A mobile hard disk security method and device based on satellite authorization

Abstract

The present invention discloses a method and device for keeping a mobile hard disk confidential based on satellite authorization, the method comprising: sending positioning information to a server end to authorize the use of a geographical location; after receiving the current geographical location of the mobile hard disk located by a terminal, the server end compares it with the set geographical range that the mobile hard disk can use, and if the current geographical location of the mobile hard disk is within its usable geographical range, then sending an authorization use message to a short message module of the terminal, and the short message module sends an authorization firmware loading short message to a main control chip; the main control chip reads a module in a firmware area in a storage chip and sends it to a mobile hard disk, and the mobile hard disk loads the module; the main control chip sends a soft reset instruction to the mobile hard disk to perform a soft reset of the storage chip, and at this time the mobile hard disk can be normally connected to a computer, and the data in the mobile hard disk can be accessed through the computer. The present invention can ensure the security of data stored in a mobile hard disk.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to a mobile hard disk security method and device based on satellite authorization. Background Art

[0002] There are still many loopholes in the management and control of mobile hard disk data, which may lead to data leakage. Even if the hard disk is encrypted as required by relevant regulations, as long as the hard disk is in normal operation, once the data is mirrored, various means can still be used to try to crack it, thereby leaking the data in the hard disk. Summary of the invention

[0003] In view of this, the present invention provides a mobile hard disk security method and device based on satellite authorization.

[0004] The present invention discloses a mobile hard disk security method based on satellite authorization, which comprises:

[0005] Step 1: After the mobile hard disk is successfully paired with the terminal, the positioning module starts positioning and sends the positioning information to the server for authorization to use the geographic location;

[0006] Step 2: After receiving the current geographical location of the mobile hard disk located by the terminal, the server compares it with the set geographical range in which the mobile hard disk can be used. If the current geographical location of the mobile hard disk is within the geographical range in which it can be used, the server sends an authorization message to the short message module of the terminal, and the short message module sends the authorization message for loading firmware to the main control chip;

[0007] Step 3: The main control chip reads the 03 module, 31 module, and 33 module in the firmware area of ​​the storage chip and sends them to the mobile hard disk, and the mobile hard disk loads the 03 module, 31 module, and 33 module; 03 module is the segment table module of the hard disk, and 31 module is the compiler module. Module 31 can be rebuilt through module 33;

[0008] Step 4: The main control chip sends a soft reset command to the mobile hard disk to perform a soft reset of the storage chip. Only then can the mobile hard disk be normally connected to the computer and the data in the mobile hard disk be accessed through the computer.

[0009] Furthermore, before step 1, the method further includes:

[0010] After the terminal and the mobile hard disk are connected to the computer, the terminal's main control chip obtains the mobile hard disk identification stored in the computer through the USB protocol, reads the key information of the mobile hard disk 02 module and compares it with the key information of the 02 module stored in the storage chip to determine whether the mobile hard disk is the mobile hard disk paired with the terminal.

[0011] Furthermore, the step 1 further comprises:

[0012] If the mobile hard disk is not paired with the terminal successfully, the computer is not connected to the mobile hard disk paired with the terminal. It may be an external device connected to the terminal separately for reverse debugging. The short message module is called to alert the server. After the server confirms the situation, it sends a destruction message. After receiving the destruction short message, the terminal immediately erases the storage chip.

[0013] Furthermore, the main control chip has a built-in timing module. When the handshake between the short message module, the positioning module and the main control chip is interrupted, the timing starts. After the timing ends, the storage chip is immediately erased to prevent reverse debugging of external devices that are separately connected to the terminal.

[0014] Furthermore, the step 2 further comprises:

[0015] After receiving the current geographic location of the mobile hard disk located by the terminal, the server compares it with the set geographical range that the mobile hard disk can be used. If the current geographic location of the mobile hard disk is not within its usable geographical range, the server sends a destruction short message to the main control chip to erase the storage chip, or the main control chip erases the storage chip after the timing ends; at the same time, the main control chip has a built-in geographical location threshold of the mobile hard disk. Once the current location of the mobile hard disk reaches the geographical location threshold, the storage chip is immediately erased.

[0016] Furthermore, the step 3 comprises:

[0017] The main control chip reads the 03 module, 31 module, and 33 module in the firmware area of ​​the storage chip and sends them to the USB bridge chip of the mobile hard disk through the USB protocol. The ATA protocol specification is used to send the 03 module, 31 module, and 33 module to the mobile hard disk through the bridge chip, and the mobile hard disk loads the 03 module, 31 module, and 33 module.

[0018] Furthermore, the step 4 comprises:

[0019] The main control chip sends a soft reset command to the USB bridge chip of the mobile hard disk, and then uses the ATA protocol specification to send it to the mobile hard disk through the bridge chip to perform a soft reset of the firmware area. Only then can the mobile hard disk be normally connected to the computer's operating system and the data in the mobile hard disk can be accessed through the computer's operating system.

[0020] Furthermore, the method further includes: the mobile hard disk needs to unlock the firmware area and read and modify the modules in the firmware area;

[0021] The mobile hard disk needs to unlock the firmware area and read and modify the modules in the firmware area, including:

[0022] Read the modules in the firmware area in the storage chip, modify the module group firmware lock to disabled state and then write it back to the storage chip. After writing back, the firmware area is unlocked and all firmware modules in the mobile hard disk can be accessed;

[0023] Read the 02 module, 03 module, 31 module, 33 module, E0 module, and E1 module in the mobile hard disk firmware area to the satellite-authorized terminal for storage;

[0024] According to the address recorded in module 01, erase module 03, module 31, module 33, module E0 and module E1 to ensure the uniqueness of the modules stored in the terminal; module 01 is the directory module of the entire firmware, recording the address and size of all firmware storage;

[0025] Read the modules in the firmware area of ​​the storage chip again, and modify the startup process to prevent the 02 module from being written back after loading. After that, the mobile hard disk cannot work and the data in the hard disk cannot be read at all. At this point, the firmware area unlocking and firmware modification of the mobile hard disk are completed.

[0026] Furthermore, the mobile hard disk divides all sectors into several segments for management. Once lost or damaged, the mobile hard disk cannot obtain the relevant information of each segment; the relevant information includes order, size and status; module 03 is a unique module for each hard disk, which can only be used with the native module of the hard disk and cannot be replaced; module 31 is a compiler module, which mainly manages the PBA sector address of the entire hard disk, as well as bad sectors and replacement sectors. Once lost or damaged, the hard disk will not be able to obtain the relevant information of the PBA sector. Module 31 can be rebuilt through module 33, and module 33 can be rebuilt through module E0 and module E1. Module 33, module E0 and module E1 need to be read together.

[0027] The present invention also discloses a mobile hard disk security device based on satellite authorization, which realizes any of the mobile hard disk security methods based on satellite authorization described above, and includes a server, a satellite, a terminal, a computer and a mobile hard disk; the terminal includes a positioning module, a short message module, a main control chip and a storage chip; the server is connected to the positioning module and the short message module respectively through a satellite; the positioning module and the short message module are both connected to the main control chip; the main control chip is connected to the mobile hard disk through a computer; and the main control chip is connected to the storage chip.

[0028] Due to the adoption of the above technical solution, the present invention has the following advantages: the present invention can effectively ensure the confidentiality of the data stored in the mobile hard disk, and even if the mobile hard disk is obtained by illegal means, the data in the hard disk cannot be easily obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0030] Figure 1 A schematic diagram of a flow chart of a mobile hard disk security method based on satellite authorization according to an embodiment of the present invention;

[0031] Figure 2 A schematic diagram of the process of firmware unlocking and module modification according to an embodiment of the present invention;

[0032] Figure 3 A schematic diagram of a mobile hard disk security device based on satellite authorization according to an embodiment of the present invention; DETAILED DESCRIPTION

[0033] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0034] See also Figure 1 The present invention provides an embodiment of a mobile hard disk security method based on satellite authorization, which includes:

[0035] S1: After the mobile hard disk is successfully paired with the terminal, the positioning module starts positioning and sends the positioning information to the server for authorization to use the geographic location;

[0036] S2: After receiving the current geographical location of the mobile hard disk located by the terminal, the server compares it with the set geographical range in which the mobile hard disk can be used. If the current geographical location of the mobile hard disk is within the geographical range in which it can be used, the server sends an authorization message to the short message module of the terminal. The short message module sends the authorization message to load the firmware to the main control chip.

[0037] S3: The main control chip reads modules 03, 31 and 33 in the firmware area of ​​the storage chip and sends them to the mobile hard disk. The mobile hard disk loads modules 03, 31 and 33. Module 03 is the segment table module of the hard disk, and module 31 is the compiler module. Module 31 can be rebuilt through module 33.

[0038] S4: The main control chip sends a soft reset command to the mobile hard disk to perform a soft reset of the storage chip. Only then can the mobile hard disk be normally connected to the computer and the data in the mobile hard disk be accessed through the computer.

[0039] In an optional embodiment, before S1, the following steps are further included:

[0040] After the terminal and the mobile hard disk are connected to the computer, the terminal's main control chip obtains the mobile hard disk identification stored in the computer through the USB protocol, reads the key information of the mobile hard disk 02 module and compares it with the key information of the 02 module stored in the storage chip to determine whether the mobile hard disk is the mobile hard disk paired with the terminal.

[0041] In an optional embodiment, the S1 further includes:

[0042] If the mobile hard disk is not paired with the terminal successfully, the computer is not connected to the mobile hard disk paired with the terminal. It may be an external device connected to the terminal separately for reverse debugging. The short message module is called to alert the server. After the server confirms the situation, it sends a destruction message. After receiving the destruction short message, the terminal immediately erases the storage chip.

[0043] In an optional embodiment, the main control chip has a built-in timing module, and timing starts when the handshake between the short message module, the positioning module and the main control chip is interrupted. After the timing ends, the storage chip is immediately erased to prevent reverse debugging of external devices that are separately connected to the terminal.

[0044] In an optional embodiment, the S2 further includes:

[0045] After receiving the current geographical location of the mobile hard disk located by the terminal, the server compares it with the geographical range set for the mobile hard disk to be used. If the current geographical location of the mobile hard disk is not within its usable geographical range, the server sends a short message of destruction to the main control chip, which can erase the storage chip 25 times, or erase the storage chip 25 times after the main control chip timing ends; at the same time, the main control chip has a built-in geographical location threshold of the mobile hard disk. Once the current location of the mobile hard disk reaches the geographical location threshold, the storage chip is immediately erased 25 times. For example, if the terminal and the mobile hard disk are illegally taken away from the designated area, the terminal will directly erase the storage chip 25 times without waiting for the main control chip timing after locating the geographical location.

[0046] In an optional embodiment, the S3 includes:

[0047] The main control chip reads the 03 module, 31 module, and 33 module in the firmware area of ​​the storage chip and sends them to the USB bridge chip of the mobile hard disk through the USB protocol. The ATA protocol specification is used to send the 03 module, 31 module, and 33 module to the mobile hard disk through the bridge chip, and the mobile hard disk loads the 03 module, 31 module, and 33 module.

[0048] In an optional embodiment, the S4 includes:

[0049] The main control chip sends a soft reset command to the USB bridge chip of the mobile hard disk, and then uses the ATA protocol specification to send it to the mobile hard disk through the bridge chip to perform a soft reset of the firmware area. Only then can the mobile hard disk be normally connected to the computer's operating system and the data in the mobile hard disk can be accessed through the computer's operating system.

[0050] In an optional embodiment, it further includes: the mobile hard disk needs to unlock the firmware area and read and modify the modules in the firmware area;

[0051] See also Figure 2 , the mobile hard disk needs to unlock the firmware area and read and modify the modules in the firmware area, including:

[0052] S01: Read the modules in the firmware area in the storage chip, modify the module group firmware lock to the disabled state and then write it back to the storage chip. After the write-back is completed, the firmware area is unlocked, and all firmware modules in the mobile hard disk can be accessed; the storage chip can be a ROM (Read-Only Memory) on the circuit board;

[0053] S02: Reading module 02, module 03, module 31, module 33, module E0 and module E1 in the mobile hard disk firmware area to the satellite-authorized terminal for storage;

[0054] S03: According to the address recorded in module 01, erase module 03, module 31, module 33, module E0 and module E1 to ensure the uniqueness of the modules stored in the satellite authorization terminal; module 01 is the directory module of the entire firmware area, recording the address and size of all firmware storage;

[0055] S04: Read the modules in the firmware area of ​​the storage chip again, and modify the startup process to prevent the 02 module from being written back after loading. After that, the mobile hard disk cannot work, and the data in the hard disk cannot be read at all. At this point, the firmware area unlocking and firmware modification of the mobile hard disk are completed; due to the lack of the key firmware 02 module, the mobile hard disk cannot be repaired through firmware debugging.

[0056] In an optional embodiment, the mobile hard disk divides all sectors into several segments for management. Once lost or damaged, the mobile hard disk cannot obtain relevant information of each segment; the relevant information includes order, size and status; module 03 is a unique module for each hard disk, which can only be used as a native module of the hard disk and cannot be replaced; module 31 is a compiler module, which mainly manages the PBA sector address of the entire hard disk, as well as bad sectors and replacement sectors. Once lost or damaged, the hard disk will not be able to obtain relevant information of the PBA sector. Module 31 can be rebuilt through module 33, and module 33 can be rebuilt through module E0 and module E1. Module 33, module E0 and module E1 need to be read together.

[0057] See also Figure 3The present invention also provides an embodiment of a mobile hard disk security device based on satellite authorization, which implements the mobile hard disk security method based on satellite authorization described in the above embodiment, and includes a server, a satellite, a terminal, a computer and a mobile hard disk; the terminal includes a positioning module, a short message module, a main control chip and a storage chip; the server is connected to the positioning module and the short message module respectively through a satellite; the positioning module and the short message module are both connected to the main control chip; the main control chip is connected to the mobile hard disk through a computer; the main control chip is connected to the storage chip.

[0058] This embodiment mainly verifies the use scope and use time of the mobile hard disk through Beidou positioning and timing services. The short message module authorizes the main control chip to call the 03 module, 31 module, and 33 module stored in the storage chip and transmit them to the RAM (Random Access Memory) of the mobile hard disk through the USB protocol for loading. Only then can the mobile hard disk be normally connected to the computer and access data. Once the server finds that the mobile hard disk has left the authorized geographical scope, it can send a destruction code through the short message module. After the main control chip receives the destruction code, it immediately repeatedly erases and writes the storage chip 25 times. Due to the uniqueness and importance of the 03 module and the 31 module, after these two modules are cleared, the mobile hard disk will be completely unusable and the data in the mobile hard disk cannot be read, effectively ensuring the confidentiality of the use of the mobile hard disk.

[0059] The satellite in this embodiment can select BDS (BeiDou Navigation Satellite System), which can provide real-time positioning services for all walks of life around the clock, and can send 80-byte short messages worldwide. The terminal and the mobile hard disk are connected to the computer through the USB (Universal Serial Bus) port at the same time, and authorized for use through the Beidou satellite. Since the terminal is an independent single-chip microcomputer with certain computing power and needs to be connected to the computer through the USB port, more and more complex verification mechanisms can be added according to demand, such as verification mechanisms such as hardware checksum of the access computer, MAC (Media Access Control Address-Media Access Control Address) address information.

[0060] The present invention stores and loads the most critical 03 module and 31 module of the mobile hard disk separately. Due to the process principle of hard disk manufacturing, once the firmware module is lost or damaged, even the hard disk manufacturer cannot restore the original segment and sector arrangement order. Taking a 1TB hard disk as an example, the total number of its LBA (Logic Block Address) logical sectors is about 1900000000. After the uniqueness module is missing, at least 1.8 billion PBA (physical block addresses) sectors need to be correctly combined first, and then 1.8 billion LBA logical sector linear addresses are correctly combined according to the PBA sector address. Its difficulty is no less than that of cracking a high-intensity asymmetric encryption algorithm. Therefore, the present invention can effectively guarantee the confidentiality of the data stored in the mobile hard disk, and even if the mobile hard disk is illegally obtained, the data in the hard disk cannot be easily obtained.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A mobile hard disk security method based on satellite authorization, characterized in that: include: Step 1: After the mobile hard disk is successfully paired with the terminal, the positioning module starts positioning and sends the positioning information to the server for authorization to use the geographic location; Step 2: After receiving the current geographical location of the mobile hard disk located by the terminal, the server compares it with the set geographical range in which the mobile hard disk can be used. If the current geographical location of the mobile hard disk is within the geographical range in which it can be used, the server sends an authorization message to the short message module of the terminal, and the short message module sends the authorization message for loading firmware to the main control chip; Step 3: The main control chip reads the 03 module, 31 module, and 33 module in the firmware area of ​​the storage chip and sends them to the mobile hard disk, and the mobile hard disk loads the 03 module, 31 module, and 33 module; 03 module is the segment table module of the hard disk, and 31 module is the compiler module. Module 31 can be rebuilt through module 33; Step 4: The main control chip sends a soft reset command to the mobile hard disk to perform a soft reset of the storage chip. Only then can the mobile hard disk be connected to the computer normally and the data in the mobile hard disk can be accessed through the computer; It also includes: the mobile hard disk needs to unlock the firmware area and read and modify the modules in the firmware area; The mobile hard disk needs to unlock the firmware area and read and modify the modules in the firmware area, including: Read the modules in the firmware area in the storage chip, modify the module group firmware lock to disabled state and then write it back to the storage chip. After writing back, the firmware area is unlocked and all firmware modules in the mobile hard disk can be accessed; Read the 02 module, 03 module, 31 module, 33 module, E0 module, and E1 module in the mobile hard disk firmware area to the satellite-authorized terminal for storage; According to the address recorded in module 01, erase module 03, module 31, module 33, module E0 and module E1 to ensure the uniqueness of the modules stored in the terminal; module 01 is the directory module of the entire firmware area, recording the address and size of all firmware storage; Read the modules in the firmware area of ​​the storage chip again, and modify the startup process to prevent the 02 module from being written back after loading. After that, the mobile hard disk cannot work, and the data in the hard disk cannot be read at all. At this point, the firmware area of ​​the mobile hard disk is unlocked and the firmware modification is completed; The mobile hard disk divides all sectors into several segments for management. Once lost or damaged, the mobile hard disk cannot obtain the relevant information of each segment; the relevant information includes order, size and status; module 03 is a unique module for each hard disk, which can only be replaced with the native module of the hard disk; module 31 is a compiler module, which mainly manages the PBA sector address of the entire hard disk, as well as bad sectors and replacement sectors. Once lost or damaged, the hard disk will not be able to obtain the relevant information of the PBA sector. Module 31 can be rebuilt through module 33, and module 33 can be rebuilt through module E0 and module E1. Module 33, module E0 and module E1 need to be read together.

2. The mobile hard disk security method based on satellite authorization according to claim 1 is characterized in that: Before step 1, the method further includes: After the terminal and the mobile hard disk are connected to the computer, the terminal's main control chip obtains the mobile hard disk identification stored in the computer through the USB protocol, reads the key information of the mobile hard disk 02 module and compares it with the key information of the 02 module stored in the storage chip to determine whether the mobile hard disk is the mobile hard disk paired with the terminal.

3. The mobile hard disk security method based on satellite authorization according to claim 1 is characterized in that: The step 1 also includes: If the mobile hard disk is not paired with the terminal successfully, the computer is not connected to the mobile hard disk paired with the terminal. It may be an external device connected to the terminal separately for reverse debugging. The short message module is called to alert the server. After the server confirms the situation, it sends a destruction message. After receiving the destruction short message, the terminal immediately erases the storage chip.

4. The mobile hard disk security method based on satellite authorization according to claim 3 is characterized in that: The main control chip has a built-in timing module. When the handshake between the short message module, positioning module and the main control chip is interrupted, the timing starts. After the timing ends, the storage chip is immediately erased to prevent reverse debugging by external devices that are separately connected to the terminal.

5. The mobile hard disk security method based on satellite authorization according to claim 1 is characterized in that: The step 2 also includes: After receiving the current geographic location of the mobile hard disk located by the terminal, the server compares it with the set geographical range that the mobile hard disk can be used. If the current geographic location of the mobile hard disk is not within its usable geographical range, the server sends a destruction short message to the main control chip to erase the storage chip, or the main control chip erases the storage chip after the timing ends; at the same time, the main control chip has a built-in geographical location threshold of the mobile hard disk. Once the current location of the mobile hard disk reaches the geographical location threshold, the storage chip is immediately erased.

6. The mobile hard disk security method based on satellite authorization according to claim 1 is characterized in that: The step 3 comprises: The main control chip reads the 03 module, 31 module, and 33 module in the firmware area of ​​the storage chip and sends them to the USB bridge chip of the mobile hard disk through the USB protocol. The ATA protocol specification is used to send the 03 module, 31 module, and 33 module to the mobile hard disk through the bridge chip, and the mobile hard disk loads the 03 module, 31 module, and 33 module.

7. The mobile hard disk security method based on satellite authorization according to claim 1 is characterized in that: The step 4 comprises: The main control chip sends a soft reset command to the USB bridge chip of the mobile hard disk, and then uses the ATA protocol specification to send it to the mobile hard disk through the bridge chip to perform a soft reset of the firmware area. Only then can the mobile hard disk be normally connected to the computer's operating system and the data in the mobile hard disk can be accessed through the computer's operating system.

8. A mobile hard disk security device based on satellite authorization, which implements the mobile hard disk security method based on satellite authorization as described in any one of claims 1 to 7, characterized in that: It includes a server, a satellite, a terminal, a computer and a mobile hard disk; the terminal includes a positioning module, a short message module, a main control chip and a storage chip; the server is connected to the positioning module and the short message module respectively through a satellite; the positioning module and the short message module are both connected to the main control chip; the main control chip is connected to the mobile hard disk through a computer; and the main control chip is connected to the storage chip.

Images