WO2020258572A1 - 保护数据安全的移动存储装置、系统、方法及存储介质 - Google Patents

保护数据安全的移动存储装置、系统、方法及存储介质 Download PDF

Info

Publication number
WO2020258572A1
WO2020258572A1 PCT/CN2019/109065 CN2019109065W WO2020258572A1 WO 2020258572 A1 WO2020258572 A1 WO 2020258572A1 CN 2019109065 W CN2019109065 W CN 2019109065W WO 2020258572 A1 WO2020258572 A1 WO 2020258572A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
data security
security protection
controller
usb
Prior art date
Application number
PCT/CN2019/109065
Other languages
English (en)
French (fr)
Inventor
周正贤
谈超
Original Assignee
深圳豪杰创新电子有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳豪杰创新电子有限公司 filed Critical 深圳豪杰创新电子有限公司
Publication of WO2020258572A1 publication Critical patent/WO2020258572A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories

Definitions

  • the present disclosure relates to the technical field of data security storage, and in particular, to a mobile storage device, system, method, and storage medium for protecting data security.
  • an encrypted USB flash drive that is, a USB flash drive with encryption and decryption protection functions for the content in the USB flash drive
  • an encrypted USB flash drive is a common data security protection product.
  • the speed is low, the processing time is long, and the user experience is poor.
  • the purpose of the present disclosure includes, for example, to provide a mobile storage device, system, method, and storage medium that protect data security, so as to alleviate the slow speed and long processing time of the existing mobile storage technology when performing data security protection operations. defect.
  • the embodiments of the present disclosure provide a mobile storage device for protecting data security, which includes a substrate and at least the following electronic components mounted on the substrate: a USB interface, a USB hub, a USB/SSD controller, a memory, and a security controller.
  • a USB interface a USB interface
  • a USB hub a USB/SSD controller
  • a memory a secure memory
  • a security controller a controller for protecting data security.
  • one end of the USB hub is connected to the USB interface
  • the other end of the USB hub is respectively connected to the USB/SSD controller and the security controller.
  • the USB/SSD controller is also connected to the memory.
  • the USB interface can be configured to connect with a terminal device, and receive from the terminal device a data security protection instruction to be sent to the USB/SSD controller and the security controller.
  • the data security protection instruction may carry information about the data to be protected.
  • the data security protection instructions may include any of the following: encryption instructions; and decryption instructions.
  • the USB/SSD controller may be configured to obtain the data to be protected stored in the memory connected to it according to the data security protection instruction, and send the data to be protected to the terminal device through the USB interface.
  • the security controller can be configured to send its built-in data security protection algorithm to the terminal device through the USB interface according to the data security protection instruction.
  • the terminal device After receiving the data to be protected and the data security protection algorithm, the terminal device can use the data security protection algorithm to perform the data security protection operation on the data to be protected, and send the information obtained after the data protection operation to the memory for storage.
  • the embodiments of the present disclosure also provide a mobile storage system for protecting data security, including a terminal device and the above-mentioned mobile storage device, wherein the terminal device is connected to the mobile storage device.
  • the embodiments of the present disclosure also provide a method for protecting data security, which can be applied to the above-mentioned mobile storage system.
  • the method includes: the mobile storage device can receive a data security protection instruction from a terminal device through a USB interface, and secure the received data
  • the protection instructions are respectively sent to the USB/SSD controller and the security controller, where the USB/SSD controller can obtain the data to be protected stored in the memory connected to it according to the data security protection instructions, and send the data to be protected to the USB interface through the USB interface.
  • the terminal device, and the security controller can send its built-in data security protection algorithm to the terminal device through the USB interface according to the data security protection instruction, so that the terminal device can use the data security protection algorithm to perform data security protection operations on the data to be protected and execute The information obtained after the data security protection operation is sent back to the memory for storage.
  • the embodiment of the present disclosure also provides a method for protecting data security, which can be applied to a terminal device connected to a mobile storage device.
  • the method includes: sending a data security protection instruction to the USB/SSD controller in the mobile storage device and the security Controller; receiving data to be protected in response to the data security protection instruction from the USB/SSD controller; receiving data security protection algorithm in response to the data security protection instruction from the security controller; based on the received data security protection algorithm Perform data security protection processing on the to-be-protected data to obtain processed information; and send the processed information to the memory in the mobile storage device for storage.
  • the embodiments of the present disclosure also provide a non-transitory storage medium on which program instructions are stored.
  • the program instructions are executed by a processor, the processor executes the foregoing method.
  • the beneficial effects of the embodiments of the present disclosure include, for example, the processing time of the data to be protected is significantly reduced, thereby shortening the waiting time of the user, and greatly improving the user experience; not only can the data storage partition Data security protection is performed as a whole, and each individual file in the partition can be encrypted to achieve a higher level of protection of data; it can protect the to-be-protected data of third-party data sources, and the scope of application is significantly expanded ; And, the user can achieve the purpose of data security protection through the corresponding application on the terminal device, which is convenient to use and simple to operate.
  • FIG. 1 is a schematic diagram of the internal structure of an existing encrypted U disk provided by an embodiment of the disclosure
  • FIG. 2 is a schematic diagram of the internal structure of a mobile storage device for protecting data security provided by an embodiment of the disclosure
  • FIG. 3 is a schematic diagram of the front structure of the substrate of a mobile storage device with a USB-A interface for protecting data security provided by an embodiment of the disclosure
  • FIG. 4 is a schematic diagram of the reverse structure of the substrate of a mobile storage device with a USB-A interface for protecting data security provided by an embodiment of the disclosure
  • FIG. 5 is an overall schematic diagram of a mobile storage device with a USB-A interface for protecting data security provided by an embodiment of the disclosure
  • FIG. 6 is a schematic diagram of the front structure of a substrate of a mobile storage device with a Type C interface whose USB interface is a Type C interface provided by an embodiment of the disclosure;
  • FIG. 7 is a schematic diagram of the reverse structure of the substrate of a mobile storage device with a Type C interface whose USB interface is a Type C interface provided by an embodiment of the disclosure;
  • FIG. 8 is an overall schematic diagram of a mobile storage device with a Type C interface whose USB interface is a Type C interface provided by an embodiment of the disclosure;
  • FIG. 9 is a schematic diagram of a connection between a terminal device and a mobile storage device according to an embodiment of the disclosure.
  • FIG. 10 is a schematic block diagram of another mobile storage device provided by an embodiment of the disclosure.
  • FIG. 11 is a schematic block diagram of a mobile storage system provided by an embodiment of the disclosure.
  • Icon 11, 21-USB/SSD controller; 12, 22-safety controller; 13, 23-memory; 24-base plate; 25-USB interface; 26-USB hub; 27-upper shell; 28-lower shell; 29-USB cap; 251-USB-A interface; 252-Type C interface.
  • FIG. 1 schematically shows the internal structure of a traditional encrypted U disk.
  • the traditional encrypted U disk uses its controller (including the USB/SSD controller 11 and the security controller 12) to encrypt and decrypt the data in the storage 13 connected to it, and the entire process of encryption and decryption is performed in the U disk Finished at the controller.
  • controller including the USB/SSD controller 11 and the security controller 12
  • the speed of the encryption and decryption process is low; in addition, due to the complexity of the encryption algorithm of the existing encrypted U disk, the process of encrypting and decrypting data takes a long time.
  • users need to have enough patience and time to wait.
  • traditional encrypted U disk encryption or decryption of 1GB movies usually requires users to wait about 5 minutes. Therefore, the traditional encrypted U disk performs operations related to data security protection at a low rate, resulting in a long processing time.
  • the embodiments of the present disclosure provide a mobile storage device, system, method, and storage medium to solve at least some of the defects in the prior art.
  • the embodiments of the present disclosure provide a mobile storage device for protecting data security.
  • the mobile storage device for protecting data security provided by the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.
  • FIG. 2 is a schematic block diagram of the internal structure of a mobile storage device for protecting data security according to an embodiment of the present disclosure
  • FIGS. 3-4 and 6-7 are mobile storage devices for protecting data security according to an embodiment of the present disclosure.
  • the mobile storage device for protecting data security includes: a base plate 24 and a USB interface 25, a USB hub 26, a USB/SSD controller 21, a storage 23, a security The controller 22, wherein one end of the USB hub 26 is connected to the USB interface 25, the other end of the USB hub 26 is respectively connected to the USB/SSD controller 21 and the security controller 22, and the USB/SSD controller 21 is also connected to the memory 23.
  • the USB interface 25 can be configured to connect with a terminal device (see FIG. 9 or FIG. 11).
  • the terminal device can send data security protection instructions to the USB/SSD controller 21 and the security controller 22 through the USB interface 25, respectively.
  • the data security protection instruction can carry information about the data to be protected.
  • the data security protection instructions may include encryption instructions and/or decryption instructions.
  • the data security protection instruction sent by the terminal device to the USB/SSD controller 21 and the data security protection instruction sent to the security controller 22 may be exactly the same in content. For example, the terminal device sends the same data security protection instruction such as the data to be protected.
  • Two copies of the data security protection instruction ie, encryption instruction
  • the security protection instruction carries information about the data to be protected
  • the data security protection instruction sent by the terminal device to the controller 22 contains information indicating encryption requirements and/or information indicating decryption requirements but does not carry information about the data to be protected and/ Or information about the data to be decrypted.
  • the USB/SSD controller 21 may be configured to obtain the data to be protected stored in the memory 23 connected to it according to the received data security protection instruction, and send the data to be protected to the terminal device through the USB interface 25.
  • the security controller 22 may be configured to send the built-in data security protection algorithm to the terminal device through the USB interface 25 according to the received data security protection instruction for its use.
  • the terminal device can also be configured to use the data security protection algorithm received from the security controller 22 to perform a data protection operation on the data to be protected obtained from the memory 23 via the controller 21, and to perform data security protection operations such as encrypted information.
  • the data or decrypted data is sent to the memory 23 for storage.
  • one of the two transmission channels is a transmission channel composed of USB interface 25—USB hub 26—USB/SSD controller 21—memory 23; the other of the two transmission channels It is a transmission channel composed of USB interface 25—USB hub 26—safety controller 22.
  • the two transmission channels can simultaneously transmit data in parallel without affecting each other.
  • the aforementioned substrate 24 may be a PCB (Printed Circuit Board, printed circuit board), but is not limited thereto.
  • the aforementioned memory 23 is used to store data, and the data may be data to be protected, protected data, or data for exchange.
  • the aforementioned memory 23 may be Flash, HDD or SSD, but the embodiment of the present disclosure does not specifically limit the aforementioned memory.
  • FIGS. 3 to 8 are illustrations based on an example of a USB flash drive as the portable storage device
  • the portable storage device that protects data security in the embodiment of the disclosure may be used to protect data security.
  • the USB flash drive can also be a mobile hard disk that protects data security, or other mobile electronic equipment with a USB interface and capable of data storage.
  • the embodiment of the present disclosure does not specifically limit the mobile storage device.
  • the terminal device After the mobile storage device that protects data security is connected to the terminal device through the USB interface 25, the terminal device can be operated by an operator to send a data security protection instruction to the mobile storage device that protects data security. Specifically, the data security protection instructions reach the USB/SSD controller 21 and the security controller 22 via the USB hub 26 through the USB interface 25, respectively.
  • the USB/SSD controller 21 and the security controller 22 After the USB/SSD controller 21 and the security controller 22 receive a data security protection instruction, such as an encryption instruction carrying information of the data to be protected, the USB/SSD controller 21 obtains the data to be protected from the memory 23 connected to the USB/SSD controller according to the encryption instruction , And send the data to be protected to the terminal device via the USB hub 26 and the USB interface 25; similarly, the security controller 22 sends its built-in encryption algorithm to the terminal device via the USB hub 26 and the USB interface 25 according to the encryption instruction. After receiving the data to be protected and the encryption algorithm, the terminal device uses the encryption algorithm to encrypt the data to be protected, and sends the cipher text obtained after the encryption operation to the storage via the USB interface 25, the USB hub 26 and the USB/SSD controller 21 23 for storage.
  • a data security protection instruction such as an encryption instruction carrying information of the data to be protected
  • the USB/SSD controller 21 obtains the data to be protected from the memory 23 connected to the USB/SSD controller according to the
  • the process of sending the data to be protected from the USB/SSD controller 21 to the terminal device and the process of sending the encryption algorithm from the security controller 22 to the terminal device can be performed in parallel at the same time, and the CPU of the terminal device performs powerful operations. With the support of processing power, the encryption operation of the data to be protected can be completed quickly. Using the CPU of the terminal device to perform encryption operations greatly saves data processing time.
  • the decryption process is performed similarly to the encryption process.
  • the specific process please refer to the foregoing example of the encryption process, and the decryption process will not be repeated here.
  • the encryption operation and the decryption operation may be completed on the terminal device.
  • the CPU of the terminal device has much more powerful computing and processing capabilities than the controller in the U disk, and can quickly realize the encryption operation or decryption operation of the data to be protected.
  • the speed is fast, which greatly saves the time of data processing and relieves the existing When the mobile storage device performs data security protection operations, the speed is slow and the processing time is long.
  • the terminal device may also be configured to send a data security protection instruction to the following target controller and security controller 22, where the above target controller may be other than the USB/SSD controller 21 Other than the controller that can access (for example, write and/or read) the data in the storage component, such as other terminal devices or remote servers such as cloud-based servers that can access the data in the storage component Controller.
  • target controller may be other than the USB/SSD controller 21
  • the controller that can access (for example, write and/or read) the data in the storage component, such as other terminal devices or remote servers such as cloud-based servers that can access the data in the storage component Controller.
  • the target controller may be configured to obtain the data to be protected stored in the storage component connected to it according to the data security protection instruction, and send the data to be protected to the terminal device.
  • the security controller 22 may be configured to send its built-in data protection algorithm to the terminal device through the USB interface 25 according to the data security protection instruction.
  • the terminal device may also be configured to use a data security protection algorithm to perform a data protection operation on the data to be protected, and send the protected data obtained after the data security protection operation is executed to the storage component for storage.
  • the controller can only perform data security protection operations on the data in the memory 23, which has a single function and a narrow application range.
  • the inventor designed the structure of the above-mentioned mobile storage device for protecting data security according to an embodiment of the present disclosure, and the mobile storage device for protecting data security can realize cross-platform data security protection.
  • the encryption operation of cloud data is taken as an example for introduction.
  • it is also possible to encrypt data in any third-party channel such as data in a computer, data in a mobile phone, etc.
  • the embodiment of the present disclosure does not specifically limit it.
  • the terminal device When the mobile storage device that protects data security is connected to the terminal device through the USB interface 25, the terminal device can be operated by the operator to protect the mobile storage device (specifically, the security controller 22) and the cloud controller (that is, the aforementioned The target controller) sends an encrypted instruction carrying information about the data to be protected. Specifically, the encrypted instruction reaches the security controller 22 through the USB interface 25 and the USB hub 26. Similarly, the encrypted instruction reaches the cloud controller through wireless or wired communication. After receiving the encryption instruction, the security controller 22 can send its built-in encryption algorithm to the terminal device via the USB hub 26 and the USB interface 25 according to the encryption instruction.
  • the security controller 22 After receiving the encryption instruction, the security controller 22 can send its built-in encryption algorithm to the terminal device via the USB hub 26 and the USB interface 25 according to the encryption instruction.
  • the cloud controller receives the encryption instruction, it can obtain the data to be protected from the cloud storage (ie storage component) connected to it according to the encryption instruction (which carries the information of the data to be protected), and The data to be protected is sent to the terminal device.
  • the terminal device After receiving the encryption algorithm and the data to be protected, the terminal device can use the encryption algorithm to perform an encryption operation on the data to be protected, and send the cipher text obtained after the encryption operation to the cloud for storage.
  • the process of sending the data to be protected from the cloud to the terminal device and the process of sending the encryption algorithm from the security controller 22 to the terminal device can be performed in parallel at the same time, and the powerful computing and processing capabilities of the terminal device CPU With the support and cooperation, the encrypted operation of the protected data can be completed quickly.
  • Using the CPU of the terminal device to perform encryption operations greatly saves data processing time.
  • the mobile storage device for protecting data security in the embodiments of the present disclosure can realize all-round data security protection, has a wide range of applications, and improves user experience.
  • the decryption process is similar to the encryption process.
  • the specific process of decryption refer to the example of the above encryption process, and the decryption process will not be repeated here.
  • the mobile storage device for protecting data security further includes: a first oscillation circuit, a first power supply circuit, a reset circuit, and a second oscillation circuit respectively mounted on the substrate 24 The circuit and the second power supply circuit.
  • the first oscillating circuit can be connected to the USB/SSD controller 21 and can be configured for the USB/SSD controller 21 to work.
  • the first power supply circuit can be respectively connected to the USB/SSD controller 21 and the memory 23, and can be configured to provide power to the USB/SSD controller 21 and the memory 23.
  • the reset circuit may be connected to the USB/SSD controller 21.
  • the second oscillation circuit can be connected to the safety controller 22 and can be configured for the safety controller 22 to work.
  • the second power supply circuit can be connected to the safety controller 22 and can be configured to provide power to the safety controller 22.
  • the mobile storage device for protecting data security further includes a resistor, a capacitor, and an inductor, wherein the resistor, capacitor, and inductor are all mounted on the substrate 24.
  • the substrate 24 of the mobile storage device for protecting data security also includes some necessary passive components such as resistors, capacitors, inductors, etc.
  • the connection structure will not be detailed here. Introduction;
  • the devices on the substrate 24 can be electrically connected by copper wires.
  • the data security protection algorithm may include but is not limited to: AES256 encryption algorithm and/or SM4 encryption algorithm.
  • the data security protection algorithm built in the security controller 22 may be the AES256 encryption algorithm or the SM4 encryption algorithm, but the embodiment of the present disclosure does not specifically limit it; the security controller 22 may be MJ1001e or MJ1002e However, the embodiments of the present disclosure do not specifically limit it.
  • the above-mentioned data security protection algorithm can not only encrypt a single file, but also encrypt multiple folders and multiple files in the folder, ensuring that each file is encrypted after being encrypted.
  • the data must be decrypted by the decryption algorithm corresponding to the encryption algorithm in the mobile storage device for protecting data security in the embodiment of the present disclosure, before the data can be viewed and shared.
  • Many experiments have proved that when encrypting 8000 files with a total capacity of 1GB, the encryption time basically only takes 50 seconds. Compared with the traditional mobile storage device when encrypting a 1GB movie, the encryption time is usually as long as 5 minutes, the mobile storage device for protecting data security provided by the embodiments of the present disclosure significantly shortens the data processing time.
  • the USB interface 25 may include any one or a combination of the USB-A interface 251 and the Type C interface 252.
  • the USB interface 25 of the mobile storage device that protects data security provided in an embodiment of the present disclosure may be a USB-A interface 251 or a Type C interface 252.
  • the mobile storage device for protecting data security may further include: an upper housing 27 and a lower housing 28;
  • the upper shell 27 and the lower shell 28 can be snap-fitted and configured to fix and protect the substrate 24 on which the electronic device is mounted, where the electronic device at least includes: a USB hub 26, a USB/SSD controller 21, a memory 23, and a security controller twenty two.
  • the mobile storage device for protecting data security may further include: a USB cap 29.
  • the USB cap 29 can be snap-fitted to the USB interface 25 and configured to protect the USB interface 25.
  • the terminal device may include any of the following items: laptop computer, desktop computer, personal digital assistant, smart phone.
  • the terminal device may be a local electronic device, a local electronic device serving as at least a part of the function of a server, a local server, or a remote server such as a cloud server.
  • an APP that is used in conjunction with the mobile storage device for protecting data security is installed in the terminal device.
  • the operator connects the USB interface 25 of the mobile storage device that protects data security with the corresponding interface of the terminal device, and then the operator opens the APP on the terminal device, and then sends data security protection instructions through the APP on the terminal device.
  • the existing mobile storage device uses a controller (specifically, a single-chip microcomputer) inside the mobile storage device to encrypt or decrypt the data in the memory 23.
  • a controller specifically, a single-chip microcomputer
  • This operation is limited by the speed and bandwidth of the single-chip itself, and the data is protected.
  • the operation speed is slow and the processing time is long.
  • the mobile storage device for protecting data security provided by the present disclosure has a unique structure-two transmission channels are parallel, and the CPU of the terminal device (which has high-performance and fast computing capabilities) is used for data security protection operations, which greatly improves the data Processing speed saves processing time.
  • Many experiments have proved that the encryption and decryption speed of the mobile storage device for protecting data security provided by the present disclosure can reach more than 10 times the encryption and decryption speed of the existing mobile storage device;
  • the mobile storage device for protecting data security in this disclosure uses AES256 encryption Algorithm or SM4 encryption algorithm, which can not only perform data security protection operations on specific partitions, but also turn every document in the partition into ciphertext, that is, it can directly perform data security protection operations on physical documents with a high level of protection ;
  • the existing mobile storage device can only perform data security protection operations on the data in the memory 23 connected to the controller, and has a narrow application range.
  • the mobile storage device for protecting data security in the present disclosure can not only perform data security protection operations on the mobile storage device
  • the data in the internal memory 23 performs data security protection operations, and can also perform data security protection operations on any third-party data such as the data on the terminal device itself, data on other terminal devices, or cloud data, which can achieve a full range of data Safety protection, wide application range;
  • the mobile storage device that protects data security in the present disclosure is convenient and fast to operate. You only need to connect the mobile storage device to the terminal device, open the corresponding APP on the terminal device, and implement data security protection operations through the APP. The user is convenient, simple and fast to use.
  • an embodiment of the present disclosure also provides a mobile storage system for protecting data security, including a terminal device and the above-mentioned mobile storage device for protecting data security, wherein the terminal device is connected to the mobile storage device for protecting data security.
  • the mobile storage system may further include another data source device, and the additional data source device includes a target controller and a storage component connected to the target controller.
  • the terminal device can send data security protection instructions to the target controller and the security controller.
  • the target controller can obtain the data to be protected stored in the storage component connected to it in response to the data security protection instruction, and send the data to be protected to the terminal device.
  • the security controller can send its built-in data security protection algorithm to the terminal device in response to the data security protection instruction.
  • the terminal device may use a data security protection algorithm to perform a data security protection operation on the data to be protected, and send the information obtained after the security protection operation is executed to a storage component for storage.
  • the additional data source device includes a cloud server or a network hard disk, so that the terminal can use the received data security protection algorithm to securely protect the data to be protected from the cloud server or the network hard disk to quickly encrypt or Decrypt.
  • the aforementioned additional data source device may be the terminal device itself.
  • the embodiments of the present disclosure also provide a method for protecting data security, which can be applied to a mobile storage system.
  • the method may include the following steps: the mobile storage device receives the data security protection instruction from the terminal device through the USB interface, and sends the received data security protection instruction to the USB/SSD controller and the security controller respectively; the USB/SSD controller responds The data security protection instruction acquires the data to be protected in the memory and sends it to the terminal device; and the security controller sends its built-in data security protection algorithm to the terminal device in response to the data security protection instruction.
  • the terminal device may use a data security protection algorithm to perform a data security protection operation on the data to be protected, and send the information obtained after the data security protection operation is performed to the memory for storage.
  • the method may further include the terminal device sending the data security protection instruction to the target controller of the other data source device and the security controller in the mobile storage device to obtain the data to be protected and the data security respectively. Protection algorithm.
  • the specific implementation process is similar to the above and will not be repeated here.
  • the embodiment of the present disclosure also provides a method for protecting data security that can be applied to terminal equipment, including, for example, the following steps: sending a data security protection instruction to the USB/SSD controller and the security controller in the mobile storage device;
  • the USB/SSD controller receives the data to be protected in response to the data security protection instruction; receives the data security protection algorithm in response to the data security protection instruction from the security controller; and compares the received data to be protected based on the received data security protection algorithm Perform data security protection processing to obtain processed information; and send the processed information to the memory in the mobile storage device for storage.
  • the embodiments of the present disclosure also provide a non-transitory storage medium on which program instructions are stored. When executed by a processor, the program instructions cause the processor to execute the methods described in the foregoing method embodiments. method.
  • the non-transitory storage medium may be a memory connected to a processor in a terminal device.
  • the memory in the terminal device stores computer instructions that can be accessed by the processor, and when the computer instructions are executed by the processor, the above-mentioned methods that can be applied to the terminal device can be executed.
  • the mobile storage system, method, and storage device for protecting data security provided by the embodiments of the present invention have the same or similar advantages as the mobile storage device for data security protection provided by the embodiments of the present invention.
  • the mobile storage device for data security protection provided by the embodiments of the present invention please refer to the device implementation above A description of the advantages of the example.
  • the terms “installed”, “connected”, and “connected” should be interpreted broadly, for example, they may be fixed connections or detachable connections. , Or integrally connected; it can be a mechanical connection or an electrical connection; it can be directly connected, or indirectly connected through an intermediate medium, and it can be the internal communication between two components.
  • installed should be interpreted broadly, for example, they may be fixed connections or detachable connections. , Or integrally connected; it can be a mechanical connection or an electrical connection; it can be directly connected, or indirectly connected through an intermediate medium, and it can be the internal communication between two components.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present disclosure.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .
  • the mobile storage device, system, method, and storage medium for protecting data security provided by the embodiments of the present disclosure can, for example, significantly reduce the processing time of the data to be protected, and encrypt each individual file in the partition to achieve high-level protection of data , And protect the to-be-protected data of third-party data sources to obtain a broad scope.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)

Abstract

一种保护数据安全的移动存储装置、系统、方法及存储介质。在移动存储装置中，USB集线器（26）的一端与USB接口（25）连接，USB集线器（26）的另一端分别与USB/SSD控制器（21）、安全控制器（22）连接，并且USB/SSD控制器（21）还与存储器（23）连接；USB接口（25）与终端设备连接，以从终端设备接收分别向USB/SSD控制器（21）、安全控制器（22）发送的数据安全保护指令；USB/SSD控制器（21）根据数据安全保护指令获取存储器（23）中的待保护数据并将其发送至终端设备；安全控制器（22）根据数据安全保护指令将其内置的数据安全保护算法发送至终端设备；其中，终端设备采用数据安全保护算法对待保护数据进行保护操作。在所述移动存储装置、系统、方法及存储介质中，加密操作和解密操作是在终端设备上完成的，由于终端设备的CPU具有强大的运算和处理能力，所以对待保护数据的加密操作或解密操作能够被快速实现，从而节省了数据处理时间。

Description

保护数据安全的移动存储装置、系统、方法及存储介质
相关申请的交叉引用
本公开要求于2019年6月26日提交中国专利局的申请号为CN201910565501.7、名称为“保护数据安全的移动存储装置及移动存储系统”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本公开涉及数据安全存储的技术领域，尤其涉及一种保护数据安全的移动存储装置、系统、方法及存储介质。
背景技术
数据安全与我们的生活息息相关，相应的衍生出了各种加密及解密技术以及各种数据安全保护产品。作为移动存储装置的加密USB闪存盘(下文简称加密U盘)，即对U盘中的内容有加解密保护功能的U盘，是较常见的数据安全保护产品。然而，现有的加密U盘在执行数据安全保护的操作时，速率低下，处理时间长，用户使用体验欠佳。
发明内容
本公开的目的包括，例如，提供一种保护数据安全的移动存储装置、系统、方法及存储介质，以缓解现有的移动存储技术在执行数据安全保护的操作时，速率低下，处理时间长的缺陷。
本公开实施例提供一种保护数据安全的移动存储装置，包括基板和安装在基板上的至少下述电子部件：USB接口、USB集线器、USB/SSD控制器、存储器、以及安全控制器。其中，USB集线器的一端与USB接口连接，并且USB集线器的另一端分别与USB/SSD控制器、安全控制器连接。USB/SSD控制器还与存储器连接。
USB接口可以配置成与终端设备连接，并且从终端设备接收待被发送至USB/SSD控制器、安全控制器的数据安全保护指令。该数据安全保护指令中可以携带有待保护数据的信息。数据安全保护指令可以包括以下任一种：加密指令；以及解密指令。
USB/SSD控制器可以配置成根据数据安全保护指令获取与其连接的存储器中存储的待保护数据，并将待保护数据通过USB接口发送至终端设备。
安全控制器可以配置成根据数据安全保护指令将其内置的数据安全保护算法通过USB接口发送至终端设备。
终端设备在接收到待保护数据和数据安全保护算法后，可以采用数据安全保护算 法对待保护数据执行数据安全保护操作，并将执行数据保护操作之后得到的信息发送回存储器进行存储。
本公开实施例还提供了一种保护数据安全的移动存储系统，包括终端设备和上述移动存储装置，其中，终端设备与移动存储装置连接。
本公开实施例还提供了一种保护数据安全的方法，可以应用于上述移动存储系统，该方法包括：移动存储装置可以通过USB接口从终端设备接收数据安全保护指令，并将所接收的数据安全保护指令分别发送至USB/SSD控制器和安全控制器，其中，USB/SSD控制器可以根据数据安全保护指令获取与其连接的存储器中存储的待保护数据，并将待保护数据通过USB接口发送至终端设备，并且安全控制器可以根据数据安全保护指令将其内置的数据安全保护算法通过USB接口发送至终端设备，以使得终端设备可以采用数据安全保护算法对待保护数据执行数据安全保护操作并将执行数据安全保护操作之后得到的信息发送回存储器进行存储。
本公开实施例还提供了一种保护数据安全的方法，可以应用于与移动存储装置连接的终端设备，该方法包括：将数据安全保护指令发送至移动存储装置中的USB/SSD控制器和安全控制器；从USB/SSD控制器接收响应于数据安全保护指令的待保护的数据；从安全控制器接收响应于数据安全保护指令的数据安全保护算法；基于所接收的数据安全保护算法对所接收的待保护数据执行数据安全保护处理，得到经处理的信息；以及将经处理的信息发送至移动存储装置中的存储器以进行存储。
本公开实施例还提供了一种非暂时性存储介质，在该非暂时性存储介质上存储有程序指令，该程序指令在由处理器执行时，使处理器执行上述方法。
与现有技术相比，本公开实施例的有益效果包括，例如：显著降低了对待保护数据的处理时间，从而缩短了用户的等待时间，大大提升了用户的使用体验；不仅能够对数据存储分区整体地进行数据安全保护，还能对分区内的每一个单独的文件进行加密，实现了对数据的较高等级的保护；能够对第三方数据源的待保护数据进行保护，应用范围明显扩增；以及，用户能够通过终端设备上的对应的应用程序来实现数据安全保护的目的，使用方便、操作简单。
附图说明
为了更清楚地说明本公开具体实施方式或现有技术中的技术方案，下面将对具体实施方式或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本公开的一些实施方式，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本公开实施例提供的现有的加密U盘内部的结构示意图；
图2为本公开实施例提供的保护数据安全的移动存储装置的内部结构示意图；
图3为本公开实施例提供的USB接口为USB-A接口的保护数据安全的移动存储装置的基板正面结构示意图；
图4为本公开实施例提供的USB接口为USB-A接口的保护数据安全的移动存储装置的基板反面结构示意图；
图5为本公开实施例提供的USB接口为USB-A接口的保护数据安全的移动存储装置的整体示意图；
图6为本公开实施例提供的USB接口为Type C接口的保护数据安全的移动存储装置的基板正面结构示意图；
图7为本公开实施例提供的USB接口为Type C接口的保护数据安全的移动存储装置的基板反面结构示意图；
图8为本公开实施例提供的USB接口为Type C接口的保护数据安全的移动存储装置的整体示意图；
图9为本公开实施例提供的终端设备与移动存储装置的连接示意图；
图10为本公开实施例提供的另一种移动存储装置的示意性框图；以及
图11为本公开实施例提供的移动存储系统的示意性框图。
图标：11、21-USB/SSD控制器；12、22-安全控制器；13、23-存储器；24-基板；25-USB接口；26-USB集线器；27-上外壳；28-下外壳；29-USB帽；251-USB-A接口；252-Type C接口。
具体实施方式
参见图1，该图示意性地示出了传统加密U盘的内部结构。传统加密U盘利用其控制器(包括USB/SSD控制器11和安全控制器12)来实现对与其连接的存储器13中的数据的加密和解密操作，并且加密及解密的整个过程在U盘的控制器处完成。然而，受限于USB的带宽限制，加密及解密过程的速率较低；另外，由于现有加密U盘的加密算法的复杂性，加密及解密数据的过程所需要花费的时间较长。特别是对于多个资料的加密及解密或者对于单个大文件的运算处理，需要用户有足够的耐心和时间去等待，例如，传统加密U盘加密或解密1GB的影片通常需要用户等待5分钟左右。因此，传统的加密U盘执行关于数据安全保护的操作的速率低下，导致处理时间较长。
基于此，本公开实施例提供了一种移动存储装置、系统、方法及存储介质，以解决现有技术存在的至少部分缺陷。
下面将结合实施例对本公开的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领 域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
本公开实施例提供了一种保护数据安全的移动存储装置，下面将结合附图对本公开实施例提供的保护数据安全的移动存储装置进行详细地描述。
在附图中，图2是根据本公开实施例的保护数据安全的移动存储装置的内部结构的示意性模块框图，图3-4及图6-7是本公开实施例的保护数据安全的移动存储装置的内部结构的平面示意图。
参见图2-4及图6-7，该保护数据安全的移动存储装置包括：基板24和分别安装在基板24上的USB接口25、USB集线器26、USB/SSD控制器21、存储器23、安全控制器22，其中，USB集线器26的一端与USB接口25连接，USB集线器26的另一端分别与USB/SSD控制器21、安全控制器22连接，USB/SSD控制器21还与存储器23连接。
USB接口25可以配置成与终端设备连接(参见图9或图11)。该终端设备可以通过USB接口25分别向USB/SSD控制器21、安全控制器22发送数据安全保护指令。数据安全保护指令中可以携带有待保护数据的信息。数据安全保护指令可以包括加密指令和/或解密指令。终端设备向USB/SSD控制器21发送的数据安全保护指令与向安全控制器22发送的数据安全保护指令在内容上可以完全相同，例如，终端设备将同一数据安全保护指令诸如携带有待保护数据的信息且包含指示加密需求的信息的数据安全保护指令(即，加密指令)的两个副本分别发送给两个控制器；或者在内容上可以存在差异，例如，终端设备向控制器21发送的数据安全保护指令中携带有关于待保护数据的信息，而终端设备向控制器22发送的数据安全保护指令中包含有指示加密需求的信息和/或指示解密需求的信息但不携带关于待保护和/或待解密的数据的信息。
USB/SSD控制器21可以配置成根据所接收的数据安全保护指令获取与其连接的存储器23中所存储的待保护数据，并将待保护数据通过USB接口25发送至终端设备。
安全控制器22可以配置成根据所接收的数据安全保护指令将内置的数据安全保护算法通过USB接口25发送至终端设备以供其使用。
终端设备还可以配置成采用从安全控制器22接收的数据安全保护算法对经由控制器21从存储器23获取的待保护数据执行数据保护操作，并将执行数据安全保护操作之后得到的信息诸如经加密的数据或经解密的数据发送至存储器23进行存储。
在本公开实施例中，该保护数据安全的移动存储装置的内部电路结构中存在两个传输通道。从上述的连接结构可以看出，两个传输通道中的一者为USB接口25—USB集线器26—USB/SSD控制器21—存储器23所组成的传输通道；两个传输通道中的另 一者为USB接口25—USB集线器26—安全控制器22所组成的传输通道。在进行数据传输时，两路传输通道可以并行地同时进行数据的传输，互不影响。
需要说明的是，上述基板24可以为PCB板(Printed circuit board，印刷电路板)，但不限于此。上述的存储器23用于存储数据，该数据可以是待被保护的数据、经保护的数据或用于交换的数据。上述存储器23可以为Flash、HDD或者SSD，但本公开实施例对上述存储器不作具体限制。
另外，在本公开实施例中，虽然图3至图8是以移动存储装置为U盘为例进行的图示，但是本公开实施例中的保护数据安全的移动存储装置可以为保护数据安全的U盘，还可以为保护数据安全的移动硬盘，或者是其它带有USB接口且能进行数据存储的移动电子设备，本公开实施例对移动存储装置不具体限制。
下面以加密的过程为例对本公开实施例的移动存储装置的工作过程进行示意性地描述：
当保护数据安全的移动存储装置通过USB接口25与终端设备连接后，终端设备可被操作人员操作以向该保护数据安全的移动存储装置发送数据安全保护指令。具体地，数据安全保护指令通过USB接口25，经由USB集线器26分别到达USB/SSD控制器21和安全控制器22。USB/SSD控制器21和安全控制器22在接收到数据安全保护指令诸如携带有待保护数据的信息的加密指令后，USB/SSD控制器21根据加密指令从与其连接的存储器23中获取待保护数据，并将待保护数据经由USB集线器26和USB接口25发送至终端设备；类似地，安全控制器22根据该加密指令将其内置的加密算法经由USB集线器26和USB接口25发送至终端设备。终端设备在接收到待保护数据和加密算法后，采用加密算法对待保护数据进行加密操作，并将加密操作后得到的密文经由USB接口25、USB集线器26和USB/SSD控制器21发送至存储器23进行存储。
上述过程中，待保护数据从USB/SSD控制器21发送至终端设备的过程与加密算法从安全控制器22发送至终端设备的过程可以是并行地同时进行的，并且在终端设备CPU强大的运算和处理能力的支持配合下，快速地完成对待保护数据加密的操作。利用终端设备的CPU来进行加密的操作，大大节省了数据处理的时间。
这里只对加密的过程进行详细的介绍，解密的过程与加密的过程类似地执行，具体过程可以参照上述加密过程的举例，在此不再对解密的过程进行赘述。
在根据本公开实施例的移动存储装置中，加密操作和解密操作可以是在终端设备上完成的。终端设备的CPU具有比U盘中的控制器强大得多的运算能力和处理能力，能够快速实现对待保护数据的加密操作或解密操作，速率快，大大节省了数据处理的 时间，缓解了现有的移动存储装置在执行数据安全保护的操作时，速率低下，处理时间长的问题。
上述内容对本公开实施例的保护数据安全的移动存储装置的结构和工作过程进行了简要介绍，下面对其中涉及的其它结构以及工作过程进行描述。
在本公开的一个可选实施例中，终端设备还可以配置成将数据安全保护指令发送至下述目标控制器和安全控制器22，其中，上述目标控制器可以为除USB/SSD控制器21以外的能够对存储部件中的数据进行访问(例如写入和/或读取)的控制器，诸如可以为其他终端设备或远程服务器诸如基于云的服务器中的能够对存储部件中的数据进行访问的控制器。
目标控制器可以配置成根据数据安全保护指令获取与其连接的存储部件中存储的待保护数据，并将待保护数据发送至终端设备。
安全控制器22可以配置成根据数据安全保护指令将其内置的数据保护算法通过USB接口25发送至终端设备。
终端设备还可以配置成采用数据安全保护算法对待保护数据执行数据保护操作，并将执行数据安全保护操作之后得到的被保护的数据发送至存储部件进行存储。
在现有的移动存储装置中，如图1所示出的，控制器只能对存储器23中的数据执行数据安全保护操作，功能单一，应用范围窄。
基于此，发明人设计了根据本公开实施例的上述保护数据安全的移动存储装置的结构，该保护数据安全的移动存储装置能够实现跨平台的数据安全保护。
下面以云端数据的安全保护为例对跨平台的数据保护的具体实现过程进行详细描述。
在这里以对云端数据进行加密操作为例进行介绍，当然还可以对电脑中的数据，手机中的数据等任何第三方渠道的数据进行加密操作，本公开实施例对其不作具体限制。
当保护数据安全的移动存储装置通过USB接口25与终端设备连接后，终端设备可以被操作人员操作以对保护数据安全的移动存储装置(具体可以为安全控制器22)和云端控制器(即上述的目标控制器)发送携带有关于待保护数据的信息的加密指令。具体地，加密指令通过USB接口25，经由USB集线器26到达安全控制器22，类似地，加密指令通过无线或有线通信方式到达云端控制器。安全控制器22在接收到加密指令后，可以根据加密指令将其内置的加密算法经由USB集线器26和USB接口25发送至终端设备。并行地和/或同时地，云端控制器在接收到加密指令后，可以根据加密指令(其携带有待保护数据的信息)从与其连接的云端存储器(即存储部件)中获 取待保护数据，并将待保护数据发送至终端设备。终端设备在接收到加密算法和待保护数据后，可以采用加密算法对待保护数据进行加密操作，并将加密操作后得到的密文发送至云端进行存储。
在上述过程中，待保护数据从云端发送至终端设备的过程与加密算法从安全控制器22发送至终端设备的过程可以是并行地同时进行的，并且在终端设备CPU强大的运算和处理能力的支持配合下，快速地对待保护数据完成加密的操作。利用终端设备的CPU来进行加密的操作，大大节省了数据处理的时间。并且，由此可见，本公开实施例中的保护数据安全的移动存储装置能够实现全方位的数据安全保护，应用范围广，提高了用户体验。
这里只对加密的过程进行详细的介绍，解密的过程与加密的过程类似，解密的具体过程可以参照上述加密过程的举例，在此不再对解密的过程进行赘述。
参见图10，在本公开的一个可选实施例中，该保护数据安全的移动存储装置还包括：分别安装在基板24上的第一振荡电路、第一电源供电电路、复位电路、第二振荡电路和第二电源供电电路。
第一振荡电路可以与USB/SSD控制器21连接，并且可以配置成供USB/SSD控制器21进行工作。第一电源供电电路可以分别与USB/SSD控制器21、存储器23连接，并且可以配置成为USB/SSD控制器21和存储器23提供电能。复位电路可以与USB/SSD控制器21连接。第二振荡电路可以与安全控制器22连接，并且可以配置成供安全控制器22进行工作。第二电源供电电路可以与安全控制器22连接，并且可以配置成为安全控制器22提供电能。
在本公开的一个可选实施例中，该保护数据安全的移动存储装置还包括：电阻器、电容器和电感器，其中，电阻器、电容器和电感器均安装在基板24上。
需要说明的是，该保护数据安全的移动存储装置的基板24上除了包含上述的主要器件外，还包括一些必要的电阻器、电容器、电感器等被动器件，这里不再对其连接结构进行具体介绍；此外，基板24上器件之间可以通过铜线电气连接。
在本公开的一个可选实施例中，数据安全保护算法可以包括但不限于：AES256加密算法和/或SM4加密算法。
具体的，安全控制器22中内置的数据安全保护算法可以为AES256加密算法，也可以为SM4加密算法，但本公开实施例对其不作具体限制；安全控制器22可以为MJ1001e，也可以为MJ1002e，但本公开实施例对其不作具体限制。
上述的数据安全保护算法不仅可以对单个文件进行加密，还可对多个文件夹以及文件夹里面的多个文件进行加密，能够确保每一个文件加密后都是密文。必须经过本 公开实施例的保护数据安全的移动存储装置中的与加密算法对应的解密算法进行解密，才能查看及分享数据。经过多次实验证明，对总容量为1GB的8000个档案进行加密时，加密时间基本上仅需要50秒。与传统的移动存储装置在对1GB的影片进行加密时，加密时间通常长达5分钟相比，本公开实施例提供的保护数据安全的移动存储装置显著地缩短了数据处理时间。
在本公开的一个可选实施例中，参考图3和图6，USB接口25可以包括USB-A接口251和Type C接口252中任一种或组合。
为了满足用户将保护数据安全的移动存储装置与不同终端设备的连接需求，本公开实施例提供的保护数据安全的移动存储装置的USB接口25可以为USB-A接口251，或者Type C接口252。
在本公开的一个可选实施例中，参考图5和图8，该保护数据安全的移动存储装置还可以包括：上外壳27和下外壳28；
上外壳27和下外壳28可以卡扣接合，配置成固定和保护安装有电子器件的基板24，其中，电子器件至少包括：USB集线器26、USB/SSD控制器21、存储器23、以及安全控制器22。
在本公开的一个可选实施例中，参考图5和图8，该保护数据安全的移动存储装置还可以包括：USB帽29。
USB帽29可以卡扣接合在USB接口25上，配置成保护USB接口25。
在本公开的一个可选实施例中，终端设备可以包括下述中任何项：膝上型计算机、台式电脑、个人数字助理、智能手机。在本公开的另一个可选的实施例中，终端设备可以是本地电子设备，充当服务器的至少一部分功能的本地电子设备，本地服务器，或者远程服务器诸如云服务器。
具体地，终端设备中安装有与该保护数据安全的移动存储装置配套使用的APP。使用时，操作人员将保护数据安全的移动存储装置的USB接口25与终端设备的对应接口连接，然后操作人员打开终端设备上的APP，进而通过终端设备上的APP发送数据安全保护指令。
下面通过与现有的移动存储装置进行对比来说明本公开实施例提供的保护数据安全的移动存储装置的至少一部分优点：
(1)现有的移动存储装置利用移动存储装置内部的控制器(具体可以为单片机)对存储器23内部的数据进行加密或解密操作，这样的操作由于受单片机本身的速度带宽限制，数据安全保护操作的速度慢，处理时间长。然而，本公开提供的保护数据安全的移动存储装置具有独特的结构——两个传输通道并行，并利用终端设备的CPU(其 具有高性能快速运算能力)进行数据安全保护操作，大大提高了数据处理速度，节省了处理时间。经多次实验证明，本公开提供的保护数据安全的移动存储装置的加解密速度可以达到现有的移动存储装置的加解密速度的10倍以上；
(2)现有的移动存储装置在进行数据安全保护操作时，只能对一个特定的分区进行数据安全保护操作，保护等级低，而本公开中的保护数据安全的移动存储装置采用了AES256加密算法或SM4加密算法，其不仅能对特定的分区进行数据安全保护操作，而且能将分区内的每一个文档都变成密文，即其能直接对实体文档进行数据安全保护操作，保护等级高；
(3)现有的移动存储装置只能对与控制器连接的存储器23内的数据进行数据安全保护操作，应用范围窄，而本公开中的保护数据安全的移动存储装置不仅能够对移动存储装置内的存储器23内的数据进行数据安全保护操作，还能够对该终端设备本身上的数据、其他终端设备上的数据或云端数据等任何第三方数据进行数据安全保护操作，能够实现全方位的数据安全保护，应用范围广；
(4)本公开中的保护数据安全的移动存储装置操作方便、快捷，只需将该移动存储装置与终端设备连接，打开终端设备上的对应的APP，通过APP即可实现数据安全保护操作，用户使用方便、简单、快捷。
参见图11，本公开实施例还提供了一种保护数据安全的移动存储系统，包括终端设备和上述的保护数据安全的移动存储装置，其中，终端设备与保护数据安全的移动存储装置连接。
再参见图11，在一种实施方式中，移动存储系统还可以包括另外的数据源设备，该另外的数据源设备包括目标控制器和与目标控制器连接的存储部件。终端设备可以将数据安全保护指令发送至目标控制器和安全控制器。相应地，目标控制器可以响应于数据安全保护指令获取与其连接的存储部件中存储的待保护数据，并将待保护数据发送至终端设备。安全控制器可以响应于数据安全保护指令将其内置的数据安全保护算法发送至终端设备。同样地，终端设备可以采用数据安全保护算法对待保护数据执行数据安全保护操作，并将执行安全保护操作之后得到的信息发送至存储部件进行存储。
在另一种实施方式中，另外的数据源设备包括云服务器或网络硬盘，使得终端能够采用接收到的数据安全保护算法对来自云服务器或网络硬盘的待保护数据进行安全保护，以快速加密或解密。在另一种实施方式中，上述另外的数据源设备可以是终端设备本身。
本公开实施例还提供了一种保护数据安全的方法，可以应用于移动存储系统。该 方法可以包括如下步骤：移动存储装置通过USB接口从终端设备接收数据安全保护指令，并将所接收的数据安全保护指令分别发送至USB/SSD控制器和安全控制器；USB/SSD控制器响应于数据安全保护指令获取存储器中的待保护数据，并将其发送至终端设备；并且安全控制器响应于数据安全保护指令将其内置的数据安全保护算法发送至终端设备。
终端设备可以采用数据安全保护算法对待保护数据执行数据安全保护操作，并将执行数据安全保护操作之后得到的信息发送至存储器进行存储。
在一种实施方式中，该方法还可以包括终端设备将数据安全保护指令发送至另外的数据源设备的目标控制器和移动存储装置中的安全控制器，以分别获取待保护的数据和数据安全保护算法。具体的实现过程与上述类似，在此不再赘述。
本公开实施例还提供了一种可以应用于终端设备的保护数据安全的方法，包括例如下述步骤：将数据安全保护指令发送至移动存储装置中的USB/SSD控制器和安全控制器；从USB/SSD控制器接收响应于数据安全保护指令的待保护的数据；从安全控制器接收响应于数据安全保护指令的数据安全保护算法；基于所接收的数据安全保护算法对所接收的待保护数据执行数据安全保护处理，得到经处理的信息；以及将经处理的信息发送至移动存储装置中的存储器以进行存储。关于该方法的更详细的实现可以参考上述几方面的描述。
本公开实施例还提供了一种非暂时性存储介质，在该非暂时性存储介质上存储有程序指令，该程序指令在由处理器执行时，使处理器执行前述方法实施例中所描述的方法。作为示例，该非暂时性存储介质可以是终端设备中的与处理器连接的存储器。终端设备中的存储器中存储有能被处理器访问的计算机指令，并且该计算机指令在由处理器执行时能够执行上述可以应用于终端设备的方法。
本发明实施例提供的用于保护数据安全的移动存储系统、方法及存储装置具有与本发明实施例提供的用于数据安全保护的移动存储装置相同或类似的优点，具体可以参见以上关于装置实施例的优点的描述。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统和方法的具体工作过程，可以参考前述装置实施例中的对应过程，在此不再赘述。
另外，在本公开实施例的描述中，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或一体地连接；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通。对于本领域的普通技术人员而言，可以具体情况理解上述术语在本公开中的具体含义。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
此外，术语“第一”、“第二”、“第三”以及“第四”仅用于描述目的，而不能理解为指示或暗示相对重要性。
最后应说明的是：以上各实施例仅用以说明本公开的技术方案，而非对其限制；尽管参照前述各实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本公开各实施例技术方案的范围
工业实用性
本公开实施例提供的保护数据安全的移动存储装置、系统、方法及存储介质能例如显著降低对待保护数据的处理时间，对分区内的每一个单独的文件进行加密以实现对数据的高等级保护，以及对第三方数据源的待保护数据进行保护从而获得应泛的范围。

Claims (19)

  1. 一种保护数据安全的移动存储装置，其特征在于，包括：基板和分别安装在所述基板上的USB接口、USB集线器、USB/SSD控制器、存储器、安全控制器，其中，所述USB集线器的一端与所述USB接口连接，所述USB集线器的另一端分别与所述USB/SSD控制器、所述安全控制器连接，所述USB/SSD控制器还与所述存储器连接；
    所述USB接口，配置成与终端设备连接，以从所述终端设备接收向所述USB/SSD控制器、所述安全控制器发送的数据安全保护指令，所述数据安全保护指令中携带有待保护数据的信息，且所述数据安全保护指令包括以下任一种：加密指令，解密指令；
    所述USB/SSD控制器，配置成根据所述数据安全保护指令获取与其连接的所述存储器中存储的待保护数据，并将所述待保护数据通过所述USB接口发送至所述终端设备；
    所述安全控制器，配置成根据所述数据安全保护指令将其内置的数据安全保护算法通过所述USB接口发送至所述终端设备；
    其中，所述终端设备采用所述数据安全保护算法对所述待保护数据执行数据安全保护操作，并将执行所述数据安全保护操作之后得到的信息发送至所述存储器进行存储。
  2. 根据权利要求1所述的移动存储装置，其特征在于，所述USB接口将从所述终端设备接收的数据安全保护指令发送至所述USB/SSD控制器的第一发送过程与发送至所述安全控制器的第二发送过程并行地发生，而没有两个发送过程间的任何的互相影响。
  3. 根据权利要求1所述的移动存储装置，其特征在于，所述USB/SSD控制器将所述待保护的数据经由所述USB接口发送至所述终端设备的第三发送过程与所述安全控制器将所述数据安全保护算法经由所述USB接口发送至所述终端设备的第四发送过程并行地发生，而没有两个发送过程间的任何的互相影响。
  4. 根据权利要求1至3中任一项所述的移动存储装置，其特征在于，还包括：分别安装在所述基板上的第一振荡电路、第一电源供电电路、复位电路、第二振荡电路和第二电源供电电路；
    所述第一振荡电路与所述USB/SSD控制器连接，配置成供所述USB/SSD控制器进行工作；
    所述第一电源供电电路分别与所述USB/SSD控制器、所述存储器连接，配置成为所述USB/SSD控制器和所述存储器提供电能；
    所述复位电路与所述USB/SSD控制器连接；
    所述第二振荡电路与所述安全控制器连接，配置成供所述安全控制器进行工作；以及
    所述第二电源供电电路与所述安全控制器连接，配置成为所述安全控制器提供电能。
  5. 根据权利要求1至3中任一项所述的移动存储装置，其特征在于，所述数据安全保护算法是能对数据存储区内的任何单独的数据文档进行数据安全保护操作的算法。
  6. 根据权利要求1至3或5中任一项所述的移动存储装置，其特征在于，所述数据安全保护算法包括：AES256加密算法和/或SM4加密算法。
  7. 根据权利要求1至3中任一项所述的移动存储装置，其特征在于，所述USB接口包括下述中任何项：USB-A接口；以及Type C接口。
  8. 根据权利要求1至3中任一项所述的移动存储装置，其特征在于，还包括：上外壳和下外壳；
    所述上外壳和所述下外壳卡扣接合，共同地配置成固定并保护所述基板。
  9. 一种保护数据安全的移动存储系统，其特征在于，包括终端设备和上述权利要求1至8中任一项所述的保护数据安全的移动存储装置，其中，所述终端设备与所述保护数据安全的移动存储装置连接。
  10. 根据权利要求9所述的移动存储系统，其特征在于，还包括另外的数据源设备，所述另外的数据源设备包括目标控制器和与所述目标控制器连接的存储部件，
    所述终端设备配置成将所述数据安全保护指令发送至所述目标控制器和所述安全控制器；
    所述目标控制器，配置成根据所述数据安全保护指令获取与其连接的所述存储部件中存储的待保护数据，并将所述待保护数据发送至所述终端设备；
    所述安全控制器，配置成根据所述数据安全保护指令将其内置的数据安全保护算法通过所述USB接口发送至所述终端设备；以及
    所述终端设备还配置成采用所述数据安全保护算法对所述待保护数据执行数据安全保护操作，并将执行所述数据安全保护操作之后得到的信息发送至所述存储部件进行存储。
  11. 根据权利要求10所述的移动存储系统，其特征在于，所述另外的数据源设备包括云服务器或网络硬盘，使得所述终端能够采用接收到的所述数据安全保护算法对来自云服务器或网络硬盘的所述待保护数据进行快速的数据安全保护操作。
  12. 根据权利要求10所述的移动存储系统，其特征在于，所述另外的数据源设备 包括所述终端设备。
  13. 一种保护数据安全的方法，应用于根据权利要求9-12中任一项所述的移动存储系统，其特征在于，所述方法包括：
    所述移动存储装置通过所述USB接口从所述终端设备接收数据安全保护指令，并将所接收的数据安全保护指令分别发送至所述USB/SSD控制器和所述安全控制器；
    其中：
    所述USB/SSD控制器根据所述数据安全保护指令获取与其连接的所述存储器中存储的待保护数据，并将所述待保护数据通过所述USB接口发送至所述终端设备；并且
    所述安全控制器根据所述数据安全保护指令将其内置的数据安全保护算法通过所述USB接口发送至所述终端设备；
    以使得：所述终端设备采用所述数据安全保护算法对所述待保护数据执行数据安全保护操作，并将执行所述数据安全保护操作之后得到的信息发送至所述存储器进行存储。
  14. 根据权利要求13所述的保护数据安全的方法，其特征在于，所述USB接口将从所述终端设备接收的数据安全保护指令发送至所述USB/SSD控制器的第一发送过程与发送至所述安全控制器的第二发送过程并行地发生，而没有两个发送过程间的任何的互相影响。
  15. 根据权利要求13所述的保护数据安全的方法，其特征在于，所述USB/SSD控制器将所述待保护的数据经由所述USB接口发送至所述终端设备的第三发送过程与所述安全控制器将所述数据安全保护算法经由所述USB接口发送至所述终端设备的第四发送过程并行地发生，而没有两个发送过程间的任何的互相影响。
  16. 根据权利要求13至15中任一项所述的保护数据安全的方法，其特征在于，所述方法还包括：
    所述终端设备将所述数据安全保护指令发送至所述目标控制器和所述安全控制器；
    所述目标控制器根据所述数据安全保护指令获取与其连接的所述存储部件中存储的待保护数据，并将所述待保护数据发送至所述终端设备；
    所述安全控制器根据所述数据安全保护指令将其内置的数据安全保护算法通过所述USB接口发送至所述终端设备；以及
    所述终端设备采用所述数据安全保护算法对所述待保护数据执行数据安全保护操作，并将执行所述数据安全保护操作之后得到的信息发送至所述存储部件进行存储。
  17. 一种保护数据安全的方法，应用于与权利要求1-8中任一项所述的移动存储装 置连接的终端设备，其特征在于，所述方法包括：
    将数据安全保护指令发送至所述移动存储装置中的所述USB/SSD控制器和所述安全控制器；
    从所述USB/SSD控制器接收响应于所述数据安全保护指令的待保护的数据；
    从所述安全控制器接收响应于所述数据安全保护指令的数据安全保护算法；
    基于所接收的数据安全保护算法对所接收的待保护数据执行数据安全保护处理，得到经处理的信息；以及
    将所述经处理的信息发送至所述移动存储装置中的所述存储器以进行存储。
  18. 根据权利要求17所述的方法，其特征在于，所述终端设备还与另外的数据源设备连接，所述另外的数据源设备包括目标控制器及与所述目标控制器连接的存储部件，所述方法还包括：
    将数据安全保护指令发送至所述另外的数据源设备中的所述目标控制器和所述移动存储装置中的所述安全控制器；
    从所述目标控制器接收响应于所述数据安全保护指令的待保护的数据；
    从所述安全控制器接收响应于所述数据安全保护指令的数据安全保护算法；
    基于所接收的数据安全保护算法对所接收的待保护数据执行数据安全保护处理，得到经处理的信息；以及
    将所述经处理的信息发送至所述另外的数据源设备中的所述存储部件以进行存储。
  19. 一种非暂时性存储介质，在所述非暂时性存储介质上存储有程序指令，所述程序指令在由处理器执行时，使所述处理器执行权利要求17-18中任一项所述的方法。
PCT/CN2019/109065 2019-06-26 2019-09-29 保护数据安全的移动存储装置、系统、方法及存储介质 WO2020258572A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910565501.7A CN110287740B (zh) 2019-06-26 2019-06-26 保护数据安全的移动存储装置及移动存储系统
CN201910565501.7 2019-06-26

Publications (1)

Publication Number Publication Date
WO2020258572A1 true WO2020258572A1 (zh) 2020-12-30

Family

ID=68007664

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/109065 WO2020258572A1 (zh) 2019-06-26 2019-09-29 保护数据安全的移动存储装置、系统、方法及存储介质

Country Status (2)

Country Link
CN (1) CN110287740B (zh)
WO (1) WO2020258572A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110287740B (zh) * 2019-06-26 2021-08-03 深圳豪杰创新电子有限公司 保护数据安全的移动存储装置及移动存储系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1853149A (zh) * 2003-09-18 2006-10-25 优创信息安全有限公司 用于电子处理器的多功能便携设备
CN101196855A (zh) * 2007-12-29 2008-06-11 北京华大恒泰科技有限责任公司 移动加密存储设备及密文存储区数据加解密处理方法
CN104166824A (zh) * 2013-04-02 2014-11-26 文盛业 多层结构的usb存储装置
CN208128281U (zh) * 2018-03-29 2018-11-20 哈工大机器人集团重庆慕云物联网科技有限公司 一种加密安全通讯模块电路
CN110287740A (zh) * 2019-06-26 2019-09-27 深圳豪杰创新电子有限公司 保护数据安全的移动存储装置及移动存储系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100464313C (zh) * 2005-05-20 2009-02-25 联想(北京)有限公司 一种移动存储装置及存取移动存储装置中加密数据的方法
DE102006000930A1 (de) * 2006-01-05 2007-07-12 Infineon Technologies Ag Speicher-Anordnung, Speichereinrichtungen, Verfahren zum Verschieben von Daten von einer ersten Speichereinrichtung zu einer zweiten Speichereinrichtung und Computerprogrammelemente
CN201111076Y (zh) * 2007-08-28 2008-09-03 深圳市德卡科技有限公司 存储式智能卡读写器
CN106228073A (zh) * 2016-07-08 2016-12-14 北京小米移动软件有限公司 智能移动存储设备及进行数据存取的方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1853149A (zh) * 2003-09-18 2006-10-25 优创信息安全有限公司 用于电子处理器的多功能便携设备
CN101196855A (zh) * 2007-12-29 2008-06-11 北京华大恒泰科技有限责任公司 移动加密存储设备及密文存储区数据加解密处理方法
CN104166824A (zh) * 2013-04-02 2014-11-26 文盛业 多层结构的usb存储装置
CN208128281U (zh) * 2018-03-29 2018-11-20 哈工大机器人集团重庆慕云物联网科技有限公司 一种加密安全通讯模块电路
CN110287740A (zh) * 2019-06-26 2019-09-27 深圳豪杰创新电子有限公司 保护数据安全的移动存储装置及移动存储系统

Also Published As

Publication number Publication date
CN110287740B (zh) 2021-08-03
CN110287740A (zh) 2019-09-27

Similar Documents

Publication Publication Date Title
US11876785B2 (en) System and method for routing-based internet security
US10154013B1 (en) Updating encrypted cryptographic key
TWI662414B (zh) 使用固態硬碟以加速運算密集操作的技術
US10834086B1 (en) Hybrid cloud-based authentication for flash storage array access
EP3304845B1 (en) Authorization and authentication in a cloud-based storage array
US10438004B2 (en) Dual-system electronic apparatus and terminal
US9893885B1 (en) Updating cryptographic key pair
US8458494B1 (en) Systems and methods for secure third-party data storage
US9076004B1 (en) Systems and methods for secure hybrid third-party data storage
US11470120B2 (en) Providing different levels of resource access to a computing device that is connected to a dock
US20170222988A1 (en) Device, system, and method for processor-based data protection
US9203815B1 (en) Systems and methods for secure third-party data storage
US11196721B2 (en) Systems and methods for establishing a secure communication channel between an information handling system and a docking station
EP3449607A1 (en) Systems and methods for managing encryption keys for single-sign-on applications
US20150222607A1 (en) Portable security device, method for securing a data exchange and computer program product
WO2020258572A1 (zh) 保护数据安全的移动存储装置、系统、方法及存储介质
CN104123244A (zh) Usb重定向系统及方法
US10678708B2 (en) Encrypted raid drive management
CN113449349A (zh) 平台安全机制
CN109587205B (zh) 共享目录的创建挂载方法及相关设备
KR102008691B1 (ko) 안전성을 높인 클라우드 저장소 기반 메모리 장치 및 이의 인증 제어 방법
US11641398B2 (en) Secure data transfer over wireless networks using data storage encryptors
CN205193805U (zh) 一种加密的usb连接装置、数据传输装置、存储装置及电视
CN219718250U (zh) 一种通信密码卡以及密码设备
CN109815708A (zh) 一种计算机网络安全控制系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19935619

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19935619

Country of ref document: EP

Kind code of ref document: A1