WO2011011952A1

WO2011011952A1 - Method for protecting storage devices based on mobile communication network

Info

Publication number: WO2011011952A1
Application number: PCT/CN2009/075952
Authority: WO
Inventors: 王德高; 向前
Original assignee: Wang Degao; Xiang Qian
Priority date: 2009-07-31
Filing date: 2009-12-24
Publication date: 2011-02-03
Also published as: CN101635921A; HK1136143A1; CN101635921B

Abstract

A method for protecting a storage device based on a mobile communication network is provided. The object to be protected is a storage device. Global on-line authentication is enabled through a network. The method can provide data-safe read-write protection for the protected object, data encryption, identity authentication for holders of legal identity features, and refusal of use by illegal users. The said network is a mobile communication network, and is utilized to enable global on-line locking. Authentication of legal user identity information held in the data of the program control area of the protected object is password protected, while all illegal user groups are inventoried, displayed in real-time and monitored on the management platform of a manufacture's server. The present invention protects all data on a storage device as well as the interests of holders of legal identity features, and provides lifelong management service for the registration information of such holders. Additionally, the invention also protects user data and the working state of a protected object. When a protected object is lost or used illegally, the method provides information on tracking and rights protection for a holder of legal identity features.

Description

Storage device based on mobile communication network

The present invention relates to storage device protection, and more particularly to a storage device protection method based on a mobile communication network. Background technique

The protection technologies of existing storage devices are diverse, such as Quantum's data protection system DPS, Maxtor's data protection system Maxsafe, and Western Digital's Data SafeGuide. The future development trend of storage devices is represented by Solid State Disk (SSD). Its interface specifications and definitions, functions and usage methods are exactly the same as those of ordinary storage devices. Basically, the shape and size of products are also common. The storage devices are consistent, including 3.5", 2.5" and 1.8". For the protection technology of solid state drives, the current Chinese patents only see "A Data Security Protection Method and Device" published by CN101403996A, and a static type disclosed in CN 101398749A. "Method, device and system for wear leveling", "Solid State Drive and Method for Processing Management Data" disclosed in CN101149664A, and "Block Management Method for Flash Memory" disclosed in CN101030167A. These SSD protection methods are not registered for legitimate users. It only uses password protection for the identification of legitimate users in the data of the local operable area of the SSD user, and there is a problem of easy copying and easy cracking. The applicant's prior patent "An Internet-based storage device protection method" ( Chinese Patent Application No.: 200910107860 .4) is a method of online network protection (SNS) involving SSDs, which can help legitimate users to protect their storage devices online, and provide online technical support and device loss information for legitimate users. For example, the basic geographic location is determined according to the IP address of the illegal user; the file system is restored for the legitimate user and the protected data is restored, the firmware of the storage device is upgraded online, and the illegal user is effectively denied the storage device of the legitimate user. This kind of protection method cannot be implemented in a special area with access to the Internet. The method of wireless message remote system (WMRS) involving SSD has not been reported.

The technical problem to be solved by the present invention is to make up for the deficiencies of the above prior art and propose an innovation. A new mobile communication network-based storage device protection method. Help legitimate users to protect their storage devices online through the mobile communication network, and provide online technical support and device loss information for legitimate users. For example, the basic geographic location is determined according to the cellular base station address of the illegal user. The file system and the restoration site are also restored for legitimate users. Protected data, online upgrade management of storage device firmware, and effective rejection of illegal users using legitimate user storage devices. This mobile communication network-based storage device protection method is particularly suitable for implementing protection for SSDs.

The technical problem of the present invention is solved by the following technical solutions:

The storage device protection method based on the mobile communication network protects the storage device, performs global online authentication by using the network, performs data security read and write protection on the protected object, encrypts the data, and authenticates the identity of the legal identity holder. And refuse to use illegal users.

The characteristics of this mobile communication network-based storage device protection method are:

The network is a mobile communication network.

A global online lock is also implemented using a mobile communication network.

The mobile communication network is one of a 2.5G mobile communication network, a 3G mobile communication network, a 4G mobile communication network, and a 5G mobile communication network.

The 2.5G mobile communication network is one of GSM, EDGE and CDMA.

The 3G mobile communication network is one of WIFI, WCDMA and TD-SCDMA. The 4G mobile communication network is one of a mobile communication network using Long Term Evolution (LTE) and a mobile communication network using World Interoperability for Microwave Access (WiMAX).

The 5G mobile communication network is one of a mobile communication network using LTE Advanced and a mobile communication network using 802.16m-based mobile WiMAX.

The mobile communication network-based storage device protection method further includes password protection for authentic user identity authentication in the data of the protection target device control program area. Existing partitioning tools and operating systems simply cannot manipulate the data in the device control program area. Even if the machine code can be read, the exact byte position of the key cannot be known.

The network implements global online authentication, including publishing a user registration system on the mobile communication network and the Internet, and after the user applies for the WMRS successfully, the real-time network online monitoring is enabled by the server-side to the client protection object, that is, the real-time mobile communication network is enabled. Regulatory procedures.

The implementation of the global online lock is once the protected object is lost or stolen, and the illegal user possesses it. The WMRS security protection lock can be activated, refused to continue to use, or self-destruct data by means of remote short message control for the protected object that is in the possession state, so as to ensure the data security of legitimate users and prevent illegal disclosure and use of data; and only legitimate users In order to restore the use rights and all other rights to the protected object manufacturer in remote SMS control mode, the use of internal data can be restored.

The identity identification of the legal identity holder includes providing a lifelong identity registration information management service to the user who legally holds the protection object, and ensuring the security and legality of the legal user identity of the legal identity holder of the protection object.

The identity identification of the legal identity holder also includes the security password and the binding authorization family number for online identity authentication by the user who legally holds the protection object, and is saved after dynamic encryption by using the MD5 irreversible encryption algorithm. In the server database of the protection object manufacturer, double authentication and update are performed from the client and the server side, and it is extremely difficult to ensure that the legal user identity information of the owner of the protection object is extremely difficult to crack.

The technical problem of the present invention is solved by the following technical solution: the user who legally holds the protection object is provided with the lifelong identity registration information management service, and the registration information is electronically registered through the Tiger Alliance Network as a legitimate user after-sales upgrade. Lifetime credentials for the service.

The registration information includes the identity of the legal identity holder, the mail, the contact method, the product code of the protected object, the product serial number, the product software, the user key, the binding authorized family number, and the user information.

The protected object is a storage device, generally referred to as a device for satisfying a permanent storage form for a computer or system to save and restore the used software programs and data files.

The storage device is one of a hard disk, a floppy disk, a flash unit storage device, and a rewritable tape.

The hard disk is one of a disk type hard disk and an SSD.

Preferably, the hard disk is an SSD including a control unit and a flash memory unit.

The beneficial effects of the present invention compared to the prior art are:

The method of the invention adopts a global mobile communication network to implement global online authentication, and is more widely applicable than the global online authentication implemented by the Internet, including a special area that does not have access to the Internet. The password authentication is used to authenticate the legitimate user identity in the data of the protected object device program control area, and all illegal user groups are displayed and supervised in the manufacturer server management platform. The invention protects all the data of the storage device and the rights of the holder of the legal identity feature, and provides the lifelong identity registration information management service to the legal identity feature holder to ensure protection. The security and legality of the identity of the legal identity of the object; the user who legally holds the protected object fills in the security code for network identity security authentication online, and after the dynamic encryption converted by the MD5 irreversible encryption algorithm, the protection is preserved. The server database of the object manufacturer performs double comparison authentication and update from the client side and the server side to ensure that the identity information of the legal identity holder of the protected object is extremely difficult to crack. It also provides protection for user data security and protects the working state of protected objects. When the protected object is lost or used by an illegal user, the legal identity holder can be provided with information for recourse and rights protection.

DRAWINGS

FIG. 1 is a schematic diagram of a client process when the SNS protection is applied for registration in the first embodiment of the present invention; FIG. 1b is a schematic diagram of a process of a terminal product (ie, SSD) when the SNS protection is applied for registration in the first embodiment of the present invention;

Figure lc is a schematic diagram of the client process when the SNS protection is applied for registration in the first embodiment of the present invention; Figure 2a is a schematic diagram of the client process when the user alarms according to the embodiment of the present invention;

2b is a schematic diagram of a server end flow when a user alarms according to an embodiment of the present invention;

2c is a schematic diagram of a process for automatically identifying an illegal user by using the owner information reported by the server in the embodiment of the present invention;

FIG. 3 is a flow chart showing a typical working process of an SSN protected by an SNS according to Embodiment 1 of the present invention.

detailed description

The invention will now be further described in conjunction with specific embodiments.

A SSD protection method based on mobile communication network:

The client has the following steps in order:

1) Automatically run the network registration unit;

2) Automatically read the SN and PN code of the SSD, and the owner fills in the registration information uploading server; 3) Fill in the main protection password and other information uploading server, and apply to the server

WMRS protection;

4) Receiving the confirmation registration success message transmitted by the server, and confirming that the owner of the legitimate user opens the WMRS, and uploads the owner information of the SSD to the server in real time;

5) After the real-time receiving the password transmitted by the server is compared with the authentication result, once the SSD is found to be lost or stolen and occupied by an illegal user, the prompt owner of the illegal user is uploaded to the server.

3⁄4 ;

6) Legitimate users enable real-time online protection, activate WMRS security protection lock; Enable real-time online protection mode is to log in to the manufacturer's WMRS-G homepage management system alarm, through the manufacturer The designated service hotline performs a telephone or fax alarm, and the user sends any one of the lock instructions to the SSD device;

7) The SSD receives the server command and activates the lock, immediately enters the automatic protection program, the system restarts, the next time the power is turned on, the current user is an illegal user, and the contact information of the legitimate user is displayed, and the system cannot be accessed later, even if the SSD is installed. In other PCs, the slave disk is still considered to be an empty disk and cannot read any data.

The manufacturer server has the following steps in order:

1) Publish the user registration system on the mobile communication network and the Internet, and the user can register the SMS through the mobile phone to the device manufacturer's special service SMS receiving center or log in to the Internet WMRS registration center to register;

2) Compare the registration information uploaded by the client 2) with the manufacturer's product information, and record the correct registration information to the WMRS database;

3) Compare and verify the owner protection password and other information of the application WMRS protection uploaded by the client terminal 3), and mark the user who successfully authenticates the application for WMRS, and enable real-time online monitoring of the client's protection object immediately, ie Enable the real-time mobile communication network remote supervision program, instruct the client to upload the SSD running status to the manufacturer server in real time, and perform technical comparison and upgrade management firmware on the SSD through the manufacturer server;

4) The client terminal 4) enables the WMRS real-time uploading of the SSD machine main information to perform legal user identity verification in real time, and uploads the dynamically encrypted security password converted by the MD5 irreversible encryption algorithm, and performs online real-time double ratio with the client. For authentication, the password is compared with the authentication result. If the comparison result is correct, repeat the comparison. If the comparison result is incorrect, go to step 5). The comparison result is saved in the comparison. Manufacturer server database to ensure the uniqueness and confidentiality of user information;

5) The client is uploaded 5) The owner of the uploaded user is the illegal user's prompt and the registration information stored in the WMRS database is compared and verified, and the identity of the owner is confirmed twice. If the identity of the owner is confirmed to be an illegal user, enter the step 6);

6) The identity of the owner should be confirmed as an illegal user, and the client needs to activate the alarm of the WMRS security protection lock, indicating the illegal user, waiting for the machine to activate the remote locking SSD;

7) After receiving the authorization of the legal identity holder and being approved by the manufacturer server, the remotely activate the activation lock SSD command to activate the locking of the illegal target terminal, including establishing a server-side warning announcement broadcast mechanism, and actively patrolling the real-time scan illegal user. Device, start WMRS to effectively protect the SSD of legitimate users, will be used in the first time when the illegal user is powered on, command the client The SSD refuses to operate normally, and performs data security protection and encrypted backup on the entire storage device including the SSD. First, the user usage data and the file system keyword section are sampled, backed up, compressed into a file, and encrypted and written in a specific manufacturing. The device control program area, after the backup is completed, the OXFFFF is filled in the partition information table of the SSD and the original keyword node of the client user data to ensure that the SSD is regarded as an empty disk even if it is installed on another PC; Then change the manufacturer master work order in the SSD to fail to start, make it in a fault state or empty factory, and all users can not use it. If the violence is forced to open, the SSD master CPU enters the self-destruction program, and the storage unit fails, so that the illegal user cannot use it normally. Only the legitimate user returns the SSD to the original manufacturer for repair or data recovery.

Examples of implementations:

Example 1: This is shown in Figures la to 3. Figure la, lb, and lc show the flowchart of the registration application SNS protection. It can be seen from the figure that when registering the application, the server side interacts with the client on one hand, accepts the user's request and the information input by the user, and returns to the user. Registration result information, on the other hand, is handed over to the SSD, instructing the SSD to automatically upload the SN, PN number and receive it, and enable SNS protection on the SSD, and install the "real-time Internet remote supervision program" on the SSD (if it is already installed, this is In the step, "Install" is changed to "Open". Registration applications can be made via the Internet or via mobile messaging.

After the registration is successful and the SNS protection is enabled on the SSD, if the user finds that the SSD is lost, the user can actively report the alarm to the server. The flowchart is shown in Figure 2a and 2b. The method of manual alarm can also be used for alarms such as telephone, fax, and SMS. According to the needs, the customer can also open the SSD directly by using the mobile communication SMS.

On the other hand, during the use of the SSD, the server also determines whether the SSD is stolen based on the owner information uploaded by the SSD in real time. In this way, even if the SSD is stolen, the user has not noticed it, and the server can find it early. As shown in Figure 2c. The way of discovery is mainly based on the machine hardware information uploaded by the SSD to determine whether the hardware environment of the SSD is changed. If it changes, it is considered to be stolen. At this time, an illegal user can be marked, and the authorized SSD can be activated. The legitimate user can also be notified by e-mail, instant messaging, SMS, telephone, fax, etc.

A typical workflow for an SNS with SNS protection enabled is shown in Figure 3. After accessing the computer, the SSD first uses the mobile communication network to find the network and shake hands with the server (that is, the SSD and the server exchange information and confirm the SSD identity information), and upload the main information (mainly including the owner's hardware information) to the server in real time, and real-time. Query whether the lock SSD instruction is activated. If the verification passes as a legitimate user and the lock SSD instruction is not activated, it enters the normal working state. Otherwise, the SSD enters the protection state: Refuse to operate normally, and perform data security protection and encrypted backup on the entire storage device of the SSD. It can also prohibit the read and write operations of the SSD master control, ensuring that the SSD can not be found when the SSD is used as the master or slave, and the SSD is faulty. State or empty factory condition, if a violent disintegration occurs, start the self-destruction program. The self-destruction program can use the self-destruction technology in the prior art, and the so-called "violent unraveling" includes, for example, attempts to repeatedly access the server authentication exceeding a threshold number of times, hardware circuit connections are changed, mechanical damage, and the like.

If the user directly uses the mobile phone short message to notify the SSD to enter the locked state, the SSD can enter the above protection state even if the lock SSD command is not activated.

The above is a detailed description of the present invention in connection with the specific preferred embodiments, and the specific embodiments of the present invention are not limited to the description. It will be apparent to those skilled in the art that <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt;

Claims

Claim

1. A storage device protection method based on a mobile communication network, the protection object is a storage device, adopts a network to implement global online authentication, performs data security read and write protection on the protected object, encrypts the data, and performs identity on the legal identity feature holder. Identification, and denial of illegal user use, are characterized by:

The network is a mobile communication network;

A global online lock is also implemented using a mobile communication network.

2. The mobile communication network based storage device protection method according to claim 1, wherein:

The mobile communication network is one of a 2.5G mobile communication network, a 3G mobile communication network, a 4G mobile communication network, and a 5G mobile communication network;

The mobile communication network-based storage device protection method according to claim 1 or 2, wherein:

It also includes password protection for user identity authentication of the protected object device control program area.

4. The mobile communication network-based storage device protection method according to claim 3, wherein:

The network implements global online authentication, including publishing a user registration system on the mobile communication network and the Internet, and after the user applies for the WMRS successfully, the server-side protection object of the client instantly enables real-time mobile communication network online monitoring, that is, enabling real-time mobile Communication network remote monitoring procedures.

5. The mobile communication network-based storage device protection method according to claim 4, wherein:

The implementation of the global online lock is to activate the WMRS security protection lock once the protected object is lost or stolen, and the illegal user possesses, refuses to continue to use, or self-destructs the data by remote SMS control for the illegally possessed protected object. Only legitimate users can use the remote network control method to recover the use rights and all other rights to the protected object manufacturer, and restore the use rights of their internal data.

6. The mobile communication network-based storage device protection method according to claim 5, wherein: The identity identification of the legal identity holder includes providing a lifelong identity registration information management service for the user who legally holds the protection object, and the security password and binding for the online identity security authentication by the user who legally holds the protection object online. The authorized family number is stored in the server database of the protected object manufacturer after dynamic encryption using the MD5 irreversible encryption algorithm, and double authentication and update are performed from the client and the server.

The mobile communication network-based storage device protection method according to claim 6, wherein:

Providing the lifelong identity registration information management service to the user who legally holds the protection object is a life certificate that registers the registration information through the network electronically as a legitimate user after-sales upgrade service; the registration information includes the identity of the legal identity feature holder, Mail, contact information, product code of the protected object, product serial number, product software, user key, binding authorization family number, and user information.

8. The mobile communication network-based storage device protection method according to claim 7, wherein:

9. The mobile communication network-based storage device protection method according to claim 8, wherein:

The hard disk is one of a disk type hard disk and an SSD.

10. The mobile communication network-based storage device protection method according to claim 9, wherein:

The hard disk is an SSD including a control unit and a flash memory unit.

11. A method for protecting a solid state hard disk, comprising the following steps:

A. After accessing the computer, the SSD first finds the network through the mobile communication network and grips with the server, then uploads the main hardware information to the server in real time, and queries whether the locked SSD command is activated in real time;

B. If the verification is valid and the locked SSD instruction is not activated, the normal working state is entered, otherwise the protection state in step C is entered;

C, SSD refused to run normally.

The method for protecting a solid state disk according to claim 11, wherein at least one of the following steps is further included in the step C: Cl, data security protection and encrypted backup of the entire storage device of the SSD;

C2. The SSD master control is forbidden to read and write operations, ensuring that the SSD cannot be found on the motherboard when it is used as the master or slave.

C3. Make the SSD in a fault state or an empty state.

The solid state hard disk protection method according to claim 11 or 12, wherein if the violent disintegration is encountered, the self-destruction program is started; the "violent unraveling" includes: attempting to repeatedly access exceeding a threshold number of times Server authentication, hardware circuit connections are changed, and mechanical damage.

The method for protecting a solid state disk according to claim 11 or 12, wherein in the step A, after the server receives the hardware information of the machine, the server determines whether the owner is illegal, and if it is illegal, marks the illegal user. Wait for the authorization to activate the lock SSD; or notify the legitimate user by email or instant messaging.