Separated data hardware access encryption device

Abstract

The invention discloses a separated data hardware access encryption device, and relates to the technical field of computer security hardware and data encryption, and the key points of the technical scheme are as follows: a host control module is used for carrying out encryption operation on write-in data and / or carrying out decryption operation on read data; the control on the data flow is realized through a first hardware data link with a switch; the system storage module is used for storing the encrypted data through a storage hardware medium and controlling the data flow through a second hardware data link with a switch; and the information management module is used for generating key information according to the input configuration information. The encryption and decryption function and the data storage function are physically separated, it is ensured that encryption and decryption operation is conducted in a special hardware module, data storage is conducted on an independent hardware medium, and the risk that data are directly accessed and cracked in the storage process is effectively avoided through the design.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security hardware and data encryption, and more specifically, to a separated data hardware path encryption device. Background Art

[0002] Data encryption is one of the core technologies in the field of information security, used to protect the confidentiality and integrity of data during transmission and storage. Traditional data encryption systems usually rely on software encryption algorithms to encrypt and decrypt data within the computer system. However, software encryption methods often face computing power limitations and potential security vulnerabilities.

[0003] In order to improve the efficiency and security of data encryption, many modern computer systems have begun to use hardware encryption modules (e.g., dedicated encryption chips) to perform data encryption operations. Hardware encryption modules generally have higher processing speed and security because they can prevent malware and attackers from interfering with the encryption process at the physical level. For example, separate hardware encryption technology aims to further enhance data security by separating encryption and decryption operations from data storage media. In this method, data encryption and decryption operations are performed by dedicated hardware modules, while data storage is handled by independent hardware media. This separation design helps prevent data leakage during storage and transmission, and has significant security advantages, especially in the face of physical attacks.

[0004] Although the existing separate hardware encryption technology has made some progress, the following problems still exist: (1) The coupling problem of encryption and storage: In many existing technologies, encryption and storage operations are usually completed through tightly integrated hardware modules, which may lead to threats to the physical security of the encryption module. If an attacker can gain access to the storage medium, it is possible to bypass the encryption protection. (2) Security of the hardware link: Hardware links in existing technologies (such as data buses and interfaces) often lack adequate protection measures. Modern links often use a combination of data paths and control paths, which has a low security factor and may be used by attackers to steal or tamper with data. (3) Insufficient data leakage prevention: In the event that data is lost or the device is stolen, the data protection measures in existing technologies may not be sufficient to prevent the leakage of sensitive data. Summary of the invention

[0005] In order to address the deficiencies in the prior art, the purpose of the present invention is to provide a separate data hardware path encryption device, which physically separates the encryption and decryption functions from the data storage functions, ensuring that the encryption and decryption operations are performed in a dedicated hardware module, while the data storage is performed on an independent hardware medium. This design effectively avoids the risk of data being directly accessed and cracked during the storage process.

[0006] The above technical objectives of the present invention are achieved through the following technical solutions: A separate data hardware path encryption device, comprising:

[0007] A host control module, used for performing encryption operation on written data and / or decryption operation on read data, and realizing control of data flow through a first hardware data link with a switch;

[0008] A system storage module, used to store the encrypted data through a storage hardware medium and to control the data flow through a second hardware data link with a switch;

[0009] An information management module, used to generate key information according to input configuration information;

[0010] Among them, the information management module configures key information to the host control module and the system storage module to realize the opening and closing of the switch;

[0011] Furthermore, the data stream is transmitted between the host control module and the system storage module via the first interface, and the key information is configured and verified between the host control module, the system storage module and the information management module via the second interface.

[0012] Further, when the information management module is plugged into the host control module via the second interface, the information management module configures the private key in the key information into the host control module;

[0013] When the information management module is plugged into the system storage module via the second interface, the information management module configures the public key in the key information into the system storage module.

[0014] Furthermore, after the host control module receives the instruction of the user requesting data, the host control module and the system storage module implement the public key and private key pairing verification through the second interface;

[0015] When the pairing verification succeeds, the switches in the first hardware data link and the second hardware data link are both closed;

[0016] When the pairing verification is unsuccessful, the switches in the first hardware data link and the second hardware data link are both disconnected.

[0017] Furthermore, the host control module automatically generates instructions for user request data after being powered on;

[0018] And, after the first pairing verification is successful, the host control module and the system storage module perform pairing verification regularly.

[0019] Furthermore, the first interface is a SATA interface, and the second interface is a USB interface.

[0020] Furthermore, the host control module is configured with a first MCU and a data encryption and decryption chip;

[0021] The data encryption and decryption chip is installed on the first hardware data link to perform encryption operations on written data and / or decryption operations on read data;

[0022] The first MCU is connected to a switch in the first hardware data link to output instructions to control the opening and closing of the corresponding switch;

[0023] And, the system storage module is configured with a second MCU;

[0024] The second MCU is connected to the switch in the second hardware data link to output instructions to control the opening and closing of the corresponding switch.

[0025] Furthermore, the switch is a network divider.

[0026] Furthermore, the storage hardware medium is a solid state drive or a hard disk drive.

[0027] Furthermore, the host control module, system storage module and information management module are all configured with a memory for storing module information.

[0028] Furthermore, the host control module and the system storage module are both configured with download and burn pads for program updates.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. The present invention provides a separate data hardware channel encryption device, which improves the security and anti-leakage capability of data by physically separating the data encryption and decryption module from the data storage medium. In this separate hardware encryption technology, data encryption and decryption operations are completed by a dedicated hardware module, while data storage is processed by an independent hardware medium. This separation design helps prevent data leakage during storage and transmission, and effectively avoids the risk of data being directly accessed and cracked during storage;

[0031] 2. The present invention realizes the control of data flow through a hardware data link with a switch. The switch function can not only effectively isolate the direct connection between the encryption and decryption module and the storage medium, but also automatically cut off the data link when the device operates abnormally or a problem occurs during data transmission, thereby further ensuring data security;

[0032] 3. The present invention significantly improves data security by physically separating the data encryption and decryption module from the storage medium. Even if the storage device is stolen or lost, the difficulty of cracking the data is greatly increased because the encryption and decryption function is not directly connected to the storage medium, thereby reducing the risk of data leakage.

[0033] 4. In terms of storage of encrypted target data, the present invention adopts a storage solution optimized for encrypted data, which not only improves storage efficiency, but also ensures the integrity and efficient management of encrypted data, avoiding bottleneck problems in the data processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0035] Figure 1 is a structural principle diagram of an information management module in an embodiment of the present invention;

[0036] Figure 2 is a structural schematic diagram of a host control module in an embodiment of the present invention;

[0037] Figure 3 1 is a structural principle diagram of a system storage module in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary implementation modes of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0039] It should be noted that when a component is referred to as being "fixed to" or "disposed on" another component, it can be directly on the other component or indirectly on the other component. When a component is referred to as being "connected to" another component, it can be directly or indirectly connected to the other component.

[0040] It should be understood that the orientation or position relationship indicated by terms such as "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside" and "outside" are based on the orientation or position relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0041] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0042] Embodiment: A separate data hardware channel encryption device includes a host control module, a system storage module and an information management module. The host control module is used to encrypt the written data and / or decrypt the read data, and control the data flow through a first hardware data link with a switch; the system storage module is used to store the encrypted data through a storage hardware medium, and control the data flow through a second hardware data link with a switch; the information management module is used to generate key information according to the input configuration information.

[0043] Among them, the information management module configures key information to the host control module and the system storage module to realize the opening and closing of the switch; and the data stream transmission is realized between the host control module and the system storage module through the first interface, and the configuration and verification of the key information are realized between the host control module, the system storage module and the information management module through the second interface.

[0044] 1. Information Management Module

[0045] Generally, the information management module is a device configured by the administrator. After connecting the information management module to the administrator's computer, the administrator enters the configuration data through a dedicated interface, including the user host number, external storage system number, etc. After the configuration is completed, the information management module will store the information securely in its memory and perform authentication when the system starts.

[0046] System initialization and configuration: Install system software on the administrator's computer and configure the relational database. Clear old user configuration data in flash (memory) and read the device ID of each module.

[0047] Module number registration: The user's host control module number, external storage system module number, external interface module number, and external administrator module number are registered and saved in the database.

[0048] Module configuration: 1. User host control module: configure its number in flash. 2. External system storage module: (1) Set the disk password. (2) Configure key information (including user, expiration date, confidentiality level, matching external interface module ID, and user host control module number). 3. External interface module: configure its number in flash. 4. External administrator module: (1) Configure its number and host information in flash. (2) Configure system storage module and interface module information in flash.

[0049] Authentication and startup: 1. The external storage module and the interface module are authenticated for access. 2. After the user enters the disk password, the system pops up a window to display key information, and the user confirms whether to continue the startup.

[0050] like Figure 1 As shown, the information management module is configured with a key unit and a third MCU. The key unit can generate key information according to the configured information. The key information includes a paired public key and a private key.

[0051] When the information management module and the host control module are plugged in through the second interface, the third MCU configures the private key in the key information into the host control module; when the information management module and the system storage module are plugged in through the second interface, the third MCU configures the public key in the key information into the system storage module.

[0052] In this embodiment, the second interface is a USB interface.

[0053] 2. Host Control Module

[0054] like Figure 2 As shown, the host control module is configured with a first MCU and a data encryption and decryption chip; the data encryption and decryption chip is installed on the first hardware data link to encrypt the written data and / or decrypt the read data; the first MCU is connected to the switch in the first hardware data link to output instructions to control the opening and closing of the corresponding switch.

[0055] When a user requests data, the host control module receives the request and verifies the user's identity. The original data is encrypted by the data encryption and decryption chip to generate an encrypted data stream. The encrypted data is transmitted to the storage module through a hardware data link with a switch.

[0056] 3. System Storage Module

[0057] The system storage module is configured with a second MCU; the second MCU is connected to the switch in the second hardware data link to output instructions to control the opening and closing of the corresponding switch.

[0058] In this embodiment, the storage hardware medium is a solid state drive or a hard disk drive, and may also be other suitable storage devices.

[0059] In addition, the host control module and the system storage module are both equipped with download and burn pads for program updates.

[0060] After the administrator completes the configuration, the system starts. The user requests to access the data and enters the disk password. The host control module verifies the user's identity and decrypts the data to ensure that only legitimate users can access it. All operation logs are recorded in the module's Flash for subsequent auditing.

[0061] Specifically, when the host control module is powered on, the host control module will automatically generate an instruction for the user to request data, and the first MCU and the second MCU will implement public key and private key pairing verification through the second interface (SATA interface); when the pairing verification is successful, it means that the identity authentication is passed, the first MCU will control the switch in the first hardware data link to close, and the second MCU will control the switch in the second hardware data link to close; when the pairing verification is unsuccessful, the switches in the first hardware data link and the second hardware data link are both disconnected.

[0062] The host control module transmits data with the system storage module through a hardware data link with a switch, ensuring that data is transmitted only when verification is passed. The interaction between the system storage module and the information management module is mainly used for log recording and configuration information update.

[0063] Write data stream: Data is input by the application end through the interface. The input data is encrypted by the HX0168 national encryption chip to ensure data security. When the switch of the host control module (ASW3410 network splitter) is in the on state, the encrypted data is transmitted through the bus. When the switch of the storage module (ASW3410 network splitter) is in the on state, the data is transmitted through the SATA data line and stored in the solid-state drive.

[0064] Read data stream: read data from the storage module. After the switch (ASW3410 network splitter) of the storage module is turned on, the data is transmitted to the bus through the SATA data line. When the switch (ASW3410 network splitter) of the host control module is turned on, the data is decrypted by the HX0168 national encryption chip and restored to the original data. The decrypted data is transmitted to the application end for subsequent processing or display.

[0065] The present invention uses the SM4 algorithm to protect the confidentiality and integrity of data.

[0066] Working principle: The present invention improves data security and anti-leakage capabilities by physically separating the data encryption and decryption module from the data storage medium. In this separated hardware encryption technology, data encryption and decryption operations are completed by a dedicated hardware module, while data storage is handled by an independent hardware medium. This separation design helps prevent data leakage during storage and transmission, and effectively avoids the risk of data being directly accessed and cracked during storage;

[0067] In addition, the present invention realizes the control of data flow through a hardware data link with a switch. The switch function can not only effectively isolate the direct connection between the encryption and decryption module and the storage medium, but also automatically cut off the data link when the device operates abnormally or a problem occurs during data transmission, thereby further ensuring data security;

[0068] The present invention significantly improves data security by physically separating the data encryption and decryption module from the storage medium. Even if the storage device is stolen or lost, the encryption and decryption function is not directly connected to the storage medium, making it much more difficult to crack the data, thereby reducing the risk of data leakage.

[0069] In terms of storing encrypted target data, the present invention adopts a storage solution optimized for encrypted data, which not only improves storage efficiency, but also ensures the integrity and efficient management of encrypted data, and avoids bottleneck problems in the data processing process.

[0070] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0071] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0072] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0073] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0074] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A separate data hardware path encryption device, characterized in that: include: A host control module, used for performing encryption operation on written data and / or decryption operation on read data, and realizing control of data flow through a first hardware data link with a switch; A system storage module, used to store the encrypted data through a storage hardware medium and to control the data flow through a second hardware data link with a switch; An information management module, used to generate key information according to input configuration information; Among them, the information management module configures key information to the host control module and the system storage module to realize the opening and closing of the switch; Furthermore, the data stream is transmitted between the host control module and the system storage module via the first interface, and the key information is configured and verified between the host control module, the system storage module and the information management module via the second interface.

2. A separate data hardware path encryption device according to claim 1, characterized in that: When the information management module is plugged into the host control module via the second interface, the information management module configures the private key in the key information into the host control module; When the information management module is plugged into the system storage module via the second interface, the information management module configures the public key in the key information into the system storage module.

3. A separate data hardware path encryption device according to claim 1, characterized in that: After the host control module receives the instruction of the user requesting data, the host control module and the system storage module implement the public key and private key pairing verification through the second interface; When the pairing verification succeeds, the switches in the first hardware data link and the second hardware data link are both closed; When the pairing verification is unsuccessful, the switches in the first hardware data link and the second hardware data link are both disconnected.

4. A separate data hardware path encryption device according to claim 3, characterized in that: The host control module automatically generates instructions for user request data after being powered on; And, after the first pairing verification is successful, the host control module and the system storage module perform pairing verification regularly.

5. A separate data hardware path encryption device according to claim 1, characterized in that: The first interface is a SATA interface, and the second interface is a USB interface.

6. A separate data hardware path encryption device according to claim 1, characterized in that: The host control module is configured with a first MCU and a data encryption and decryption chip; The data encryption and decryption chip is installed on the first hardware data link to perform encryption operations on written data and / or decryption operations on read data; The first MCU is connected to a switch in the first hardware data link to output instructions to control the opening and closing of the corresponding switch; And, the system storage module is configured with a second MCU; The second MCU is connected to the switch in the second hardware data link to output instructions to control the opening and closing of the corresponding switch.

7. A separate data hardware path encryption device according to claim 1, characterized in that: The switch is a network divider.

8. The separate data hardware path encryption device according to claim 1 is characterized in that: The storage hardware medium is a solid state drive or a hard disk drive.

9. A separate data hardware path encryption device according to claim 1, characterized in that: The host control module, system storage module and information management module are all configured with a memory for storing module information.

10. A separate data hardware path encryption device according to claim 1, characterized in that: The host control module and the system storage module are both configured with download and burn pads for program updating.

Images