM), and the RAM (not shown) in the CPU 12, but in the present embodiment, for example, It is stored in the ROM 13. In this case, C
In step S3, the PU 12 stores the second
It is determined whether or not the next authentication data is stored, and the result is written to the error register of the HDC 9. This H
When the secondary authentication data is stored in the error register of the DC 9 as information indicating the recognition result, (00
h) is set, while (0) if not stored
4h) is set. Here, since it is assumed that neither the storage device 100 nor the host system 200 stores the secondary authentication data, the ROM 13 of the storage device 100 does not store the secondary authentication data,
The CPU 12 writes information (04h) indicating that the secondary authentication data is not stored in the error register.
The contents stored in each register of the HDC 9 at this time are shown in FIG. After writing the check result in the error register, the CPU 12 ends the process for the authentication data check command (8Dh) transmitted from the host system 200.

As a result, on the host system 200 side,
By reading the storage contents (04h) of the error register of the HDC 9, it is recognized that the secondary authentication data is not stored in the storage device 100. Thereafter, the host system 200 performs processing to confirm whether or not the secondary authentication data is stored in the host system 200 itself, and determines that the secondary authentication data is not stored in the host system 200. In this case, the host system 200 performs a process of creating secondary authentication data so that the storage system 100 can be accessed by establishing a new connection relationship with the storage system 100. .

On the other hand, when it is determined that the secondary authentication data is stored in the host system 200, a process of not accessing the storage device 100 is performed in the host system 200. . That is, in this case, the host system 200 is in a state where access to another storage device is permitted. According to the present invention, control is performed such that access of a specific host system is limited to only a specific storage device. Therefore, the host system 200 denies access to the storage device 100 that is to be accessed this time so as to prevent access to other storage devices than the other storage devices to which access is permitted. The processing on the host system 200 side described here will be described later in detail.

Here, the host system 200 also has the second
Since the secondary authentication data is not stored, the host system 200 creates secondary authentication data in order to establish a new connection relationship with the storage device 100 and access the storage device 100. Will be taken. In response to the secondary authentication data creation processing on the host system 200 side, the storage device 100 performs a secondary authentication data creation operation described below.

(Operation of Creating Secondary Authentication Data on Storage Device) The operation of creating secondary authentication data on the storage device 100 will be described with reference to the flowchart shown in FIG.

When the host system 200 moves to the process of creating the secondary authentication data, first, the host system 2
From 00, information (01h) indicating the data size of the primary authentication data to be transmitted is transmitted to the storage device 100, and subsequently, a primary authentication data transmission command (8Fh)
Is sent. When information (01h) indicating the data size of the primary authentication data and the primary authentication data transmission command (8Fh) are transmitted from the host system 200, as shown in FIG. (01h), (8Fh) is written to the command register. Here, since the data size of the primary authentication data is 512 bytes, (01h) is transmitted as information indicating that.

The CPU 12 reads the primary authentication data transmission command (8Fh) from the command register of the HDC 9 (step S11), and confirms the content of the command (step S12). If the command is not the primary authentication data transmission command (8Fh), a process corresponding to another read command is performed (No in step S12).
In this case, since it is confirmed that the command is the primary authentication data transmission command (8Fh) (Yes in step S12), the primary authentication data transmitted from the host system 100 is received and stored in the buffer memory 10. CPU 12
Confirms that there is no error in the received primary authentication data, and stores the contents of the error register of HDC 9 into (00
h), and notifies the host system 200 that there is no error (step S13).

For example, as shown in FIG. 6, the primary authentication data is created in the host system 200 based on the unique information of the host system 200 and the date and time information when the primary authentication data is created. It was done. In this example, a manufacturer name (TOSHIBA), a model name (Satellite2550X), and a serial number (99017796) are used as the unique information of the host system 200. Also, date and time information (1999-09-13, 19:40:00) is used. Primary authentication data is 512 bytes (0000h to 01FFh)
In FIG. 6, 0000h to 00h are shown in FIG.
Data indicating the above-mentioned unique information is described in 20h, and there is no data description in 0030h to 01FFh thereafter, and all data are "00h". Of course, this 30000h
It is also possible to create longer primary authentication data in which data is described in 01FFh.

Subsequently, the CPU 12
00 and the storage device 100
The secondary authentication data is created from the unique information (step S14). Here, the unique information of the storage device 100 is stored in the disk 1, the ROM 13, and the RA (not shown) in the CPU 12.
M may be stored in any of M, but in this embodiment,
It is stored in the ROM 13. The secondary authentication data created in the CPU 12 is shown in FIG. The data size of the secondary authentication data is 512 bytes,
The first 256 bytes (0000h to 00FFh) of the first half are the primary authentication data created on the host system 200 side, and the second half 256 bytes (0100h to 01FF).
h) to which the unique information of the storage device 200 is added. The unique information of the storage device 100 is the manufacturer name (TOSHIB
A), model name (MK6411MAT), serial number (Z8G50891
G). The created secondary authentication data is temporarily C
It is stored in a RAM (not shown) in the PU 12.

When the CPU 12 creates the secondary authentication data, the CPU 12 sets (04h) in the error register of the HDC 9 to notify the host system 200 that the secondary authentication data has been created without error. Primary authentication data transmission command transmitted (8Fh)
The processing for is ended. (Transmission of Secondary Authentication Data) The transmission operation of the secondary authentication data on the storage device side will be described with reference to the flowchart shown in FIG.

In order to request the transmission of the secondary authentication data from the host system 200, information (01h) indicating the data size (512 bytes) of the secondary authentication data to be transmitted is transmitted to the storage device 100. Subsequently, a secondary authentication data reception command (81h) is transmitted. At this time, as shown in FIG. 9, (01h) is written in the sector count register of the HDC 9, and a secondary authentication data reception command (81h) is written in the command register.

The CPU 12 reads the secondary authentication data reception command (81h) from the command register of the HDC 9 (step S21), and confirms the contents of the command (step S22). If the command is not the secondary authentication data reception command (81h), processing for another read command is performed (No in step S22). In this case, the command is the secondary authentication data reception command (81h). (Yes in step S22), the CP
U12 sets (00h) in an error register of the HDC 9 to notify the transmission of the secondary authentication data to the host system 200, and then stores the secondary authentication data stored in a RAM (not shown) in the CPU 12. Is transmitted to the host system 200, and after the transmission of the secondary authentication data to the host system 200 is completed, the secondary authentication data is stored in the ROM 13 (step S2).
3). After performing the processing in step S23, the CPU 12 ends the processing for the secondary authentication data reception command (81h) transmitted from the host system 200.

Thereafter, the secondary authentication data transmitted by the storage device 100 is stored in the host system 200. As a result, a one-to-one connection relationship is established between the storage device 100 and the host system 200. Therefore, on the storage device 100 side, by performing the processing of step S23, the CPU 12 permits the host system 200 to access the user data of the disk 1. On the other hand, in response to the transmission of the secondary authentication data from the storage device 100, the host system 200 recognizes that access to the user data of the disk 1 of the storage device 100 has become possible.

The timing at which the storage device 100 stores the secondary authentication data is determined by the host system 20.
0 after the transmission of the secondary authentication data is terminated because the power of the host system 200 is erroneously turned off before the host system 200 receives the secondary authentication data and only the storage device 100 receives the second authentication data. This is to avoid storing the next authentication data. According to the present invention, when the secondary authentication data is stored only in the storage device 100, the storage device 100 is permitted to access another host system. Access to the host system is not permitted (the operation at this time will be described later in detail). For this reason, if the secondary authentication data is stored only in the storage device 100 due to the power-off of the host system 200, the storage device 100 and the host system 2
00, the access to the storage device 100 is not permitted when performing the authentication process. However, as described above, the storage of the secondary authentication data in the storage device 100 is performed by the host system 200. By transmitting the second authentication data to the server, such a problem can be avoided.

The secondary authentication data set as described above is stored in the storage device 100 and the host system 2.
The method of releasing from 00 is the same as the method of releasing the password of the security command described in the conventional ATA interface specification. That is, a command capable of instructing the user to erase the secondary authentication data from the host system 200 is provided, and the secondary authentication is performed by both the storage device 100 and the host system 200 in accordance with the command instruction from the user. Try to erase data storage. The process of erasing the secondary authentication data is performed in the storage device 10
0 is the same for both the host system 200 and the storage contents are erased by writing (00h) to the entire storage area storing the secondary authentication data. (Comparison Operation of Secondary Authentication Data) After the secondary authentication data is created as described above, every time the power of the storage device 100 is turned on from the host system 200 to the storage device 100, Then, the storage device 100 compares the secondary authentication data stored in both, and determines whether to permit access to the host system 200. The operation of comparing the secondary authentication data of the storage device 100 will be described with reference to the flowchart shown in FIG.

Information (01h) indicating the data size (512 bytes) of the secondary authentication data to be transmitted from the host system 200 to the storage device 100, and the second
When the next authentication data transmission command (F4h) is transmitted,
As shown in FIG. 11, (01h) is written in the sector count register of the HDC 9 of the storage device 100, and the secondary authentication data transmission command (F4h) is written in the command register.

The CPU 12 reads the secondary authentication data transmission command (F4h) from the command register of the HDC 9 (step S31), and confirms the content of the command (step S32). If the command is not the secondary authentication data transmission command (F4h), processing for another read command is performed (No in step S32). In this case, the command is the secondary authentication data transmission command (F4h). Is confirmed (Yes in step S32).

The CPU 12 receives the secondary authentication data transmitted from the host system 100 and stores it in the buffer memory 10. (Step S33). At this time, CP
U12 writes (00h) in the error register of HDC 9 to notify the host system 100 that the secondary authentication data has been received without error.

Subsequently, the CPU 12
00 and the secondary authentication data transmitted from the storage device 100
The secondary authentication data stored on the side (that is, the ROM 13
(Secondary authentication data) stored in the storage device. Secondary authentication data of host system 200 and storage device 10
As a result of comparison with the secondary authentication data on the 0 side, if it is determined that they match, the CPU 12 writes (00h) in the error register of the HDC 9 and sends the host system 200 the user data on the disk 1. Notify that access is allowed. On the other hand, if they do not match, HDC9
(04h) is written to the error register of (1) to notify the host system 200 that access to the user data of the disk 1 is not permitted (step S34).
When the CPU 12 writes the comparison result of the secondary authentication data to the error register of the HDC 9, the host system 200
Authentication data transmission command (F4
The comparison processing of the secondary authentication data for h) ends.

Thereafter, on the host system 200 side, H
The content of the error register of the DC 9 is confirmed. If the content of the error register is (00h), the storage device 100
Determines that the two pieces of secondary authentication data match, recognizes that access to the user data of the disk 1 has been permitted, and takes a state in which the user data of the disk 1 can be accessed thereafter. On the other hand, if the content of the error register is (04h), the host system 200 determines that the storage device 100 has determined that the two secondary authentication data do not match, and denies access to the user data on the disk 1. Then, a state in which the user data of the disk 1 of the storage device 100 is not accessed thereafter is set. Then, the host system 200 notifies the user that access to the storage device 100 has been prohibited on a display screen (not shown) or the like. (Authentication processing on the host system side) Next, the authentication processing on the host system 200 side will be described below.

The host system 200 is various computers such as a personal computer and a general-purpose computer. The host system 200, as shown in FIG.
ATA interface circuit 21, CPU 22, ROM
23, a RAM 24, an RTC 25, and the like.
The ATA interface circuit 21 controls data transfer with the storage device 100 using an ATA standard interface. The CPU 22 is a main control device of the host system 200, and includes a ROM 23, an R
The authentication process is performed according to the control program stored in the AM 24. The ROM 23 stores the host system 200
Is stored. The RAM 24 stores the secondary authentication data. The RTC 25 outputs current date and time information.

The authentication processing of the host system 100 is shown in FIG.
This will be described with reference to FIGS.

First, the CPU 22 transmits an authentication data confirmation command (8Dh) to the storage device 100 via the ATA interface circuit 21 in order to inquire whether or not the secondary authentication data is stored in the storage device 100. (Step S41). Next, in response to the authentication data confirmation command (8Dh), the CPU 22 refers to the storage content written in the error register of the HDC 9 of the storage device 100, so that the secondary authentication data is stored in the storage device 100. Is determined (step S4).
2).

When the content of the error register of the HDC 9 of the storage device 100 is (00h), the CPU 22
The storage device 200 determines that the secondary authentication data is not stored (No in step S42), and then determines whether or not the secondary authentication data is stored in the host system 100 itself. It is determined whether the secondary authentication data is stored (step S43).

When the secondary authentication data is not stored on the host system 200 side (N in step S43).
o) Since both the host system 200 and the storage device 100 do not store the secondary authentication data, a new connection relationship is established between the host system 200 and the storage device 100 in this case. In order to obtain access permission to the storage device 100, step S4 described below
4 to step S48 are performed.

The CPU 22 creates primary authentication data (FIG. 6) based on the unique information stored in the ROM 23 and the date and time information output from the RTC 25 (step S4).
4). Then, the CPU 22 first transmits the created primary authentication data to the storage device 100,
0, the data size of the primary authentication data to be transmitted (5
12h) (01h), followed by
A primary authentication data transmission command (8Fh) is transmitted.
After transmitting the primary authentication data transmission command (8Fh), the CPU 22 stores the primary authentication data in the storage device 100.
(Step S45).

Next, the CPU 22 requests the storage device 100 to transmit the secondary authentication data created by the storage device 100 to the storage device 100 so that the data size of the secondary authentication data ( (512 bytes), and then a secondary authentication data reception command (81h) is transmitted (step S46). The storage device 100 stores the secondary authentication data reception command (81
h) to confirm that the error register of the HDC 9 has been set to (00h) in order to notify the transmission of the secondary authentication data in response to the transmission of h).
The next authentication data is received and stored in the RAM 24 (step S47). Then, the CPU 22 executes the storage device 100
Recognizes that access to the user data of the disk 1 of the storage device 100 has been permitted, and the subsequent storage device 1
00 (step S4).
8).

On the other hand, if the CPU 22 determines in the determination in step S43 that the secondary authentication data is stored in the RAM 24 (Yes in step S43),
Since the secondary authentication data is stored only on the host system 200 side, it is determined that access to the storage device 100 is not permitted, and the access to the storage device 100 is stopped (step S49). ). That is, in this case, since the host system 200 can access other storage devices, the CPU 22
Makes access to the storage device 100 that is to be accessed this time non-permitted so as to control access to storage devices other than the other storage devices to which access is permitted.

Next, in the above-mentioned judgment in step S42,
The case where it is determined that the secondary authentication data is stored in the storage device 100 will be described below.

The CPU 22 determines in step S42
If it is determined that the secondary authentication data is stored in the storage device 100 (Yes in step S42), then, it is determined whether the secondary authentication data is stored in the host system 200 itself (step S50). . The processing in step S50 is the same as step S43 described above, and is performed by the CPU 22 determining whether the secondary authentication data is stored in the RAM 24. If it is determined in step S50 that the secondary authentication data is also stored in the host system 200 itself (Yes in step S50), the host system 200 and the storage device 1
In both cases, the secondary authentication data is stored. Therefore, in this case, the CPU 22 stores the secondary authentication data stored in the host system 200 in the storage device 10.
In order to confirm whether or not the secondary authentication data matches the secondary authentication data stored in 0, information (01h) indicating the data size (512 bytes) of the secondary authentication data to be transmitted is transmitted. A secondary authentication data transmission command (F4h) is transmitted to the storage device 100. Subsequently, the CPU 22
24 stores the secondary authentication data stored in the storage device 10
0 (step S51).

Next, the CPU 22 refers to the contents stored in the error register of the HDC 9 of the storage device 100 in order to confirm the comparison result of the storage device 100 with the transmitted secondary authentication data (step S52). As a result, the content of the error register of the HDC 9 of the storage device 100 becomes (00
In the case of h), the CPU 22 recognizes that the storage device 100 has permitted the access, and sets a state where the access to the storage device 100 can be performed thereafter (step S53). On the other hand, when the content of the error register is (04h), the CPU 22
Recognizes that the storage device 100 has denied access. Then, the CPU 22 executes the following storage device 100
Access to the disk 1 is not performed, and the user is notified that access to the storage device 100 has been prohibited on a display screen (not shown) or the like (step S54).

In step S50 described above,
If the secondary authentication data is not stored in the host system 200 itself (No in step S50), the storage device 1
00 stores the secondary authentication data, whereas the host system 200 does not store the secondary authentication data. In this case, since the storage device 200 is in a state in which access permission is given to another host system, access to the storage device 100 is not permitted except for the other host systems to which access permission is given. I do. Accordingly, the CPU 22 proceeds to the process of step S54, denies access to the storage device 100, and performs a process in a case where access is not permitted.

As a result of performing the authentication processing on the host system 200 side as described above, if access to the storage device 100 is permitted (step S48 or step S53), the CPU 22 of the host system 200
Accesses the storage device 100 in the subsequent processing,
The user data is read and written.

As described above, the secondary authentication data is jointly created between the storage device 100 and the host system 200 using the unique information of each other, and mutual authentication is performed using this data. Since this is performed, the storage device can control access to the storage device to be limited to only a specific host system, and the host system can perform access only to a specific storage device. It becomes possible to perform such control.

In the above-described embodiment, the manufacturer name, the model name, and the serial number are used as the unique information of the storage device 100 and the host system 200. However, the present invention is not limited to this, and the same model (or similar model is used). (Including a numerical value with a very low probability of being statistically the same). Further, the unique information may be encrypted so that it cannot be analyzed by the user. (Second Embodiment) In the above-described embodiment, the primary authentication data is created on the host system 200 side and is stored in the storage device 1.
The secondary authentication data is created on the 00 side. On the contrary, the primary authentication data is created on the storage device 100 side and the secondary authentication data is created on the host system 200 side. You may do it. The second embodiment will be described below.

Here, first, the host system 200 determines whether or not the secondary authentication data is stored in the host system 200 and the storage device 100.
In this determination, when the host system 200 determines that the secondary authentication data is not stored in either the host system 200 or the storage device 100, the following operation of creating the secondary authentication data is performed. .

That is, the CPU 22 of the host system 200
Transmits a primary authentication data creation instruction command to the storage device 100 to instruct creation of the primary authentication data. The CPU 12 of the storage device 100 receives the primary authentication data creation instruction command and
The primary authentication data is created based on the unique information of the storage device 100 stored in the CPU 12 and temporarily stored in a RAM (not shown) in the CPU 12.

Next, the CPU on the host system 200 side
22 transmits a primary authentication data reception command to the storage device 100 to request transmission of the primary authentication data. The CPU 12 of the storage device 100 receives the primary authentication data reception command and
The primary authentication data stored in the internal RAM is transmitted to the host system 200 side.

The CPU 22 of the host system 200
Upon receiving the primary authentication data from the storage device 100,
Secondary authentication data is created based on the primary authentication data, the unique information stored in the ROM 23, and the date and time information output from the RTC 25, and stored in the RAM 24. Next, the CPU 22 of the host system 200 transmits a secondary authentication data transmission command to the storage device 100 to transmit the created secondary authentication data.
Send the next authentication data.

In the CPU 12 of the storage device 100, the second
When receiving the next authentication data transmission command, it receives the secondary authentication data transmitted from the host system 200 subsequent to the secondary authentication data transmission command, and stores it in the ROM 13. Then, after storing the secondary authentication data in the ROM 13, the CPU 12 of the storage device 100
By setting (04h) in the error register, the host system 200 is notified that the secondary authentication data has been received without error.

When the CPU 22 of the host system 200 receives a notification from the storage device 100 that the secondary authentication data has been received without error, the storage device 100
It recognizes that the access to the user data of the disk 1 of the storage device 100 has been permitted, and the subsequent storage device 100
Access to the server.

It should be noted that before the processing operation other than the operation of creating the secondary authentication data, ie, before the creation of the secondary authentication data, the host system 200
And a processing operation for determining whether or not the secondary authentication data is stored in the storage device 100, and the storage device 100 and the host system 20 after creating the secondary authentication data.
The processing operation and the like in the case of performing the authentication of the secondary authentication data between 0 and 0 are the same as those in the first embodiment described above.

[0063]

As described above in detail, according to the present invention, based on authentication data created in one of a storage device and a host system, the other creates authentication data for access control and uses this authentication data. In order to perform access control of the host system by using
Access to the storage device can be controlled so as to be limited to only a specific host system.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a storage device according to an embodiment of the present invention.

FIG. 2 is a view showing the contents of various registers of the HDC 9 when an authentication data confirmation command (8Dh) is written.

FIG. 3 is a flowchart illustrating an operation of confirming whether or not secondary authentication data is stored in a storage device.

FIG. 4 is a flowchart showing an operation of creating secondary authentication data in the storage device.

FIG. 5 is a diagram showing the contents of various registers of the HDC 9 when a primary authentication data transmission command (8Fh) is written.

FIG. 6 is a view showing primary authentication data created by a host system.

FIG. 7 is a view showing secondary authentication data created in a storage device.

FIG. 8 is a flowchart showing a transmission operation of secondary authentication data of the storage device.

FIG. 9 is a view showing the contents of various registers of the HDC 9 when a secondary authentication data reception command (81h) is written.

FIG. 10 is a flowchart showing a comparison operation of the secondary authentication data of the storage device.

FIG. 11 is a view showing the contents of various registers of the HDC 9 when a secondary authentication data transmission command (F4h) is written.

FIG. 12 is a diagram showing a configuration of a host system according to the embodiment of the present invention.

FIG. 13 is a flowchart showing an authentication process of the host system according to the embodiment of the present invention.

FIG. 14 is a flowchart showing an authentication process of the host system according to the embodiment of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Disk 2 ... SPM 3 ... Head 4 ... Actuator 5 ... VCM 6 ... SPM / VCM driver 7 ... Head amplifier circuit 8 ... Read / write channel 9 ... HDC 10 ... Buffer memory 11 ... Gate array circuit 12 ... CPU (storage device) 13) ROM (storage device side) 21 ... ATA interface circuit 22 ... CPU (host system side) 23 ... ROM (host system side) 100 ... Storage device 200 ... host system

Claims (9)

[Claims] 1. An information storage / reproduction system comprising: a storage device for storing user data; and a host system for detachably connecting the storage device and accessing the user data in the storage device. The storage device is access control authentication data for controlling access to the user data of the host system created by the storage device based on the authentication data created by the host system, or created by the storage device. Authentication data storage means for storing the access control authentication data created by the host system based on the obtained authentication data, wherein the storage device comprises an access control stored in the authentication data storage means of the host system. Authentication data and the authentication data storage means of the storage device. Based on the 憶 access control authentication data, the information storing and reproducing system characterized by comprising a control means for controlling access to the user data from the host system. 2. The information storage / reproduction system according to claim 1, wherein the host system creates the authentication data or the access control authentication data based on the unique information of the host system. 3. The information storage / reproduction system according to claim 1, wherein the storage device creates the authentication data or the access control authentication data based on unique information of the storage device. 4. An information storage / reproducing system comprising: a storage device for storing user data; and a host system removably connected to the storage device and accessing the user data in the storage device. A host authentication data creating unit for creating host authentication data as authentication data on the host system side; and a first authentication storing access control authentication data for controlling access to the user data of the host system. Data storage means, the storage device comprising: access control authentication data creation means for creating the access control authentication data based on the host authentication data created by the host authentication data creation means of the host system. Created by the access control authentication data creating means. Second authentication data storage means for storing the access control authentication data, access control authentication data stored in the first authentication data storage means of the host system, and the second authentication data storage means Control means for controlling access to the user data from the host system based on the access control authentication data stored in the information storage / reproduction system. 5. The information storage / reproduction system according to claim 4, wherein said host authentication data creating means creates said host authentication data based on unique information of said host system. 6. The access control authentication data creating means, wherein the access control authentication data is created based on the host authentication data created by the host authentication data creation means of the host system and the unique information of the storage device. The information storage / reproduction system according to claim 4, wherein the information storage / reproduction system is created. 7. An information storage / reproduction system comprising: a storage device for storing user data; and a host system for detachably connecting the storage device and accessing the user data in the storage device. Access control authentication data creating means for creating access control authentication data for controlling access to the user data of the host system based on storage device authentication data created in the storage device; First authentication data storage means for storing the access control authentication data created by the authentication data creation means, and wherein the storage device stores the storage device authentication data, which is the authentication data on the storage device side. Means for creating storage device authentication data to be created; Second authentication data storage means for storing access control authentication data; access control authentication data stored in the first authentication data storage means of the host system; and storage in the second authentication data storage means. Control means for controlling access to the user data from the host system based on the obtained access control authentication data. 8. The access control authentication data creating unit creates the access control authentication data based on the storage device authentication data created in the storage device and the unique information of the host system. The information storage / reproduction system according to claim 7, wherein 9. The information storage / reproduction system according to claim 7, wherein said storage device authentication data creating means creates the storage device authentication data based on unique information of the storage device.