WO2022068298A1

WO2022068298A1 - Usb flash disk access method and usb flash disk

Info

Publication number: WO2022068298A1
Application number: PCT/CN2021/103492
Authority: WO
Inventors: 宁姣; 张程程; 袁艳芳; 张磊; 高志洲; 杨峰; 谷思庭; 刘佳易; 王晖南
Original assignee: 北京智芯微电子科技有限公司; 国网信息通信产业集团有限公司; 国网山西省电力公司营销服务中心; 国家电网有限公司; 北京智芯半导体科技有限公司
Priority date: 2020-09-30
Filing date: 2021-06-30
Publication date: 2022-04-07
Also published as: CN112084524A; CN112084524B

Abstract

A USB flash disk access method and a corresponding USB flash disk. Said access method comprises: receiving an access instruction for the USB flash disk (S11); determining that the access address of the access instruction is a specific address of the USB flash disk (S12); and executing an APDU instruction related to the access instruction or returning data of a designated area, so as to respond to the access instruction (S13). The described USB flash disk access method can improve the reading security of a USB flash disk and implement the personalized application of the USB flash disk.

Description

U disk access method and U disk

technical field

The invention relates to the technical field of mobile storage, in particular to a U disk access method and a U disk.

Background technique

With the advent of the information age, mobile storage media has become an indispensable information transmission tool in people's daily work. U disk adopts USB interface, supports hot swap, and has the characteristics of fast transmission speed, simple use, small size, large capacity and easy portability, and has become the most widely used mobile storage medium.

At present, under Windows, the upper-layer application of the operating system can normally use the SCSI private command, and realize the management of the private partition of the U disk through the private command. However, under some operating systems, such as Linux, root privileges are required to use private commands. Root authority, a type of system authority, also called root authority, is a super administrator in some systems. This account has the highest authority of the entire system, and can easily delete or change parts of the system. If the user obtains the root authority, he can easily flash the system, backup, restore and uninstall system files, etc. After the malware obtains the root authority, it will cause irreparable damage to the system, and all the privacy of the user stored on the host will be lost. exposed to malware. In order to avoid some potential risks when applying the platform, the common practice of manufacturers is to set SecureLock security lock and limit root permissions. This approach limits the potential of the system to a certain extent while ensuring security.

APDU: (ApplicationProtocolDataUnit)--Application Protocol Data Unit. APDU is often used for data interaction of IC card and business development of IC card.

FAT: (File Allocation Table) is the abbreviation of File Allocation Table, which is a linked list file organization structure proposed to facilitate the storage, addition and deletion of files.

SUMMARY OF THE INVENTION

In view of this, the present invention aims to provide a U-disk access method and a U-disk to at least partially solve the above problems.

In order to achieve the above object, the first aspect of the present invention provides a U disk access method, the access method comprises: in response to a received access instruction to the U disk; determining that the access address of the access instruction is The specific address of the U disk; execute the APDU command related to the access command or return the data of the specified area to realize the response to the access command.

Preferably, the specific address is obtained through the following steps: taking the address of the preset file in the file allocation table as the specific address.

Preferably, the preset file is pre-stored in a preset directory of a preset partition of the U disk.

Preferably, the executing the corresponding APDU instruction or returning the data in the designated area includes: if the access instruction is a "write instruction", executing the APDU instruction related to the access instruction; if the access instruction is " read command" to return the data in the specified area.

Preferably, before returning the data in the designated area, the method further includes: judging whether there is valid data in the designated area, if there is, returning the data in the designated area, otherwise returning "null" or "error" .

Preferably, the executing the APDU instruction related to the access instruction includes: extracting data in the data field of the access instruction; and executing the APDU instruction that has a mapping relationship with the data.

Preferably, after executing the APDU instruction that has a mapping relationship with the data, the method further includes: writing the execution result of the APDU instruction into the designated area.

In a second aspect of the present invention, a USB flash drive is also provided, comprising an interface component, a storage component and a control component, the control component is configured to: determine that the access address of the access instruction acquired from the interface component is the A specific address in the storage unit; execute the APDU command related to the access command or return the data of the specified area to realize the response to the access command.

Preferably, the storage component includes a preset file, the preset file is pre-stored in a preset directory of a preset partition of the storage component, and the address of the preset file in the file allocation table is used as the address of the preset file. specific address.

Preferably, the storage component includes a private partition invisible to the host operating system, and the private partition can only be accessed by the APDU command.

The present invention also provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a processor, any one of the above U disk access methods is implemented.

The U-disk access method and U-disk of the present invention have the following beneficial effects:

1) In this embodiment, there is no need to obtain the ROOT authority, but the general interface provided by the operating system is used to execute personalized application processing, and access the private partition through the application processing, thereby ensuring the security and reliability of the system.

2) The key data is stored in the private partition of the U disk, and the ciphertext method can be used for data transmission and storage according to the application requirements, which ensures the security of the data.

Other features and advantages of the present invention will be described in detail in the detailed description that follows.

Description of drawings

The accompanying drawings constituting a part of the present invention are used to provide further understanding of the present invention, and the schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the attached image:

1 is a schematic diagram of steps of a U disk access method in an embodiment of the present invention;

FIG. 2 is a flow chart of establishing a preset file in an embodiment of the present invention;

3 is a flow chart of determining a specific address in an embodiment of the present invention;

FIG. 4 is a schematic diagram of a processing flow of a "write command" in an embodiment of the present invention;

5 is a schematic diagram of an APDU command type in an embodiment of the present invention;

FIG. 6 is a schematic diagram of a processing flow of a "read instruction" in an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a U disk in an embodiment of the present invention.

Detailed ways

The specific implementations of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific implementation manners described herein are only used to illustrate and explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention.

FIG. 1 is a schematic diagram of steps of a U-disk access method in an embodiment of the present invention. As shown in FIG. 1 , the U-disk access method includes:

S11, in response to the received access instruction to the U disk;

When the USB flash drive receives an access command through its USB interface, the access command is a general command, specifically a SCSI general command. The SCSI general command is used because the operating system generally uses a file system in the form of FAT16/FAT32/NTFS, etc. The instruction set manages it. This U disk only needs to process the general instructions issued by the general operating system, so it does not need additional permissions.

S12, determine that the access address of the access instruction is the specific address of the U disk;

The specific address in this embodiment includes one or a combination of a specific partition and a specific offset. For example, it is determined that the partition for the access operation is the first partition, and the access address is the same as the value of a preset global variable ADDR. The setting steps of the global variable ADDR will be described in detail later.

S13. Execute the APDU instruction related to the access instruction or return the data of the specified area, so as to realize the response to the access instruction.

If the determined conditions in the previous step are met, the access instruction is intercepted or discarded, and the function of the access instruction is no longer executed. The intercepting or discarding specifically includes: firstly intercepting, then extracting the APDU, executing the APDU according to the mapping relationship, not executing if it is an illegal APDU instruction, and writing the error status to the specified address. Instead, the response to the access command is completed by executing the APDU command corresponding to the access command or directly returning the data of the designated area. The use of APDU command utilizes its normativeness in data transmission, but also ensures its isolation from the general command of U disk. Through this step, the access to the U disk by the general instruction is avoided, and the technical effect of data security is realized on the premise of ensuring the access security of the U disk.

FIG. 2 is a flowchart of creating a preset file in an embodiment of the present invention, as shown in FIG. 2 . In this embodiment, the preset file is pre-stored in the preset directory of the preset partition of the U disk. Specifically, when the U disk is issued, a preset designated directory is established in the preset fixed partition of the U disk (the first partition is used in this embodiment) through the host operating system. For example, the preset directory is under the first partition. \Android\data\com.example.sgskftest. A file ZHIXINIO.CRD with a fixed name is created in the preset directory, and this file is the preset file, hereinafter referred to as the IO file.

FIG. 3 is a flowchart of determining a specific address in an embodiment of the present invention, as shown in FIG. 3 . In this embodiment, the specific address is obtained through the following steps: the address of the preset file in the file allocation table is used as the specific address. When the released U disk is in use, insert it into the USB port of the host computer. After the U disk is powered on, the security chip completes a series of initialization operations and analyzes the FAT file system of the first partition to find the IO file: ZHIXINIO.CRD. If the file exists, assign the address of the file to a specific address: the global variable ADDR; otherwise, the global variable ADDR is assigned an empty value. After the address resolution is completed, the enumeration process is completed according to the process of the host operating system. Through the above steps, the access of the IO file is equal to the matching judgment of the operation address, which simplifies the process of triggering judgment.

In one embodiment, the executing the corresponding APDU command or returning the data of the designated area includes: if the access command is a "write command", executing the APDU command related to the access command; The command is a "read command", which returns the data in the specified area. The writing process corresponding to the "write command" and the reading process corresponding to the "read command" will be described separately below.

FIG. 4 is a schematic diagram of a processing flow of a “write command” in an embodiment of the present invention, as shown in FIG. 4 . In this embodiment, when the host computer application needs to send an instruction to the U disk, the instruction to be sent is taken as the data to be written into the IO file, and the general WRITE command (0x2A) of the operating system is called. After the U disk receives the WRITE command, the Judgment: If the partition of the write operation is the first partition, and the access address is the same as the address of the global variable ADDR, the instruction will be intercepted. The data field in the instruction is analyzed and processed, and the data in the data field of the access instruction is extracted; the APDU instruction having a mapping relationship with the data is executed to complete the function corresponding to the APDU instruction. The APDU command can complete functions such as encryption, decryption, private partition storage, verification PIN and other personalized command processing. And further, save the processing result and the data to be returned in a designated area, such as the global variable Buff_CMD. The setting of the subsequent steps is beneficial to enable the upper computer to obtain the execution result of the APDU instruction and return data. The setting of the above APDU command can not only realize the data operation on the private partition of the secure USB flash drive, but also realize various customization functions.

FIG. 5 is a schematic diagram of an APDU command type in an embodiment of the present invention, as shown in FIG. 5 . After the personalized application instruction is reparsed from the WRITE command (0x2A), the instruction is executed. Among them, the personalized application instructions include: encryption, decryption, private partition storage, verification PIN and other personalized instructions.

FIG. 6 is a schematic diagram of a processing flow of a “read instruction” in an embodiment of the present invention, as shown in FIG. 6 . In this embodiment, when the host computer software needs to obtain the instruction execution result or return data, it calls the general interface of the operating system, and sends the Read (0x28) instruction to the IO file. After the U disk receives the read instruction, it makes a judgment: if the read operation If the partition is the first partition, and the access address is the same as the global variable ADDR address, then this instruction is intercepted, and the data in the file is not actually read, but the processing result of the instruction stored in the specified area (Buff_CMD) in the previous step and The data to be returned is used as the return data of the read command and returned to the host computer application. When there is no valid data in the specified area, "null" or "error" is returned. Therefore, before returning the data in the designated area, adding a step of judging whether there is valid data in the designated area is beneficial to the abnormal feedback of the system and improves the use experience.

It can be seen from the above embodiment that the host computer software can call the general interface of the operating system to access the partition of the U disk without additional authority. Processing, realize the transmission of private instructions, and then realize security and personalized applications.

FIG. 7 is a schematic structural diagram of a U disk according to an embodiment of the present invention, as shown in FIG. 7 . In this embodiment, a USB flash drive is also provided, including an interface component, a storage component and a control component, the control component is configured to: determine the access address of the access instruction obtained from the interface component as the storage component The specific address in the access command; execute the APDU command related to the access command or return the data of the specified area, so as to realize the response to the access command. The interface component may be a USB interface; the storage component may be a security chip or other types of processor chips; the storage component may be a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) ) card, flash memory card (Flash Card), etc., preferably EMMC memory can be used.

For specific limitations on functions implemented by the control component, reference may be made to the limitations on the U-disk access method above, which will not be repeated here. Where the control unit can provide communication isolation between the high-speed USB and the EMMC bus.

In one embodiment, the storage component includes a preset file, the preset file is pre-stored in a preset directory of a preset partition of the storage component, and the preset file is stored in the file allocation table with the number of the preset file. address as the specific address. Through the host operating system, a specified directory is created in the fixed partition of the U disk (the first partition is used in this solution), and a file with a fixed name is created under the specified directory, that is, the aforementioned IO file: ZHIXINIO.CRD, in this embodiment The specified directory is \Android\data\com.example.sgskftest under the first partition. After the released security U disk is powered on again, the security chip parses the FAT file system of the first partition after completing a series of initialization operations, and finds the IO file: ZHIXINIO.CRD. If the file exists, assign the address of the file to the global variable ADDR; otherwise, assign ADDR to be empty. After the address resolution is completed, the enumeration process is completed according to the process of the host operating system.

In one embodiment, the storage component includes a private partition not visible to the host operating system, the private partition being accessible only by the APDU instructions. In order to improve the security of the U disk, in addition to the ordinary partition and the encrypted partition, a third sub-storage partition is also provided: the invisible "private partition": only the security chip can access, the outside is invisible, the operating system and the host computer software are not directly accessible. Data can be read and written in plaintext or in ciphertext; it can be stored in plaintext or in ciphertext; it can be managed as a single storage area, or it can be divided into different functional areas according to the application, and different security attributes can be added for independent management. Since the private partition is invisible to the host operating system and cannot utilize the file system of the host operating system, it is necessary to use the private instructions in the SCSI instruction set to manage the partition through the security chip. In this embodiment, an APDU command is used to access it.

An embodiment of the present invention further provides a computer storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the U disk access method described in this embodiment is implemented.

Embodiments of the present invention provide a method for executing private instructions without root authority, implementing personalized application processing, and accessing private partitions through personalized applications.

The optional embodiments of the embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the embodiments of the present invention are not limited to the specific details of the above-mentioned embodiments. A variety of simple modifications are made to the technical solution of the invention, and these simple modifications all belong to the protection scope of the embodiments of the present invention.

In addition, it should be noted that each specific technical feature described in the above-mentioned specific implementation manner may be combined in any suitable manner under the circumstance that there is no contradiction. To avoid unnecessary repetition, various possible combinations are not further described in this embodiment of the present invention.

Those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, and includes several instructions to make a single-chip microcomputer, a chip or a processor. (processor) executes all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

In addition, any combination of different implementations of the embodiments of the present invention may also be performed, as long as they do not violate the ideas of the embodiments of the present invention, they should also be regarded as the contents disclosed in the embodiments of the present invention.

Claims

A U disk access method, characterized in that the access method comprises:

receiving an access instruction to the U disk;

Determine that the access address of the access instruction is the specific address of the U disk;

Execute the APDU command related to the access command or return the data of the specified area, so as to realize the response to the access command.
The access method according to claim 1, wherein the specific address is obtained through the following steps:

The address of the preset file in the file allocation table is used as the specific address.
The access method according to claim 2, wherein the preset file is pre-stored in a preset directory of a preset partition of the U disk.
The access method according to claim 1, wherein the executing an APDU instruction related to the access instruction or returning the data of the designated area comprises:

If the access command is a "write command", execute the APDU command related to the access command;

If the access command is a "read command", the data of the specified area is returned.
The access method according to claim 4, wherein before returning the data of the designated area, the method further comprises:

It is judged whether there is valid data in the specified area, if there is, the data of the specified area is returned, otherwise "null" or "error" is returned.
The access method according to claim 4, wherein the execution of the APDU instruction related to the access instruction comprises:

extracting data in the data field of the access instruction;

Execute the APDU instruction that has a mapping relationship with the data.
The access method according to claim 6, wherein after executing the APDU instruction that has a mapping relationship with the data, the method further comprises:

Write the execution result of the APDU instruction into the designated area.
A U disk, comprising an interface part, a storage part and a control part, characterized in that the control part is configured as:

determining that the access address of the access instruction obtained from the interface component is a specific address in the storage component;

Execute the APDU command related to the access command or return the data of the specified area, so as to realize the response to the access command.
The U disk according to claim 8, wherein the storage component includes a preset file, the preset file is pre-stored in a preset directory of a preset partition of the storage component, and the preset file is stored in a preset directory of the preset partition of the storage component. Let the address of the file in the file allocation table be the specific address.
The USB flash drive according to claim 8 or 9, wherein the storage component includes a private partition that is invisible to a host operating system, and the private partition can only be accessed by the APDU command.