A data reading and writing method, system, device and medium of a secure storage device

Abstract

The present invention proposes a data reading and writing method, system, device and medium for a secure storage device, which belongs to the field of data security technology. The method includes: allocating a root key to the secure storage device and setting it as a read-only device; sending a CBW command for reading data to the secure storage device through the host computer management software, and generating a data reading key; after the secure storage device receives the CBW command for reading data, it uses the data reading key to encrypt the returned data and sends it to the host computer management software; generates a CBW command for writing data through the host computer management software, and generates a data writing key; configures a check bit for the CBW command for writing data using the data writing key, and encrypts the written data; after the secure storage device receives the CBW command for writing data, it performs a command duplicate check and performs command verification according to the data writing key and the check bit, and after the verification is successful, decrypts the encrypted written data and performs a write operation.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically to a data reading and writing method, system, device and medium of a secure storage device. Background Art

[0002] With the popularization of the Internet and the acceleration of the digitalization process, the amount of data generated by enterprises and individuals has exploded. These data contain a large amount of sensitive information, which will have serious consequences once leaked. Therefore, the demand for data security is becoming increasingly urgent. Traditional storage devices, such as ordinary hard disks, USB flash drives, etc., have many hidden dangers in data security. They often lack effective encryption mechanisms and access control methods, and are easily accessed and tampered by unauthorized users. In addition, these devices are also relatively fragile in terms of physical security and are easily damaged or lost.

[0003] As the demand for data security continues to increase, devices dedicated to secure storage have emerged on the market. These devices usually integrate multiple security technologies, such as data encryption, identity authentication, access control, etc., to provide a higher level of data protection. A secure storage device is a hardware device dedicated to storing encrypted data. Its core purpose is to protect the confidentiality, integrity, and availability of data. Such devices usually integrate multiple security technologies to ensure that the stored data is protected from unauthorized access, tampering, or destruction.

[0004] At present, after most secure storage devices are authenticated, that is, in a secure environment, all storage media users in the system can operate the storage media, read or modify the storage media, etc. If a malicious attacker appears in the secure environment, the storage device content can be stolen or rewritten. That is, after the secure storage device is authenticated, the attacker can snoop on the transmitted data by capturing packets and analyzing protocol packets, or simulate the standard SCSI protocol used by legitimate users to read and write storage devices, read the data of the secure storage device, or tamper with the data of the secure storage device.

[0005] Specifically, after the universal secure storage device allows standard SCSI command operations, all applications in the operating system can operate the device through standard SCSI commands. At this time, if there is a malicious attacker, the data can be read and the storage device data can be maliciously destroyed. Summary of the invention

[0006] In response to the above problems, the purpose of the present invention is to provide a data reading and writing method, system, device and medium for a secure storage device, which controls the data transmission process of the secure storage device by means of registration authentication, encrypted transmission and hash verification, effectively prevents the possibility of malicious attackers stealing secrets at various links, and protects the data stored in the secure storage device from being maliciously tampered with.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0008] In a first aspect, the present invention discloses a method for reading and writing data of a secure storage device, comprising:

[0009] Register the secure storage device through the upper computer management software. After successful registration, assign a root key to the secure storage device and set the secure storage device as a read-only device.

[0010] When reading data from a secure storage device, a CBW command for reading data is sent to the secure storage device through the host computer management software, and a data reading key is generated;

[0011] After receiving the CBW command to read data, the secure storage device uses the data reading key to encrypt the returned data and sends it to the upper computer management software;

[0012] When writing data to the secure storage device, the host computer management software generates a CBW command for writing data and generates a data writing key;

[0013] Using the data write key to configure the check bit for the CBW command for writing data, encrypting the write data, and sending the CBW command for writing data and the encrypted write data to the secure storage device in sequence;

[0014] After receiving the CBW command to write data, the secure storage device performs a command duplicate check and verifies the command based on the data write key and the check bit. After the verification is successful, the encrypted write data is decrypted and the write operation is performed.

[0015] Further, the sending of a CBW command for reading data to the secure storage device through the host computer management software and generating a data reading key includes:

[0016] Generate a CBW command containing a READ command through the host computer management software as a CBW command for reading data and send it to the secure storage device;

[0017] The dCBWTag field of the CBW command for reading data is encrypted using a root key through a symmetric encryption algorithm, and the encrypted dCBWTag field is used as a data reading key.

[0018] Further, after receiving the CBW command for reading data, the secure storage device encrypts the returned data using the data reading key and sends it to the upper computer management software, including:

[0019] After receiving the CBW command for reading data, the secure storage device extracts the corresponding returned data;

[0020] The dCBWTag field of the CBW command for reading data is encrypted using the root key through a symmetric encryption algorithm to calculate the data reading key;

[0021] Encrypt the returned data using the data reading key through a symmetric encryption algorithm;

[0022] The encrypted return data and the read success CSW are sent to the upper computer management software in turn.

[0023] Further, the generating of the CBW command for writing data by the host computer management software and generating the data writing key includes:

[0024] Generate a CBW command containing a custom command 0Xfa through the host computer management software as the CBW command for writing data;

[0025] The dCBWTag field of the CBW command for writing data is encrypted using a root key through a symmetric encryption algorithm, and the encrypted dCBWTag field is used as the data writing key.

[0026] Further, the method of configuring a check bit for a CBW command for writing data using a data writing key, encrypting the written data, and sequentially sending the CBW command for writing data and the encrypted written data to a secure storage device includes:

[0027] Calculate a hash value of the data write key; in a CBW command for writing data, replace the last 4 bytes of the CBWC field with the first 4 bytes of the hash value to update the CBW command for writing data;

[0028] Encrypt the written data using the data writing key through a symmetric encryption algorithm;

[0029] The CBW command for writing data is first sent to the secure storage device, and then the encrypted write data is sent to the secure storage device.

[0030] Further, after receiving the CBW command for writing data, the secure storage device performs a command duplicate check and performs command verification according to the data writing key and the check bit. After the verification is successful, the encrypted write data is decrypted and a write operation is performed, including:

[0031] After receiving the CBW command for writing data, the secure storage device extracts the dCBWTag field of the CBW command for writing data and identifies whether the dCBWTag field appears repeatedly;

[0032] If yes, then end the operation directly;

[0033] If not, encrypt the dCBWTag field using the root key through a symmetric encryption algorithm to calculate the data write key; calculate the hash value of the data write key, and extract 4 bytes of the hash value as a check code;

[0034] Extract the last 4 bytes of the CBWC field of the CBW command for writing data, and determine whether they are the same as the check code;

[0035] If they are the same, the verification is successful, and the encrypted write data is decrypted using the data write key to generate the original write data, which is written into the preset space of the secure storage device, and a write success CSW is returned to the upper computer management software;

[0036] If they are not the same, the verification fails and the operation ends directly.

[0037] Furthermore, the symmetric encryption algorithm adopts SM4 algorithm or AES algorithm.

[0038] In a second aspect, the present invention further discloses a data reading and writing system of a secure storage device, comprising:

[0039] A registration module is used to register the secure storage device through the upper computer management software. After successful registration, a root key is assigned to the secure storage device and the secure storage device is set as a read-only device.

[0040] A read command sending module is used to send a CBW command for reading data to the secure storage device through the upper computer management software when reading data from the secure storage device, and generate a data reading key;

[0041] The read execution module is used to encrypt the returned data with the data read key and send it to the upper computer management software after the secure storage device receives the CBW command to read the data;

[0042] A write command generation module is used to generate a CBW command for writing data and a data writing key through the upper computer management software when writing data to the secure storage device;

[0043] A write command sending module, used to configure a check bit for a CBW command for writing data using a data write key, encrypt the write data, and sequentially send the CBW command for writing data and the encrypted write data to a secure storage device;

[0044] The write execution module is used to perform command duplication check and command verification based on the data write key and check bit when the secure storage device receives the CBW command to write data. After the verification is successful, the encrypted write data is decrypted and the write operation is performed.

[0045] In a third aspect, the present invention further discloses a data reading and writing device of a secure storage device, comprising:

[0046] A memory, used for storing a data reading and writing program of a secure storage device;

[0047] A processor is used to implement the steps of the data reading and writing method of the secure storage device as described in any one of the above items when executing the data reading and writing program of the secure storage device.

[0048] In a fourth aspect, the present invention further discloses a readable storage medium, on which a data reading and writing program for a secure storage device is stored. When the data reading and writing program for the secure storage device is executed by a processor, the steps of the data reading and writing method for the secure storage device as described in any of the above items are implemented.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] 1. The present invention allocates a unique root key to the secure storage device through the host computer management software, and dynamically generates a dedicated data reading key and data writing key during the data reading and writing process. This mechanism ensures the encryption during data transmission, effectively prevents data from being intercepted or tampered with during transmission, and thus significantly enhances data security.

[0051] 2. The present invention introduces a command duplication check and verification mechanism in the process of writing data. After receiving the write command, the secure storage device will perform a command uniqueness check and verification based on the data write key to ensure that only legal and non-duplicate commands are executed. This process effectively avoids data errors or system crashes caused by duplicate writing or illegal commands, greatly improving the reliability and stability of the system.

[0052] 3. The present invention uniformly registers and manages secure storage devices through the host computer management software, and users can easily implement operations such as device initialization, key distribution, and data reading and writing without complicated configuration and debugging processes. At the same time, the automated processing of encryption and verification mechanisms also reduces the possibility of human errors, improves overall operating efficiency and user experience. In addition, the setting of read-only mode also prevents data loss or damage caused by user misoperation, further ensuring the security and integrity of user data.

[0053] 4. The present invention can effectively prevent the threat of malicious attackers, prevent attackers from reading the real content of the secure storage device, and prevent attackers from tampering with the content of the secure storage device. Even if the attacker obtains the interactive data packet and the encryption algorithm, the real data cannot be restored because the key changes once, thereby ensuring the data security of the storage device.

[0054] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0056] Figure 1 It is a method flow chart of a specific implementation mode of the present invention.

[0057] Figure 2 It is a system structure diagram of a specific implementation mode of the present invention.

[0058] In the figure, 1. Registration module; 2. Read command sending module; 3. Read execution module; 4. Write command generation module; 5. Write command sending module; 6. Write execution module. DETAILED DESCRIPTION

[0059] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0060] See also Figure 1 As shown, this embodiment provides a data reading and writing method of a secure storage device, comprising the following steps:

[0061] S1: Register the secure storage device through the host computer management software. After successful registration, assign a root key to the secure storage device and set the secure storage device as a read-only device.

[0062] In a specific implementation method, the secure storage device is registered through the host computer management software. A root key is generated during the registration, and this key will be stored in the secure storage device and the host computer management software. When the user uses it, after the access host passes the security authentication, the secure storage device will appear as a read-only storage device, and attackers will not be able to perform write operations through the standard SCSI protocol.

[0063] S2: When reading data from the secure storage device, a CBW command for reading data is sent to the secure storage device through the host computer management software, and a data reading key is generated.

[0064] In a specific implementation, when reading data from a secure storage device, a CBW command containing a READ command is first generated by the host computer management software as a CBW command for reading data, and sent to the secure storage device. Then, the dCBWTag field of the CBW command for reading data is encrypted using a root key through a symmetric encryption algorithm, and the encrypted dCBWTag field is used as a data reading key.

[0065] Among them, in this method, all encryption algorithms can adopt symmetric encryption algorithms, such as SM4, AES and other encryption algorithms.

[0066] It should be noted that, in the present invention, the structure of the CBW command used is shown in Table 1 below.

[0067] Table 1: CBW command structure table.

[0068]

[0069] In the CBW command shown in Table 1, the dCBWTag field changes each time the command is sent. Therefore, in this step, the dCBWTag field in this command is encrypted by the root key generated during registration, and the encrypted dCBWTag is used as the key for decrypting the data transmitted this time.

[0070] S3: After receiving the CBW command to read data, the secure storage device uses the data reading key to encrypt the returned data and sends it to the upper computer management software.

[0071] In a specific implementation, after receiving the CBW command for reading data, the secure storage device first extracts the corresponding return data; then, the dCBWTag field of the CBW command for reading data is encrypted using the root key through a symmetric encryption algorithm to calculate the data reading key. At this time, the return data is encrypted using the data reading key through a symmetric encryption algorithm; and the encrypted return data and the read success CSW are sent to the upper computer management software in turn.

[0072] After receiving the encrypted return data, the upper computer management software can complete the data reading by decrypting it according to the data reading key.

[0073] S4: When writing data to the secure storage device, a CBW command for writing data is generated through the host computer management software, and a data writing key is generated.

[0074] In a specific implementation, a CBW command containing a custom command 0Xfa is first generated by the host computer management software as a CBW command for writing data; then the dCBWTag field of the CBW command for writing data is encrypted using a root key through a symmetric encryption algorithm, and the encrypted dCBWTag field is used as the data writing key.

[0075] It should be noted that when writing data to the secure storage device, since the device is a read-only device and will not respond to the standard WRITE command (0x2a), a custom command (0Xfa) is used for writing. When the host management software initiates a write command, the dCBWTag field in the CBW is encrypted using the root key. The encrypted dCBWTag is used as the data write key for the data being transmitted this time, and the key is used to encrypt the data to be written and sent to the secure storage device.

[0076] S5: Use the data write key to configure a check bit for the CBW command for writing data, encrypt the write data, and send the CBW command for writing data and the encrypted write data to the secure storage device in sequence.

[0077] In a specific implementation, the hash value of the data write key is first calculated; then, in the CBW command for writing data, the first 4 bytes of the hash value are used to replace the last 4 bytes of the CBWC field to update the CBW command for writing data. At this time, the write data is encrypted using the data write key through a symmetric encryption algorithm. Finally, the CBW command for writing data is first sent to the secure storage device, and then the encrypted write data is sent to the secure storage device.

[0078] As an example, to prevent an attacker from copying the command to tamper with the data in the storage device after capturing the CBW for writing data, this step calculates the hash value of the encrypted dCBWTag field in the CBW command for writing data, and puts the first 4 bytes of the hash value into the last 4 bytes of the CBWC field for subsequent dCBWTag data authentication and comparison.

[0079] S6: After receiving the CBW command for writing data, the secure storage device performs a command duplicate check and verifies the command according to the data writing key and the check bit. After the verification is successful, the encrypted write data is decrypted and the write operation is performed.

[0080] In this step, after receiving the CBW command containing the private instruction 0xfa, the secure storage device first verifies whether the dCBWTag field of the command is sent repeatedly, and then calculates the data write key for this transmission based on the root key, and compares it with the last 4 bytes of the received CBW. After the comparison is successful, it responds to the corresponding write operation, so that even if the attacker copies the command or changes the dCBWTag in the command, the device will not respond to the operation. Subsequently, after receiving the correctly encrypted data, the secure storage device writes the key according to the data transmitted this time, decrypts the data transmitted this time and completes the write operation.

[0081] In a specific implementation, after receiving a CBW command for writing data, the secure storage device first extracts the dCBWTag field of the CBW command for writing data, and identifies whether the dCBWTag field appears repeatedly.

[0082] If the dCBWTag field appears repeatedly, the operation ends directly.

[0083] If the dCBWTag field appears for the first time, the dCBWTag field is encrypted using a root key through a symmetric encryption algorithm to calculate a data write key; then a hash value of the data write key is calculated, and 4 bytes of the hash value are extracted as a check code.

[0084] At this time, the last 4 bytes of the CBWC field of the CBW command for writing data are extracted, and it is determined whether they are the same as the check code.

[0085] If they are the same, the verification is successful, and the encrypted write data is decrypted using the data write key to generate the original write data, which is written into the preset space of the secure storage device, and a write success CSW is returned to the upper computer management software.

[0086] If they are not the same, the verification fails and the operation ends directly.

[0087] The present invention provides a data reading and writing method for a secure storage device, which controls the data transmission process of the secure storage device by means of registration authentication, encrypted transmission and hash verification, effectively prevents the possibility of malicious attackers stealing secrets at various links, and protects the data stored in the secure storage device from being maliciously tampered with.

[0088] See also Figure 2 As shown, the present invention also discloses a data reading and writing system for a secure storage device, comprising: a registration module 1, a read command sending module 2, a read execution module 3, a write command generation module 4, a write command sending module 5 and a write execution module 6.

[0089] The registration module 1 is used to register the secure storage device through the upper computer management software. After successful registration, a root key is allocated to the secure storage device and the secure storage device is set as a read-only device.

[0090] The read command sending module 2 is used to send a CBW command for reading data to the secure storage device through the upper computer management software when reading data from the secure storage device, and generate a data reading key.

[0091] The read execution module 3 is used to encrypt the returned data with the data read key and send it to the upper computer management software after the secure storage device receives the CBW command for reading data.

[0092] The write command generation module 4 is used to generate a CBW command for writing data and a data writing key through the upper computer management software when writing data to the secure storage device.

[0093] The write command sending module 5 is used to configure a check bit for the CBW command for writing data using the data write key, encrypt the write data, and send the CBW command for writing data and the encrypted write data to the secure storage device in sequence.

[0094] The write execution module 6 is used to perform command duplication check and command verification based on the data write key and check bit when the secure storage device receives the CBW command for writing data. After the verification is successful, the encrypted write data is decrypted and the write operation is performed.

[0095] The specific implementation of the data reading and writing system of the secure storage device of this embodiment is basically the same as the specific implementation of the data reading and writing method of the secure storage device described above, and will not be described in detail here.

[0096] The present invention also discloses a data reading and writing device for a secure storage device, comprising a processor and a memory; wherein the processor implements the steps of the data reading and writing method for the secure storage device as described in any one of the above items when executing the data reading and writing program for the secure storage device in the memory.

[0097] Furthermore, the data reading and writing device of the secure storage device in this embodiment may also include:

[0098] The input interface is used to obtain the data reading and writing program of the secure storage device imported from the outside, and save the obtained data reading and writing program of the secure storage device to the memory, and can also be used to obtain various instructions and parameters transmitted by the external terminal device, and transmit them to the processor, so that the processor can use the above various instructions and parameters to carry out corresponding processing. In this embodiment, the input interface can specifically include but is not limited to a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk reading interface, etc.

[0099] The output interface is used to output various data generated by the processor to the terminal device connected thereto, so that other terminal devices connected to the output interface can obtain various data generated by the processor. In this embodiment, the output interface may specifically include but is not limited to a USB interface, a serial interface, etc.

[0100] The communication unit is used to establish a remote communication connection between the data reading and writing device of the secure storage device and the external server so that the data reading and writing device of the secure storage device can mount the image file to the external server. In this embodiment, the communication unit may specifically include but is not limited to a remote communication unit based on wireless communication technology or wired communication technology.

[0101] The keyboard is used to obtain various parameter data or instructions input by the user by tapping the keycaps in real time.

[0102] The display is used to display relevant information of the data reading and writing process of the running secure storage device in real time.

[0103] The mouse can be used to assist users in inputting data and simplify user operations.

[0104] The present invention also discloses a readable storage medium, wherein the readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable hard disk, a CD-ROM or any other form of storage medium known in the technical field. The readable storage medium stores a data reading and writing program of a secure storage device, and when the data reading and writing program of the secure storage device is executed by a processor, the steps of the data reading and writing method of the secure storage device described in any one of the above items are implemented.

[0105] In summary, the present invention controls the data transmission process of the secure storage device through registration authentication, encrypted transmission and hash verification, effectively preventing the possibility of malicious attackers stealing secrets at various links, and protecting the data stored in the secure storage device from being maliciously tampered with.

[0106] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. As for the method disclosed in the embodiment, since it corresponds to the system disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0107] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0108] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0109] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0110] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.

[0111] Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

[0112] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0113] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0114] The data reading and writing method, system, device and readable storage medium of the secure storage device provided by the present invention are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for reading and writing data of a secure storage device, characterized in that: include: Register the secure storage device through the upper computer management software. After successful registration, assign a root key to the secure storage device and set the secure storage device as a read-only device. When reading data from a secure storage device, a CBW command for reading data is sent to the secure storage device through the host computer management software, and a data reading key is generated; After receiving the CBW command to read data, the secure storage device uses the data reading key to encrypt the returned data and sends it to the upper computer management software; When writing data to the secure storage device, the host computer management software generates a CBW command for writing data and generates a data writing key; Using the data write key to configure the check bit for the CBW command for writing data, encrypting the write data, and sending the CBW command for writing data and the encrypted write data to the secure storage device in sequence; After receiving the CBW command to write data, the secure storage device performs a command duplicate check and verifies the command based on the data write key and the check bit. After the verification is successful, the encrypted write data is decrypted and the write operation is performed.

2. The data reading and writing method of the secure storage device according to claim 1, characterized in that: The sending of a CBW command to read data to the secure storage device through the host computer management software and generating a data reading key includes: Generate a CBW command containing a READ command through the host computer management software as a CBW command for reading data and send it to the secure storage device; The dCBWTag field of the CBW command for reading data is encrypted using a root key through a symmetric encryption algorithm, and the encrypted dCBWTag field is used as a data reading key.

3. The data reading and writing method of the secure storage device according to claim 2, characterized in that: After receiving the CBW command for reading data, the secure storage device encrypts the returned data using the data reading key and sends it to the upper computer management software, including: After receiving the CBW command for reading data, the secure storage device extracts the corresponding returned data; The dCBWTag field of the CBW command for reading data is encrypted using the root key through a symmetric encryption algorithm to calculate the data reading key; Encrypt the returned data using the data reading key through a symmetric encryption algorithm; The encrypted return data and the read success CSW are sent to the upper computer management software in turn.

4. The data reading and writing method of the secure storage device according to claim 3, characterized in that: The step of generating a CBW command for writing data through the host computer management software and generating a data writing key includes: Generate a CBW command containing a custom command 0Xfa through the host computer management software as the CBW command for writing data; The dCBWTag field of the CBW command for writing data is encrypted using a root key through a symmetric encryption algorithm, and the encrypted dCBWTag field is used as the data writing key.

5. The data reading and writing method of the secure storage device according to claim 4, characterized in that: The method of configuring a check bit for a CBW command for writing data using a data writing key, encrypting the written data, and sequentially sending the CBW command for writing data and the encrypted written data to a secure storage device includes: Calculate a hash value of the data write key; in a CBW command for writing data, replace the last 4 bytes of the CBWC field with the first 4 bytes of the hash value to update the CBW command for writing data; Encrypt the written data using the data writing key through a symmetric encryption algorithm; The CBW command for writing data is first sent to the secure storage device, and then the encrypted write data is sent to the secure storage device.

6. The data reading and writing method of the secure storage device according to claim 5, characterized in that: After receiving the CBW command for writing data, the secure storage device performs a command duplicate check and performs command verification according to the data writing key and the check bit. After the verification is successful, the encrypted write data is decrypted and a write operation is performed, including: After receiving the CBW command for writing data, the secure storage device extracts the dCBWTag field of the CBW command for writing data and identifies whether the dCBWTag field appears repeatedly; If yes, then end the operation directly; If not, encrypt the dCBWTag field using the root key through a symmetric encryption algorithm to calculate the data write key; calculate the hash value of the data write key, and extract 4 bytes of the hash value as a check code; Extract the last 4 bytes of the CBWC field of the CBW command for writing data, and determine whether they are the same as the check code; If they are the same, the verification is successful, and the encrypted write data is decrypted using the data write key to generate the original write data, which is written into the preset space of the secure storage device, and a write success CSW is returned to the upper computer management software; If they are not the same, the verification fails and the operation ends directly.

7. The data reading and writing method of the secure storage device according to claim 2, characterized in that: The symmetric encryption algorithm adopts SM4 algorithm or AES algorithm.

8. A data reading and writing system for a secure storage device, characterized in that: include: A registration module is used to register the secure storage device through the upper computer management software. After successful registration, a root key is assigned to the secure storage device and the secure storage device is set as a read-only device. A read command sending module is used to send a CBW command for reading data to the secure storage device through the upper computer management software when reading data from the secure storage device, and generate a data reading key; The read execution module is used to encrypt the returned data with the data read key and send it to the upper computer management software after the secure storage device receives the CBW command to read the data; A write command generation module is used to generate a CBW command for writing data and a data writing key through the upper computer management software when writing data to the secure storage device; A write command sending module, used to configure a check bit for a CBW command for writing data using a data write key, encrypt the write data, and sequentially send the CBW command for writing data and the encrypted write data to a secure storage device; The write execution module is used to perform command duplication check and command verification based on the data write key and check bit when the secure storage device receives the CBW command to write data. After the verification is successful, the encrypted write data is decrypted and the write operation is performed.

9. A data reading and writing device for a secure storage device, characterized in that: include: A memory, used for storing a data reading and writing program of a secure storage device; A processor, configured to implement the steps of the data reading and writing method for a secure storage device as claimed in any one of claims 1 to 7 when executing the data reading and writing program of the secure storage device.

10. A readable storage medium, characterized in that: The readable storage medium stores a data reading and writing program for a secure storage device, and when the data reading and writing program for the secure storage device is executed by a processor, the steps of the data reading and writing method for a secure storage device according to any one of claims 1 to 7 are implemented.

Images