TWI690805B - Card activation device and methods for authenticating and activating a data storage device by using a card activation device - Google Patents

Abstract

A card activation device, for authenticating and activating a data storage device, includes a first control unit and a central control unit. The first control unit is coupled to the data storage device via a first interface. The central control unit is coupled to the first control unit via a system bus. In response to a first control command received from an electronic device, the central control unit is configured to provide first authentication data to the first control unit via the system bus and the first authentication data is transmitted to the data storage device by the first control unit via the first interface. After the first authentication data is transmitted to the data storage device, the central control unit is configured to provide second authentication data to the first control unit via a system bus in response to a second control command received from the electronic device, and the second authentication data is transmitted to the data storage device by the first control unit via the first interface. After transmission of the first authentication data is finished, the card activation device enters a fully locked stage. In the fully locked stage, the central control unit is configured to perform an authentication procedure of the data storage device. Before the central control unit determines that the data storage device is authorized, the central control unit is not allowed to transmit any data to the data storage device.

Description

Card opening device and method for verifying and activating a data storage device using the card opening device

The present invention relates to a device and method for enabling a data storage device, and in particular to a method for verifying and activating a data storage device using a card opening device.

As the technology of data storage devices has grown rapidly in recent years, many data storage devices, such as the Secure Digital Memory Card (abbreviated as SD)/Multimedia Memory Card (MMC) specification, CF Memory cards, solid state drives, embedded Multi Media Card (abbreviated as eMMC) and Universal Flash Storage (Universal Flash Storage, abbreviated as UFS) of the specifications, MS specifications and XD specifications have been widely used Used in multiple applications.

Generally speaking, in the mass production stage of the data storage device, the device firmware needs to be loaded to enable the data storage device. The device firmware is usually designed according to customer needs. Therefore, it is usually not pre-written into the internal memory device when the chip is packaged, but it is only loaded during the mass production stage. In order to load the device firmware more efficiently and safely, a novel device and method for enabling a data storage device is needed.

According to an embodiment of the invention, a card opening device for verifying and activating a data storage device includes a first control unit and a central control unit. The first control unit is coupled to the data storage device through a first interface. The central control unit is coupled to the first control unit through a system bus. The central control unit provides a first verification data to the first control unit through the system bus in response to a first control command received from an electronic device, and the first control unit transmits the first verification data to the data through the first interface Storage device. After the first verification data is sent to the data storage device, the central control unit provides a second verification data to the first control unit through the system bus in response to a second control command received from the electronic device, and the first control unit Send the second verification data to the data storage device through the first interface. After the transfer of the second verification data is performed, the card opening device enters a completely locked phase under the control of the central control unit. During the completely locked phase, the central control unit executes a verification procedure of the data storage device, and the central control unit determines Before the data storage device passes the verification procedure, the central control unit is not allowed to send any data to the data storage device.

According to an embodiment of the invention, a method for verifying and activating a data storage device using a card opening device includes: transmitting a first verification data to the data storage device in response to a first control command received from an electronic device; After the first verification data is transmitted to the data storage device, a second verification data is transmitted to the data storage device in response to a second control command received from the electronic device; after the second verification data transmission is performed, the card opening is controlled The device operates in a completely locked stage. In the fully locked stage, before the card opening device judges that the data storage device passes a verification procedure, data transmission is not allowed between the card opening device and the data storage device; the verification procedure of the data storage device is performed To determine whether the data storage device has passed the verification procedure; After the storage device passes the verification procedure, the card opening device is controlled to operate in an unlocking phase; and in the unlocking phase, the card opening device receives a third control command from the electronic device and the firmware of one of the data storage devices, and responds to the third control command Send the device firmware to the data storage device to activate the data storage device.

21A: Central control unit

21B: UFS control unit

100: data storage device

110: memory controller

112: Microprocessor

112M: read-only memory

112C: Code

114: control logic

116: Buffer memory

118: Interface logic

120: Memory device

130: Host device

132: Encoder

134: decoder

140: processor

200: card opening device

210: main part

211: USB physical layer circuit unit

212: USB MAC layer circuit unit

213. CPU: Central Processing Unit

214, ROM: read-only memory

215. DMA device: direct memory access device

216. SRAM: static random access memory

217: UFS host controller

218: UniPRO circuit unit

219: M-PHY layer circuit unit

220: SD host controller

221: eMMC host controller

222: System bus

230: memory device

Interface_1, Interface_2, Interface_3, Interface_4, Interface_5: Interface

Tiny_code: code

FIG. 1 is a schematic diagram showing a data storage device according to an embodiment of the invention.

FIG. 2 is a block diagram showing an example of a card opening device according to an embodiment of the invention.

FIG. 3 shows an electronic device system architecture according to an embodiment of the invention.

FIG. 4 is a flowchart of a method for verifying and activating a data storage device using a card opening device according to an embodiment of the invention.

FIG. 5 is a message flow diagram illustrating verification and activation of a data storage device using a card opening device according to the first embodiment of the present invention.

FIG. 6 is a message flow diagram illustrating verification and activation of a data storage device using a card opening device according to a second embodiment of the invention.

FIG. 7 is a message flow diagram illustrating verification and activation of a data storage device using a card opening device according to a third embodiment of the present invention.

In order to make the purpose, features and advantages of the present invention more obvious and understandable, specific embodiments of the present invention are specifically listed below, and in conjunction with the accompanying drawings, detailed descriptions are as follows. The purpose is to illustrate the spirit of the present invention and not to limit the scope of protection of the present invention. The following embodiments can be implemented by software, hardware, firmware, or any combination of the above.

FIG. 1 is a schematic diagram of a data storage device 100 according to an embodiment of the invention. The data storage device 100 includes a memory device 120, for example, a NAND flash memory (NAND Flash Memory) module, and a memory controller 110, and the memory controller 110 is used to access memory体装置120。 Body device 120. According to an embodiment of the present invention, the memory controller 110 includes a microprocessor 112, a read only memory (Read Only Memory, ROM) 112M, a control logic 114, a buffer memory 116, and an interface logic 118. The read-only memory 112M is used to store a program code 112C, and the microprocessor 112 is used to execute the program code 112C to control access to the memory device 120. The control logic 114 includes an encoder 132 and a decoder 134. The encoder 132 is used to encode the data written into the memory device 120 to generate a corresponding check code (or Error Correction Code (ECC)). The decoder 134 is used to decode the data read from the memory device 120.

Under typical conditions, the memory device 120 includes a plurality of flash memory chips, and each flash memory chip includes a plurality of memory blocks (Block), and the controller (for example, through the microprocessor 112 executes The memory controller 110 of the program code 112C) erases data on the memory device 120 in units of blocks. In addition, a memory block can record (include) a specific number of data pages (Page), in which the controller (for example, the memory controller 110 that executes the program code 112C through the microprocessor 112) performs operations on the memory device 120 The operation of writing data is to write data in units of data pages.

In practice, the memory controller 110 that executes the program code 112C through the microprocessor 112 can use its own internal components to perform many control operations, for example For example, the control logic 114 is used to control the access operation of the memory device 120 (especially the access operation of at least one block or at least one data page), the buffer memory 116 is used for required buffer processing, and the interface is used The logic 118 communicates with a host device (Host Device) 130. The buffer memory 116 is implemented by random access memory (Random Access Memory, RAM). For example, the buffer memory 116 may be static random access memory (Static RAM, SRAM), but the invention is not limited thereto.

In general, the host device 130 can issue commands to the data storage device 100, for example, read commands or write commands, to access data stored in the memory device 120, or to further control and manage the data storage device 100. The data storage device 100 may be configured in a digital camera, a mobile phone, a consumer electronic device, or others. In one embodiment, the data storage device 100 may be a portable memory device (for example: a memory card conforming to SD/MMC, CF, MS, XD standards), and the host device 130 is a device that can be connected to the data storage device Electronic device. In another embodiment, the data storage device 100 may be a solid-state hard drive or an embedded device that conforms to Universal Flash Storage (UFS) or Embedded Multi Media Card (EMMC) specifications. The storage device may be provided in an electronic device, and the host device 130 may be a processor of the electronic device or another electronic device connectable to the data storage device. Among them, UFS and eMMC are currently common flash memory specifications, which can bring higher data transmission speed and higher reliability to flash memory flash memory.

As described above, in the mass production stage of the data storage device 100, the device firmware needs to be loaded to activate the data storage device 100. Generally speaking, the loading of the device firmware can be done by the host device 130 connected to the data storage device 100. At this time, with the capital The host device 130 connected to the material storage device 100 may be a card opening device or a card reader.

FIG. 2 is a block diagram showing an example of a card opening device according to an embodiment of the invention. In the embodiment of the present invention, the card opening device 200 may be the host device 130 shown in FIG. 1, which is connected to the data storage device 100 through a predetermined interface to verify the data storage device 100 and confirm the data storage device After 100 is verified, the device firmware required by the data storage device 100 is loaded into the data storage device 100.

According to an embodiment of the invention, the card opening device 200 may include a main part 210 and an external memory device 230, wherein the external memory device 230 is disposed outside the main part 210. According to an embodiment of the invention, the card opening device 200 may include a first interface Interface_1. The card opening device communicates with the processor 140 through the interface Interface_1 and uses a standard communication protocol. The standard communication protocol may be, for example, a communication protocol (Universal Serial Bus (USB)), a high-tech configuration (Advanced Technology Attachment (abbreviated as ATA) communication protocol, Serial High Technology Configuration (Serial ATA, abbreviated as SATA) communication protocol, Express Peripheral Component Interconnect-Express (abbreviated as PCI-E) communication protocol, Or other. According to an embodiment of the invention, the card opening device 200 may include a USB physical layer circuit unit 211 and a USB media access control (Media Access Control, abbreviated as MAC) layer circuit unit 212 to follow the USB The communication protocol performs data processing at different layers.

The card opening device 200 may further include a central control unit 21A. The central control unit 21A includes a central processing unit (Central Processing Unit, Written as CPU) 213, a read-only memory (Read Only Memory, abbreviated as ROM) 214, a direct memory access (Direct Memory Access, abbreviated as DMA) device 215, and a static random access memory (Static Random Access Memory, abbreviated as SRAM) 216. According to an embodiment of the invention, the card opening device 200 may include a second interface Interface_2. The card opening device communicates with the external memory device 230 through the interface Interface_2 and uses a standard communication protocol. The standard communication protocol may be, for example, an integrated circuit bus (Inter-Integrated Circuit Bus, abbreviated as I2C), a serial peripheral interface ( Serial Peripheral Interface (abbreviated as SPI), or other. The ROM 214 is used to store the boot code, and the external memory device 230 is used to store in-system programming (abbreviated as ISP) or in-circuit programming (abbreviated as ICP) code. After the card opening device 200 is powered, the central processing unit 213 can execute the boot code stored in the ROM 214 to initialize the card opening device 200, and read the ISP code from the external memory device 230 and load it The SRAM 216 then executes the ISP code to provide a predetermined function according to the content compiled by the ISP code. The central control unit 21A can communicate with the UFS control unit 21B, the SD control unit, and the eMMC control unit through the system bus 222. The UFS control unit 21B communicates with an external UFS device through a third interface Interface_3, where the Interface_3 may be a UFS interface. The SD control unit communicates with the external SD card through the fourth interface Interface_4, where the Interface_4 may be an SD interface. The eMMC control unit communicates with the external eMMC card through the fifth interface Interface_5, where the interface_5 can be an eMMC interface.

The UFS control unit 21B may include a UFS host controller 217, A Mobile Industry Processor Interface (Mobile Industry Processor Interface, MIPI) standardized communication protocol (UniPRO) circuit unit 218 and MIPI physical (M-PHY) layer circuit unit 219. The UFS host controller 217 can receive commands from the central processing unit 213 through the system bus 222, such as read/write commands and receive data, and convert the received commands and data into a predetermined format according to the UFS communication protocol. The UniPRO circuit unit 218 and the M-PHY layer circuit unit 219 are used to perform data processing in different layers (for example, the data connection layer and the physical layer) according to the UFS communication protocol. After format conversion and processing, commands and data will be sent to the external UFS device through Interface_3.

The SD control unit may include an SD host controller 220. The SD host controller 220 can receive commands from the central processing unit 213 through the system bus 222, such as read/write commands and receive data, and convert the received commands and data into a predetermined format according to the SD communication protocol. After format conversion and processing, the commands and data will be sent to the external SD device through Interface_4. The eMMC control unit may include an eMMC host controller 221. The eMMC host controller 221 can receive commands from the central processing unit 213 through the system bus 222, such as read/write commands and receive data, and convert the received commands and data into a predetermined format according to the eMMC communication protocol. After format conversion and processing, commands and data will be sent to external eMMC devices through Interface_5.

FIG. 3 shows an electronic device system architecture according to an embodiment of the invention. The electronic device system may include a data storage device 100, a card opening device 200, and a processor 140. The data storage device 100 may include a memory controller 110 and a memory device 120. The card opening device 200 and the data storage device 100 can pass the above Communication with a predetermined interface. The predetermined interface can be a flash memory interface, such as a UFS interface or eMMC interface. At this time, the data storage device 100 may be a UFS device or an eMMC device.

According to an embodiment of the present invention, the card opening device 200 (or the host device 130 described above) may be a hardware device used by the host to activate the data storage device 100. For example, as described above, the card opening device 200 may verify the data storage device 100 during the mass production stage of the data storage device, and activate the data storage device 100 after verification. The activation process may also be referred to as a card opening process, which is used to load the corresponding device firmware into the data storage device 100 to activate the data storage device 100. The card opening device 200 can communicate with the processor 140 through an interface and using a standard communication protocol as described above. The processor 140 may be another electronic device, for example, a processor of a computer device. According to an embodiment of the invention, the processor 140 may issue instructions to control the card opening process. In response to the commands received from the processor 140, the card opening device 200 may send corresponding commands (such as UFC or eMMC commands) and data to the memory controller 110, and receive messages from the memory controller 110.

Referring back to FIG. 2, according to one embodiment of the present invention, after the card opening device 200 is powered, it is controlled by the central control unit 21A (for example, by the central processing unit 213 of the central control unit 21A), the card opening device 200 will enter a first lock phase. In the first locking stage, the central control unit 21A (or the corresponding card opening device 200) is only allowed to perform at most a first predetermined number of data transmissions to the data storage device 100. In addition, in the first locking stage, the amount of data that can be allowed to be transferred to the data storage device 100 can also be limited to a predetermined amount of data.

The central control unit 21A can receive a first control command and a first verification from the processor 140 (or corresponding electronic device including the processor 140, the same applies hereinafter) Information. The first control command is used to instruct the card opening device 200 to send the first verification data to the data storage device 100.

In response to the first control instruction, the central control unit 21A provides the first verification data to another control unit through the system bus 222, for example, the UFS control unit 21B, and the UFS control unit 21B performs the corresponding data processing as described above through The corresponding interface Interface_3 sends the first verification data to the data storage device 100. In this embodiment, the data storage device 100 is a UFS device.

According to an embodiment of the present invention, the first verification data may include a code Tiny_code for generating encrypted data, which is a small amount of data used to assist the data storage device 100 to generate corresponding verification response data during the verification process .

According to an embodiment of the present invention, after the first verification data is transmitted to the data storage device 100, under the control of the central control unit 21A, the card opening device 200 will enter a second locking stage. In the second locking stage, the central control unit 21A (or the corresponding card opening device 200) is only allowed to perform at most a second predetermined number of data transmissions to the data storage device 100. In addition, in the second locking stage, the amount of data that can be allowed to be transferred to the data storage device can also be limited to no more than a predetermined amount of data.

After the first verification data is sent to the data storage device 100, the central control unit 21A can receive the second control command from the processor 140. The second control instruction is used to instruct the card opening device 200 to send the second verification data to the data storage device 100, wherein the second verification data may be provided by the processor 140 or generated by the card opening device 200 (the following will be different More detailed introduction during implementation).

In response to the second control command, the central control unit 21A provides the second verification data to the corresponding control unit through the system bus 222, for example, UFS control Unit 21B, and the UFS control unit 21B performs the corresponding data processing as described above, and then transmits the second verification data to the data storage device 100 through the corresponding interface Interface_3.

After the transfer of the second verification data is performed, the card opening device 200 will wait for the data storage device 100 to return the corresponding verification response data. After receiving the verification response data, the central control unit 21A executes a verification procedure of the data storage device 100 according to the verification response data. According to an embodiment of the present invention, after the transfer of the second verification data is performed, the card opening device 200 enters a completely locked stage under the control of the central control unit 21A. In the fully locked stage, before determining that the data storage device 100 passes the verification procedure, the central control unit 21A is not allowed to send any more data to the data storage device 100.

After determining that the data storage device 100 passes the verification procedure, the card opening device 200 enters an unlocking stage under the control of the central control unit 21A. During the unlocking stage, the central control unit 21A receives a third control command and data storage device from the processor 140 One of 100 device firmware. In response to the third control command, the central control unit 21A provides the device firmware to the corresponding control unit through the system bus 222, for example, the UFS control unit 21B, and the UFS control unit 21B performs the corresponding data processing as described above and then transmits the corresponding Interface_3 sends the device firmware to the data storage device 100 to activate the data storage device 100.

FIG. 4 is a flowchart of a method for verifying and activating a data storage device using a card opening device according to an embodiment of the invention. It should be noted that in the embodiment of the present invention, the card opening device may also be referred to as a host device, for example, the host device 130 shown in FIG. 1. First, the card opening device can send the first verification data to the data storage device in response to the first control command received from an electronic device (step S402). Then, after the first verification data is sent to the data storage device, the card opening device may send the second verification data to the data storage device in response to the second control command received from the electronic device (step S404). Then, after the transfer of the second verification data is performed, the card opening device is controlled to operate in a completely locked phase (step S406), and a verification procedure of the data storage device is performed (step S408). Next, the card opening device determines whether the data storage device passes the verification procedure (step S410). If so, the card opening device is controlled to operate in an unlocking stage, so that the card opening device can transmit the device firmware to the data storage device in response to the third control command received from the electronic device to activate the data storage device (step S412). If not, unlocking is not performed, so that the card opening device continues to operate in the completely locked stage. Since the card-opening device is not allowed to send any data to the data storage device until the data storage device passes the verification process during the complete lock phase, the card-opening device will not pass the device until the data storage device passes the verification process. The firmware is sent to the data storage device. In other words, data storage devices that cannot be verified will not be activated.

According to the first embodiment of the present invention, the second verification data includes a key and an encryption method selected by the processor 140 (or corresponding electronic device including the processor 140, the same applies hereinafter). The central control unit 21A (or the corresponding card opening device 200, the same below) receives the second verification data from the processor 140, and in the verification process, the central control unit 21A further uses the key and encryption method to calculate a first The encrypted key, and comparing whether the first encrypted key is the same as the second encrypted key (ie, the verification response data) received from the data storage device 100, and the first encrypted key When it is the same as the second encrypted key, it is determined that the data storage device passes the verification procedure.

FIG. 5 is a message flow diagram illustrating verification and activation of a data storage device using a card opening device according to the first embodiment of the present invention. Figure 5 shows Electronic device (or its processor 140, the same below), card opening device 200/host device 130 (or its central control unit 21A, the same below), and data storage device 100 (or its The message flow between the included memory controller 110, the same below).

According to an embodiment of the present invention, after the card opening device 200 is powered, the card opening device enters a first locking stage. Before being successfully unlocked, the card opening device 200 is only allowed to perform the first predetermined number of data transmissions to the data storage device 100, and the amount of data that can be transmitted in each data transmission is also limited to not exceed a predetermined amount of data .

According to an embodiment of the present invention, in the first locking stage, the card opening device 200 is only allowed to perform data transmission to the data storage device 100 at most twice, and the card opening device 200 transmits data to the data in the first data transmission The data amount of the storage device 100 is limited to, for example, no more than 64kB.

As shown in FIG. 5, after the card opening device 200 is powered, the electronic device transmits the first control command and the first verification data to the card opening device 200. In the embodiment of the present invention, the first verification data includes To generate a code Tiny_code of one of the encrypted data (for example, the encrypted key). The card opening device 200 transmits the first verification data including the code Tiny_code to the data storage device 100 in response to the first control command.

After the first verification data is sent to the data storage device 100, the card opening device 200 enters a second locking stage. According to an embodiment of the present invention, in the second locking stage, the card opening device 200 is only allowed to perform a second predetermined number of data transmissions to the data storage device 100, and the amount of data that can be transmitted in each data transmission is also limited In order not to exceed a predetermined amount of data, the second predetermined number of times may be less than the first predetermined number of times. For example, in the second locking stage, the card opening device 200 is only allowed to perform at most one data transmission to the data storage device 100, and the amount of data transmitted from the card opening device 200 to the data storage device 100 in this data transmission Limited to, for example, no more than 64kB.

After receiving the first verification data including the code Tiny_code, the data storage device 100 can respond to a transmission completion message to the card opening device 200, and the card opening device 200 can further respond to a transmission completion message to the electronic device. According to an embodiment of the present invention, the data storage device 100 may store the received first verification data in the buffer memory 116, thereby executing the program code Tiny_code. It is worth noting that in the embodiment of the present invention, the data storage device 100 does not further store the code Tiny_code into the memory device 120.

According to an embodiment of the invention, the program code Tiny_code may include a predetermined amount of encrypted code and decryption code, and a predetermined amount of dummy data. That is, in the embodiment of the present invention, the real encryption/decryption code is embedded in the code Tiny_code, and the code Tiny_code will be disrupted by the dummy data. By executing the built-in firmware stored in the read-only memory 112M in advance, the memory controller 110 of the data storage device 100 can grammatically analyze the code Tiny_code, parse out the real encryption/decryption code, and convert it Stored in the buffer memory 116 for subsequent execution.

According to the first embodiment of the present invention, after receiving the transmission completion message, the electronic device can randomly select an encryption method and generate a key. The electronic device may send the key and the selected encryption method to the card opening device 200 as the second verification data. In response to the corresponding control message sent by the electronic device, the card opening device 200 further sends the information of the key and the encryption method to the data storage device as second verification data Set 100.

After the second verification data is sent to the data storage device 100, the card opening device 200 enters a third locking stage, which is a complete locking stage. In the fully locked stage, the card opening device 200 is not allowed to send any data to the data storage device. That is, no further commands and data transmission are allowed between the card opening device 200 and the data storage device 100.

After receiving the information of the key and the encryption method, the data storage device 100 can execute the program code Tiny_code to generate encrypted data according to the encryption method and the key. As described above, the memory controller 110 of the data storage device 100 can grammatically analyze the code Tiny_code according to the encryption method instructed by the electronic device, and parse out the real encryption/decryption code it needs.

According to an embodiment of the invention, the data storage device 100 can calculate the encrypted key as encrypted data, and can return the encrypted data to the card opening device 200.

According to another embodiment of the present invention, the data storage device 100 can randomly generate a large amount of dummy data, calculate the encrypted key, and embed the encrypted key in the dummy data according to the encryption method as encrypted data, and then Send the encrypted data back to the card opening device 200.

After receiving the encrypted data, the card opening device 200 can compare the encrypted key calculated by itself with the encrypted key received from the data storage device 100, and compare whether the two are the same for verification Whether the data storage device is an approved device. In some embodiments where the encrypted key is embedded in the dummy data as encrypted data, the card opening device 200 may further use an encryption method to find the valid data (ie, the encrypted key) embedded in the dummy data To locate the data store The encrypted key transmitted by the storage device 100. After finding the encrypted key, the card opening device 200 can compare the encrypted key calculated by itself with the encrypted key received from the data storage device 100, and compare whether the two are the same for verification Whether the data storage device is an approved device (ie, the integrity of the device).

In one embodiment of the present invention, the card opening device 200 can execute the program code Tiny_code to further generate (calculate) the encrypted key by using the key according to the encryption method. In another embodiment of the present invention, the card opening device 200 can execute the program code stored in the memory device 230 to automatically generate (calculate) the encrypted key using the key according to the encryption method. If the encrypted key calculated by the card opening device 200 does not match the encrypted key received from the data storage device 100, the card opening device 200 continues to operate in the fully locked stage.

If the encrypted key calculated by the card opening device 200 matches the encrypted key received from the data storage device 100, it means that the data storage device 100 has passed the verification procedure. After determining that the data storage device 100 passes the verification procedure, the card opening device 200 operates in an unlocking stage. The card opening device 200 can send an unlock response message to the electronic device.

In response to the unlock response message, the electronic device can confirm that the data storage device 100 has passed the verification procedure, so the card storage device 100 starts the card opening process by sending the device firmware required to activate the data storage device 100 to the card opening device 200. The card opening device 200 then transmits the device firmware to the data storage device 100. The device firmware can finally be loaded into the memory device 120 of the data storage device 100 under the control of the memory controller 110. After the device firmware is successfully loaded, the card opening procedure is completed, and the data storage device 100 can send a card opening completion message to the card opening device 200.

When the card opening device 200 receives the card opening completion message, it will further Send the card opening completion message to the electronic device. After the electronic device receives the card opening completion message, the electronic device may issue a command to close the card opening device 200 or close the relevant circuit in the card opening device 200 for communicating with the data storage device 100. After that, when the card opening device 200 or related circuits are powered on again, the card opening device 200 will enter the first locking stage again to perform the verification and card opening procedures for the next data storage device.

According to the second embodiment of the present invention, the second verification data includes the encrypted key and the corresponding encryption/decryption method. The central control unit 21A receives from the processor 140 an encryption method and a key selected by the processor 140, and uses the key to calculate an encrypted key according to the encryption method, and then compares the encrypted key with the corresponding The encryption or decryption method is sent to the data storage device 100 as the second verification data. The data storage device 100 needs to decrypt the encrypted key according to the encryption or decryption method, and then return the decrypted key (ie, the verification response data) to the card opening device 200. In the verification process, the central control unit 21A compares whether the key received from the processor 140 and the decrypted key received from the data storage device 100 are the same, and when the two are the same, determines that the data storage device passes the verification process.

FIG. 6 is a message flow diagram illustrating verification and activation of a data storage device using a card opening device according to a second embodiment of the invention. FIG. 6 shows the electronic device (or the processor 140 included in it, the same below), the card opening device 200/host device 130 (or the central control unit 21A included in it, the same below) and the data storage device 100 (Or the memory controller 110 included in it, the same applies hereinafter).

Similar to the first embodiment, after the card opening device 200 is powered, the card opening device 200 enters a first locking stage. Before being successfully unlocked, the card opening device 200 is only allowed to perform the first predetermined number of data transmissions to the data storage device 100, And the amount of data that can be transmitted in each data transmission is also limited to not exceed a predetermined amount of data.

According to an embodiment of the present invention, in the first locking stage, the card opening device 200 is only allowed to perform data transmission to the data storage device 100 at most twice, and the card opening device 200 transmits data to the data in the first data transmission The data amount of the storage device 100 is limited to, for example, no more than 64kB.

As shown in FIG. 6, after the card opening device 200 is powered, the electronic device transmits the first control command and the first verification data to the card opening device 200. In the embodiment of the present invention, the first verification data includes To generate a code Tiny_code of one of the encrypted data (for example, the encrypted key). The card opening device 200 transmits the first verification data including the code Tiny_code to the data storage device 100 in response to the first control command.

After the first verification data is sent to the data storage device 100, the card opening device 200 enters a second locking stage. According to an embodiment of the present invention, in the second locking stage, the card opening device 200 is only allowed to perform a second predetermined number of data transmissions to the data storage device 100, and the amount of data that can be transmitted in each data transmission is also limited In order not to exceed a predetermined amount of data, the second predetermined number of times may be less than the first predetermined number of times. For example, in the second locking stage, the card opening device 200 is only allowed to perform at most one data transmission to the data storage device 100, and the amount of data transmitted from the card opening device 200 to the data storage device 100 in this data transmission Limited to, for example, no more than 64kB.

After receiving the first verification data including the code Tiny_code, the data storage device 100 can respond to a transmission completion message to the card opening device 200, and the card opening device 200 can further respond to a transmission completion message to the electronic device. According to the invention In one embodiment, the data storage device 100 may store the received first verification data in the buffer memory 116, thereby executing the program code Tiny_code. It is worth noting that in the embodiment of the present invention, the data storage device 100 does not further store the code Tiny_code into the memory device 120.

According to the second embodiment of the present invention, after receiving the transmission completion message, the electronic device can randomly select an encryption method and generate a key. The electronic device can send the information of the key and the selected encryption method to the card opening device 200. According to an embodiment of the present invention, the card opening device 200 can then execute the program code Tiny_code or the program stored in the memory device 230 for generating an encrypted key as encrypted data using the key according to the encryption method . According to another embodiment of the present invention, the card opening device 200 can randomly generate a large amount of dummy data, calculate the encrypted key, and embed the encrypted key in the dummy data according to the encryption method as encrypted data.

According to an embodiment of the present invention, the card opening device 200 then transmits the encrypted data and the information of the encryption method to the data storage device 100.

In another embodiment of the present invention, the card opening device 200 can send the encrypted data and the decryption method information to the data storage device 100. In this embodiment, the read-only memory 214 or the memory device 230 may store a comparison table for recording the correspondence between the encryption code and the corresponding encryption method, and the corresponding decryption code and decryption method. Therefore, in this embodiment, after receiving the information of the encryption method selected by the electronic device, the card opening device 200 can look up the comparison table to know which decryption method corresponds to the encryption method selected by the electronic device, and encrypt The data and the decryption method are sent to the data storage device 100.

In one embodiment of the invention, upon receiving the encrypted data and After encrypting the information of the method, the data storage device 100 can execute the code Tiny_code to use the encryption method to find the location of the valid data (ie, the encrypted key) embedded in the dummy data to find the card opening device 200 The encrypted key sent. After finding the encrypted key, the data storage device 100 further decrypts the key. More specifically, in this embodiment, a comparison table may be stored in the code Tiny_code to record the correspondence between the encrypted code and the corresponding encryption method, and the corresponding decryption code and decryption method. After receiving the information of the encryption method selected by the electronic device, the data storage device 100 can look up the comparison table to know which decryption method corresponds to the encryption method selected by the electronic device, and obtain the corresponding decryption code. The data storage device 100 can further decrypt the key by executing the decryption code. After the decryption is completed, the data storage device 100 can send the decrypted key to the card opening device 200.

In another embodiment where the card opening device 200 transmits the encrypted data and the decryption method information to the data storage device 100, after receiving the encrypted data and the decryption method information, the data storage device 100 can execute the program code Tiny_code, to find the location of the valid data (ie, the encrypted key) embedded in the dummy data using the corresponding encryption method, to find the encrypted key transmitted by the card opening device 200. After finding the encrypted key, the data storage device 100 further decrypts the key by executing the decryption code obtained according to the received decryption method information. After the decryption is completed, the data storage device 100 can send the decrypted key to the card opening device 200.

After receiving the decrypted key, the card opening device 200 may compare the decrypted key with the key received from the electronic device, and compare whether the two are the same to verify whether the data storage device is approved Device (ie, device integrity (integrity)).

If the decrypted key calculated by the data storage device 100 does not match the key received from the electronic device, the card opening device 200 continues to operate in the fully locked stage.

If the decrypted key calculated by the data storage device 100 matches the key received from the electronic device, it means that the data storage device 100 passes the verification procedure. After determining that the data storage device 100 passes the verification procedure, the card opening device 200 operates in an unlocking stage. The card opening device 200 can send an unlock response message to the electronic device.

In response to the unlock response message, the electronic device can confirm that the data storage device 100 has passed the verification procedure, so the card storage device 100 starts the card opening process by sending the device firmware required to activate the data storage device 100 to the card opening device 200. The card opening device 200 then transmits the device firmware to the data storage device 100. The device firmware can finally be loaded into the memory device 120 of the data storage device 100 under the control of the memory controller 110. After the device firmware is successfully loaded, the card opening procedure is completed, and the data storage device 100 can send a card opening completion message to the card opening device 200.

After the card opening device 200 receives the card opening completion message, it will further send the card opening completion message to the electronic device. After the electronic device receives the card opening completion message, the electronic device may issue a command to close the card opening device 200 or close the relevant circuit in the card opening device 200 for communicating with the data storage device 100. After that, when the card opening device 200 or related circuits are powered on again, the card opening device 200 will enter the first locking stage again to perform the verification and card opening procedures for the next data storage device.

According to the third embodiment of the present invention, the second verification data includes the encrypted key and the corresponding encryption/decryption method. The central control unit 21A receives the key generated by the processor 140 from the processor 140, selects an encryption method by itself, and The encrypted key is calculated using the key according to the encryption method, and then the encrypted key and the corresponding encryption or decryption method are sent to the data storage device 100 as second verification data. The data storage device 100 needs to decrypt the encrypted key according to the encryption or decryption method, and then return the decrypted key (ie, the verification response data) to the card opening device 200. In the verification process, the central control unit 21A compares whether the key received from the processor 140 and the decrypted key received from the data storage device 100 are the same, and when the two are the same, determines that the data storage device passes the verification process.

FIG. 7 is a message flow diagram illustrating verification and activation of a data storage device using a card opening device according to a third embodiment of the present invention. FIG. 7 shows the electronic device (or the processor 140 included in it, the same below), the card opening device 200/host device 130 (or the central control unit 21A included in it, the same below) and the data storage device 100 (Or the memory controller 110 included in it, the same applies hereinafter).

Similar to the first embodiment, after the card opening device 200 is powered, the card opening device 200 enters a first locking stage. Before being successfully unlocked, the card opening device 200 is only allowed to perform the first predetermined number of data transmissions to the data storage device 100, and the amount of data that can be transmitted in each data transmission is also limited to not exceed a predetermined amount of data .

According to an embodiment of the present invention, in the first locking stage, the card opening device 200 is only allowed to perform data transmission to the data storage device 100 at most twice, and the card opening device 200 transmits data to the data in the first data transmission The data amount of the storage device 100 is limited to, for example, no more than 64kB.

As shown in FIG. 7, after the card opening device 200 is powered, the electronic device transmits the first control command and the first verification data to the card opening device 200, wherein, In an embodiment of the present invention, the first verification data includes a code Tiny_code for generating encrypted data (for example, an encrypted key). In response to the first control command, the card opening device 200 then sends the first verification data including the code Tiny_code to the data storage device 100.

After the first verification data is sent to the data storage device 100, the card opening device 200 enters a second locking stage. According to an embodiment of the present invention, in the second locking stage, the card opening device 200 is only allowed to perform a second predetermined number of data transmissions to the data storage device 100, and the amount of data that can be transmitted in each data transmission is also limited In order not to exceed a predetermined amount of data, the second predetermined number of times may be less than the first predetermined number of times. For example, in the second locking stage, the card opening device 200 is only allowed to perform at most one data transmission to the data storage device 100, and the amount of data transmitted from the card opening device 200 to the data storage device 100 in this data transmission Limited to, for example, no more than 64kB.

After receiving the first verification data including the code Tiny_code, the data storage device 100 can respond to a transmission completion message to the card opening device 200, and the card opening device 200 can further respond to a transmission completion message to the electronic device.

According to the third embodiment of the present invention, after receiving the transmission completion message, the electronic device can generate a key. The electronic device can send the key to the card opening device 200. In the third embodiment of the present invention, the card opening device 200 can randomly select an encryption method for encrypting the key, and can execute the program code Tiny_code or the program stored in the memory device 230 to encrypt according to this The method uses this key to generate an encrypted key. In one embodiment of the present invention, the card opening device 200 can generate an encrypted key as encrypted data, and send the encrypted data and the information of the encryption or decryption method to the data storage device 100. In another embodiment of the invention, the card is opened The device 200 can randomly generate a large amount of dummy data, generate an encrypted key, and embed the encrypted key in the dummy data according to an encryption method as encrypted data. The card opening device 200 then transmits the encrypted data and the information of the encryption or decryption method to the data storage device 100.

After receiving the encrypted data and the information of the encryption or decryption method, the data storage device 100 can execute the code Tiny_code to use the encryption or decryption method to find valid data embedded in the dummy data (ie, the encrypted key ), decrypt the key by executing the decryption code based on the received encryption or decryption method information. After the decryption is completed, the data storage device 100 can send the decrypted key to the card opening device 200.

After receiving the decrypted key, the card opening device 200 may compare the decrypted key with the key received from the electronic device, and compare whether the two are the same to verify whether the data storage device is approved Device (ie, the integrity of the device).

If the decrypted key calculated by the data storage device 100 does not match the key received from the electronic device, the card opening device 200 continues to operate in the fully locked stage.

If the decrypted key calculated by the data storage device 100 matches the key received from the electronic device, it means that the data storage device 100 passes the verification procedure. After determining that the data storage device 100 passes the verification procedure, the card opening device 200 operates in an unlocking stage. The card opening device 200 can send an unlock response message to the electronic device.

In response to the unlock response message, the electronic device can confirm that the data storage device 100 has passed the verification procedure, so the card storage device 100 starts the card opening process by sending the device firmware required to activate the data storage device 100 to the card opening device 200. Open card The device 200 then transmits the device firmware to the data storage device 100. The device firmware can finally be loaded into the memory device 120 of the data storage device 100 under the control of the memory controller 110. After the device firmware is successfully loaded, the card opening procedure is completed, and the data storage device 100 can send a card opening completion message to the card opening device 200.

After the card opening device 200 receives the card opening completion message, it will further send the card opening completion message to the electronic device. After the electronic device receives the card opening completion message, the electronic device may issue a command to close the card opening device 200 or close the relevant circuit in the card opening device 200 for communicating with the data storage device 100. After that, when the card opening device 200 or related circuits are powered on again, the card opening device 200 will enter the first locking stage again to perform the verification and card opening procedures for the next data storage device.

As described above, in the embodiment of the present invention, before performing the card opening procedure of the data storage device, the card opening device first verifies whether the data storage device is an approved or permitted device, and before determining that the data storage device passes the verification The card opening device will operate in a completely locked state, so that no data transmission can be allowed between the card opening device and the data storage device to protect the device firmware from being easily loaded into non-approved or non-permitted devices. In other words, in the embodiment of the present invention, the data storage device that cannot pass the verification cannot be activated through the card opening device proposed by the present invention. Compared with the conventional technology, the method and the card opening device proposed by the present invention can enable the data storage device to be activated more efficiently and more securely.

Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. Anyone who is familiar with this skill can do some modifications and retouching without departing from the spirit and scope of the present invention. Therefore, the present invention The scope of protection shall be as defined in the scope of the attached patent application.

21A: Central control unit

21B: UFS control unit

140: processor

200: card opening device

210: main part

211: USB physical layer circuit unit

212: USB MAC layer circuit unit

213. CPU: Central Processing Unit

214, ROM: read-only memory

215. DMA device: direct memory access device

216. SRAM: static random access memory

217: UFS host controller

218: UniPRO circuit unit

219: M-PHY layer circuit unit

220: SD host controller

221: eMMC host controller

222: System bus

230: memory device

Interface_1, Interface_2, Interface_3, Interface_4, Interface_5: Interface

Claims (15)

A card opening device for verifying and activating a data storage device, comprising: a first control unit, coupled to the data storage device through a first interface; and a central control unit, coupled to a system bus The first control unit, wherein the central control unit provides a first verification data to the first control unit through the system bus in response to a first control command received from an electronic device, and is transmitted by the first control unit The first interface transmits the first verification data to the data storage device. After the first verification data is sent to the data storage device, the central control unit responds to a second control command received from the electronic device. The second verification data is provided to the first control unit through the system bus, and the first control unit transmits the second verification data to the data storage device through the first interface, and the second verification data After the transfer is performed, the card opening device enters a fully locked stage under the control of the central control unit. During the fully locked stage, the central control unit executes a verification procedure of the data storage device, and the central control unit determines Before the data storage device passes the verification procedure, the central control unit is not allowed to transmit any data to the data storage device, and after judging that the data storage device passes the verification procedure, the control of the central control unit enables the open The card device enters an unlocking stage, and in the unlocking stage, the first control unit transmits a device firmware to the data storage device through the first interface to activate the data storage device. The card opening device as described in item 1 of the patent application scope, wherein after the card opening device is powered, the card opening device is controlled by the central control unit In a first locking stage, the central control unit is only allowed to perform at most a first predetermined number of data transmissions to the data storage device. The card opening device as described in item 2 of the patent application scope, wherein after the first verification data is transmitted to the data storage device, the card opening device is operated in a second locking stage under the control of the central control unit, In the second locking stage, the central control unit is only allowed to perform at most a second predetermined number of data transmissions to the data storage device. The card opening device as described in item 1 of the patent application scope, wherein in the unlocking stage, the central control unit passes the device firmware received from the electronic device through the system in response to a third control command received from the electronic device The bus bar is provided to the first control unit. The card opening device as described in item 1 of the patent application scope, wherein the first verification data includes a program code for generating encrypted data. The card opening device as described in item 1 of the patent application scope, wherein the second verification data includes a key selected by the electronic device and an encryption method, and the central control unit receives the second verification data from the electronic device , And in the verification process, the central control unit further uses the key and the encryption method to calculate a first encrypted key, receives a second encrypted key from the data storage device, and compares the first Whether an encrypted key is the same as the second encrypted key, and when the first encrypted key is the same as the second encrypted key, it is determined that the data storage device passes the verification process. The card opening device as described in item 1 of the patent application scope, wherein the second verification data includes an encrypted key and a corresponding encryption/decryption method, and in the verification process, the central control unit further extracts the data Storage device connection Receiving a decrypted key, comparing whether a key received from the electronic device is the same as the decrypted key, and when the key is the same as the decrypted key, determining that the data storage device passes The verification procedure. The card opening device as described in item 1 of the patent application scope, wherein the first interface is a UFS interface. A method for verifying and activating a data storage device by using a card opening device includes: transmitting a first verification data to the data storage device in response to a first control command received from an electronic device; After transmitting to the data storage device, a second verification data is transmitted to the data storage device in response to a second control command received from the electronic device; after the transmission of the second verification data is executed, the card opening device is controlled Operate in a completely locked stage, wherein in the completely locked stage, before the card opening device judges that the data storage device passes a verification procedure, data transmission is not allowed between the card opening device and the data storage device; the data storage is performed The verification procedure of the device to determine whether the data storage device passes the verification procedure; after determining that the data storage device passes the verification procedure, control the card opening device to operate in an unlocking stage; and in the unlocking stage, the card opening The device receives a third control command from the electronic device and a device firmware of the data storage device, and transmits the device firmware to the data storage device in response to the third control command to activate the data storage device. The method described in item 9 of the patent application scope further includes: After the card opening device is powered, the card opening device is controlled to operate in a first locking stage, wherein in the first locking stage, the card opening device is only allowed to execute the data storage device for at most a first predetermined number of times Data transmission. The method as described in item 10 of the patent application scope further includes: after the first verification data is transmitted to the data storage device, controlling the card opening device to operate in a second locking stage, in which the second locking stage The card opening device is only allowed to perform at most a second predetermined number of data transmissions to the data storage device. The method as described in item 9 of the patent application scope, wherein the first verification data includes a code for generating encrypted data. The method as described in item 9 of the patent application scope, wherein the second verification data includes a key selected by the electronic device and an encryption method, and wherein the verification procedure of the data storage device is executed to determine the data The step of whether the storage device passes the verification process further includes: using the key and the encryption method to calculate a first encrypted key; receiving a second encrypted key from the data storage device; comparing the first encryption Whether the encrypted key is the same as the second encrypted key; and when the first encrypted key is the same as the second encrypted key, it is determined that the data storage device passes verification. The method as described in item 9 of the patent application scope, wherein the second verification data includes an encrypted key and a corresponding encryption/decryption method, and wherein the verification process of the data storage device is executed to determine the data The step of whether the storage device passes the verification procedure further includes: receiving a decrypted key from the data storage device; Comparing whether a key received from the electronic device is the same as the decrypted key received from the data storage device; and when the decrypted key is the same as the key, it is determined that the data storage device passes verification. The method as described in item 9 of the patent application scope, wherein the data storage device is a UFS device.

Images