Storage device

Abstract

The utility model provides a storage device, comprising: a data input port for receiving input data; the memory comprises a secure storage module and a non-secure storage module, the secure storage module is used for storing encrypted data in the input data, and the non-secure storage module is connected with the data input port and is used for storing other data in the input data; the processing assembly comprises a processor, and the processor is connected with the data input port and the secure storage module and used for detecting input data input from the data input port, encrypting sensitive data to obtain encrypted data when the input data is sensitive data of an application passing permission authentication, and sending the encrypted data to the secure storage module; and the encrypted data is transmitted to the secure storage module. Thus, by storing the sensitive data in the secure storage module, the sensitive data are isolated and protected, and unauthorized access and data leakage are prevented.

Description

Technical Field

[0001] The present application belongs to the technical field of data storage, and more specifically, to a storage device. Background Art

[0002] In traditional storage devices, data is usually stored in the same storage space, and multiple business systems may share the same batch of data. Although centralized systems are convenient for data management, their single point of failure and wide attack surface can easily lead to data leakage risks. Once data is leaked or unauthorized access occurs, it may cause huge losses.

[0003] Therefore, existing storage devices have the problem of proneness to data leakage. Utility Model Content

[0004] The purpose of the embodiments of the present application is to provide a storage device to solve the technical problem that data leakage is prone to occur in the prior art.

[0005] To achieve the above purpose, the technical solution adopted in this application is:

[0006] A storage device is provided, comprising:

[0007] A data input port, used for receiving input data;

[0008] The memory includes a secure storage module and a non-secure storage module, wherein the secure storage module is used to store encrypted data in the input data, and the non-secure storage module is connected to the data input port and is used to store other data in the input data.

[0009] The processing component includes a processor, which is respectively connected to the data input port and the security storage module, and is used to detect input data input from the data input port, and when the input data is sensitive data of an application that has passed authority authentication, encrypt the sensitive data to obtain encrypted data, and transmit the encrypted data to the security storage module.

[0010] Optionally, the secure storage module includes a secure storage area and a backup area.

[0011] The secure storage area is used to store the encrypted data;

[0012] The backup area is used to back up the encrypted data in the secure storage area in real time.

[0013] Optionally, the processing component further comprises a monitor,

[0014] The monitor is used to monitor whether there is data anomaly in the secure storage area.

[0015] Optionally, the monitor is connected to the processor and is further configured to send an alarm signal to the processor when detecting data anomalies in the secure storage area.

[0016] The processor is further configured to, upon receiving the alarm signal, restore the encrypted data in the secure storage area that has an abnormality based on the encrypted data in the backup area.

[0017] Optionally, the storage device further includes a USB female socket for connecting to an external device;

[0018] The USB female socket comprises:

[0019] main body of mother seat;

[0020] USB contact pin, connected to the female socket body, used for data transmission with external devices;

[0021] A limit assembly, used to limit the insertion of external devices;

[0022] The processor is also connected to the limit component and is used to send a limit signal to the limit component when receiving the alarm signal to prevent the external device from being inserted.

[0023] Optionally, the limiting component includes:

[0024] Ejector pin with serrations on the sides;

[0025] The transmission mechanism comprises a first transmission shaft and a second transmission shaft, wherein the first transmission shaft and the second transmission shaft are connected via a conveyor belt, and a gear is provided on the first transmission shaft, which meshes with the saw teeth on the side of the ejector pin through the gear;

[0026] A motor, used for driving the second transmission shaft to rotate;

[0027] When a restriction signal is received, the motor drives the transmission mechanism to move, and drives the ejector pin to rise through the gear to restrict the insertion of an external USB male connector.

[0028] Optionally, the processor includes:

[0029] The encryption chip encrypts the sensitive data to obtain encrypted data, and stores the encrypted data in the secure storage module.

[0030] Optionally, the processor further includes:

[0031] A clock chip is used to set an access time for the encrypted data.

[0032] Optionally, the storage address of the secure storage module is an original address of the memory plus a preset offset.

[0033] Optionally, the processor is further configured to read encrypted data from the secure storage module, decrypt the encrypted data, and send the decrypted sensitive data to an application that has passed authority authentication.

[0034] The beneficial effects provided by this application are:

[0035] The storage device uses a processor to encrypt sensitive data to obtain encrypted data, and stores the encrypted data of the sensitive data and the non-sensitive data in a secure storage module and a non-secure storage module respectively, thereby achieving secure storage and effective management of data, effectively preventing unauthorized access and data leakage, and improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0037] Figure 1 One of the structural schematic diagrams of the storage device provided in the embodiment of the present application;

[0038] Figure 2 A schematic diagram of the structure of a secure storage module provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of the structure of the processing component provided in the embodiment of the present application;

[0040] Figure 4 One of the structural schematic diagrams of the USB socket provided in the embodiment of the present application;

[0041] Figure 5 The second structural diagram of the USB socket provided in the embodiment of the present application;

[0042] Figure 6 A second structural diagram of a storage device provided in an embodiment of the present application;

[0043] Figure 7 A third structural diagram of a storage device provided in an embodiment of the present application;

[0044] Figure 8 A schematic diagram of the software call flow of a storage device provided in an embodiment of the present application.

[0045] The meanings of the marks in the figure are:

[0046] 1. Data input port;

[0047] 2. Memory; 21. Secure storage module; 211. Secure storage area; 212. Backup area; 22. Non-secure storage module;

[0048] 3. Processing component; 31. Processor; 32. Monitor;

[0049] 4. USB female socket; 41. Female socket body; 42. USB contact pin; 43. Limiting assembly; 431. Ejector pin; 432. Transmission mechanism; 4321. First transmission shaft; 4322. Second transmission shaft; 4323. Conveyor belt; 433. Motor; 44. ID line; 45. Control line; 46. Other data signal lines;

[0050] 100. Storage device. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] It should be noted that the terms "upper", "lower", "left", "right", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on this patent. The terms "first" and "second" are only used for the convenience of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features. "Multiple" means two or more, unless otherwise clearly and specifically defined. In addition, terms such as "horizontal", "vertical", and "overhanging" do not mean that the components are required to be absolutely horizontal or overhanging, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0053] It should also be noted that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0054] In traditional data processing methods, data is usually stored in the same device space, and multiple business systems may share the same batch of data. This centralized data processing method has certain risks. Once the data is leaked or unauthorized access occurs, it may cause huge losses. In addition, the storage and transmission of data are also threatened by network attacks and malware, and effective measures need to be taken to ensure data security.

[0055] Currently, the technologies and methods provided mostly adopt a centralized and global management mode, and achieve the purpose of data security isolation by establishing and maintaining data permission mapping relationships. Method 1: Permission control is performed through the technology of private encrypted channels, in the form of interfaces, which simplifies device access, simplifies application development, and reduces system complexity. The effective isolation of gateway upstream and downstream data is achieved, and the purpose of isolation is achieved through identity authentication, but it still belongs to the thinking of centralized management, and the user space on shared storage cannot solve the problem of malicious access security. Method 2: By dividing the database for different user groups, one user group corresponds to a data sub-library and configures a data source for each data sub-library, setting a data source manager to allocate the corresponding data source to the user and connect to the corresponding data sub-library, and the data source manager maintains the user group and all its users and the data source association mapping to achieve the purpose of data security. The method does not solve the problem of centralized access. The data source manager performs global management and cannot avoid the impact of malicious attacks on data security.

[0056] In order to illustrate the technical solution described in this application, a detailed description is given below in conjunction with specific drawings and embodiments.

[0057] See also Figure 1 , an embodiment of the present application provides a storage device 100, including:

[0058] Data input port 1, used to receive input data;

[0059] The memory 2 includes a secure storage module 21 and a non-secure storage module 22. The secure storage module is used to store encrypted data in the input data, and the non-secure storage module is connected to the data input port and is used to store other data in the input data.

[0060] The processing component 3 includes a processor 31, which is respectively connected to the data input port and the secure storage module, and is used to detect input data input from the data input port, and when the input data is sensitive data of an application that has passed authority authentication, encrypt the sensitive data to obtain encrypted data, and transmit the encrypted data to the secure storage module.

[0061] Specifically, through the data input port 1, the storage device 100 can receive data from different sources, such as different application transmissions, network transmissions, USB devices or other input devices. The memory is divided into two main parts: a secure storage module 21 and a non-secure storage module 22. The secure storage module 21 is specifically used to store encrypted data. Encrypted data is sensitive data that is encrypted to protect its content from unauthorized access. The secure storage module 21 can adopt two layers of security measures, physical and software, to ensure the security of the data; the non-secure storage module 22 is used to store data that does not need to be encrypted. This part of the data is usually non-sensitive information, or data that has been protected in other ways.

[0062] In an embodiment of the present application, the storage device uses a processor to encrypt sensitive data to obtain encrypted data, and stores the encrypted data of the sensitive data and the non-sensitive data in a secure storage module and a non-secure storage module respectively, thereby achieving secure storage and effective management of data, effectively preventing unauthorized access and data leakage, and improving data security.

[0063] Even if the encrypted data of the target data is leaked, the real sensitive data cannot be obtained. The combination of identity authentication, permission verification and data encryption triple protection measures greatly enhances the security of stored data. In addition, by storing data in a dedicated security partition, sensitive data can be further isolated and protected to prevent unauthorized access and data leakage.

[0064] In one example, the storage device 100 may perform the following operations:

[0065] The data input port 1 receives the target data (sensitive data) input by the first application; the processor 31 receives the storage request sent by the first application, the storage request is used to request to cache the target data (i.e., sensitive data) to the secure storage module 21, and the storage request includes the authentication information of the first application and the permission information of the target data; the processor 31 responds to the storage request and authenticates the first application according to the authentication information of the first application; when the first application passes the identity authentication, the target data is encrypted according to the permission information to obtain encrypted data; and the encrypted data is cached to the secure storage module 21. Therefore, when the first application sends a storage request, the first application can be authenticated, and when the identity authentication passes, the target data received by the data input port 1 is set with the permission information for the target data access rights, and the target data is encrypted and cached to the secure storage module 21. Therefore, the triple protection measures of identity authentication, permission verification, and data encryption are combined to improve the security of the stored data.

[0066] Optionally, the secure storage module 21 includes a secure storage area 211 and a backup area 212.

[0067] The secure storage area 211 is used to store encrypted data;

[0068] The backup area 212 is used to back up the encrypted data in the secure storage area in real time.

[0069] Specifically, Figure 2 The secure storage module 21 is divided into two main parts: a secure storage area 211 and a backup area 212. The secure storage area 211 is the main location for data storage, and is used to store encrypted sensitive information or key data. The main function of the backup area 212 is to back up the data in the secure storage area 211 in real time. Data changes in the secure storage area 211 will be synchronized to the backup area 212 in real time, thereby ensuring the integrity and recoverability of key data in the event of data corruption, system failure or other unexpected situations.

[0070] Optionally, the processing component 3 further includes a monitor 32,

[0071] The monitor 32 is used to monitor whether there is data anomaly in the secure storage area.

[0072] Specifically, Figure 3 The processing component 3 shown also includes a monitor 32, so that the data in the secure storage area 211 can be security-verified based on the encrypted data in the backup area 212 through the monitor 32. The verification content may include comparing the integrity of the data, checking whether the data has been tampered with, verifying the consistency of the data, etc. The verification process may use a hash algorithm, a checksum, or other data verification technology to ensure that the original state of the data has not been illegally modified, and this application does not limit it.

[0073] Optionally, the monitor 32 is connected to the processor 31 and is also used to send an alarm signal to the processor when detecting data anomalies in the secure storage area.

[0074] The processor 32 is further configured to restore the abnormal encrypted data in the secure storage area 211 based on the encrypted data in the backup area 212 when receiving an alarm signal.

[0075] Specifically, the monitor 32 sends an alarm signal to the processor 32 when the verification result indicates that the data in the secure storage area 211 is abnormal. After receiving the alarm signal, the processor 32 automatically extracts the most recent backup data from the backup area 212. Based on the data in the backup area 212, the processor 32 performs a restore operation to restore the data in the secure storage area 211 to the most recent safe state. After the data is restored, the monitor 32 continues to monitor the state of the data and can also record all related operations and events.

[0076] In this embodiment, the secure storage module 21 is divided into a secure storage area 211 and a backup area 212, which provides secure storage of data and enhances the disaster resistance and recovery capabilities of data through a backup mechanism. It can not only protect data from accidental damage, but also respond quickly and effectively when facing data tampering or other security threats, thereby minimizing the risk of data loss and business interruption.

[0077] Optionally, the storage device further includes a USB female socket 4 for connecting to an external device;

[0078] like Figure 4 The USB female socket 4 shown includes:

[0079] Mother base body 41;

[0080] A USB contact pin 42, connected to the female socket body, for data transmission with an external device;

[0081] A limit assembly 43, used to limit the insertion of external devices;

[0082] The processor 31 is also connected to the limit component 43 and is used to send a limit signal to the limit component 43 when receiving an alarm signal to prevent the external device from being inserted.

[0083] Specifically, the female socket body 41 is the basic structural part of the USB female socket, providing the physical shape and structure of the socket, and is used to support and fix the entire USB female socket. The USB contact pin 42 is used for electrical connection, and contacts with the corresponding pins of the inserted external device to achieve data transmission and power supply. The limit assembly 43 is used to control and limit the insertion of external devices, thereby protecting the storage device from physical damage or data security threats in the event of data anomalies.

[0084] Alternatively, if Figure 4 and Figure 5 As shown, the limiting assembly 43 includes: a pin 431, a transmission mechanism 432 and a motor 433.

[0085] Ejector pin 431, with serrations on the side;

[0086] The transmission mechanism 432 includes a first transmission shaft 4321, a second transmission shaft 4322 and a conveyor belt 4323. The first transmission shaft 4321 and the second transmission shaft 4322 are connected through the conveyor belt 4323. The first transmission shaft 4321 is provided with a gear, which meshes with the saw teeth on the side of the ejector pin 431 through the gear.

[0087] The motor 433 is used to drive the second transmission shaft 4322 to rotate;

[0088] When receiving the limiting signal, the motor 433 drives the transmission mechanism 432 to move, and drives the ejector pin 431 to rise through the gear, so as to limit the insertion of the external USB male connector.

[0089] Specifically, the ejector pin 431 is designed to be in the shape of an ejector pin with serrations. The serrated side of the ejector pin 431 can mesh with the gear in the transmission mechanism 432, so that the ejector pin 431 can move up or down under the action of the driving force. The two transmission shafts of the transmission mechanism 432 are connected by a conveyor belt 4323 to ensure that the two move synchronously. A gear is provided on the first transmission shaft 4321, and this gear meshes with the serrations of the ejector pin 431, thereby converting the rotational motion of the motor 433 into a linear motion of the ejector pin 431. The motor 433 is the power source of the transmission mechanism 432, and is used to drive the second transmission shaft 4322 to rotate. The start and stop of the motor 433 are controlled by a limit signal sent by the processor 31.

[0090] When the detector 32 of the storage device detects that there is data anomaly in the secure storage area 211, it will send an alarm signal to the processor 31. After receiving the alarm signal, the processor 31 will start the safety mode and send a limit signal to the motor 433. After receiving the limit signal, the motor 433 starts to work and drives the second transmission shaft 4322 and the first transmission shaft 4321 driven by the conveyor belt 4323 to rotate. The gear on the first transmission shaft 4321 rotates and engages with the saw teeth on the side of the ejector pin 431, pushing the ejector pin 431 to move upward.

[0091] After the ejector pin 431 rises into position, it can physically prevent the external USB male connector from being further inserted, thereby ensuring the safety of the USB interface.

[0092] Thus, the storage device will automatically start the safe mode when detecting data anomalies. In the safe mode, the USB socket of the storage device is disabled. The USB socket 4 can be: a physical port (such as a USB port) and a network interface, etc., to prevent any external device from connecting or remotely accessing, thereby preventing data leakage or further data damage.

[0093] Optionally, based on the data in the backup area 212, the processor 32 will perform a restore operation to restore the data in the secure storage area 211 to the most recent secure state. The safe mode can then be released, the USB socket 4 of the storage device can be re-enabled, and the system can resume normal operation, that is, the pin 431 is controlled to descend by the motor 433, which will not be repeated here.

[0094] In this embodiment, when the storage device detects data anomalies, it can not only respond quickly and recover data, but also protect the storage device from further potential threats by disabling the USB socket 4 and starting the safe mode.

[0095] In one example, if Figure 4 and Figure 5 As shown, the design of the USB socket 4 of the storage device adds a pin 431 design to the original USB socket design. When the system is in safe mode and needs to isolate data, the pin 431 on the USB will be pulled and popped out. At this time, the storage device will not be able to insert any other storage device, achieving the effect of data isolation. The specific structure includes:

[0096] ID line 44: reuses the original ID line on the USB socket as a signal line to control the ejector pin 431, and can also be understood as a switch line of the ejector pin device;

[0097] Motor 433: a motor for ensuring that the ejector pin can be ejected, and the ejector pin is ejected and rebounded by the motor;

[0098] Ejector pin 431: The ejector pin can block the USB port when it pops out, so that any transfer device cannot be inserted into the USB port of the host;

[0099] The second transmission shaft 4322: a transmission bearing of the motor and a mechanical device for ejecting the ejector pin;

[0100] Conveyor belt 4323: conveyor belt of motor;

[0101] Control line 45: control line of the ejector device, which is connected to the ID line of the USB socket, and the host CPU of the ID line is connected;

[0102] Other data signal lines 46: including data lines and power lines;

[0103] USB contact pin 42: the contact point between the USB socket and the host, through which the USB socket and the CPU are connected.

[0104] Optionally, the processor 31 includes:

[0105] The encryption chip encrypts the sensitive data to obtain encrypted data, and stores the encrypted data in a secure storage module.

[0106] An encryption chip is provided in the processor 31. After the application identity authentication that needs to store sensitive data in the secure storage module 21 is passed, the encryption chip is used to encrypt the sensitive data. The encryption chip is a hardware device specially designed to perform efficient and secure data encryption operations, which can ensure the security of the encryption process and the strength of the encryption algorithm.

[0107] Here, the sensitive data is encrypted to obtain encrypted data, and the target data may be encrypted using an encryption method associated with permission information (access rights to the sensitive data set by the application sending the sensitive data) to obtain encrypted data.

[0108] Optionally, the processor 31 further includes:

[0109] Clock chip, used to set the access time for encrypted data.

[0110] The above permission information includes the access time of the data. The access time of the encrypted target data (i.e. sensitive data) is set by the clock chip. The clock chip can ensure the accuracy and consistency of the time, so that the access control of the data can depend on the specific time conditions. For example, some encrypted data may only be accessible within a specific time period, and the data cannot be decrypted or accessed beyond this time period.

[0111] In this embodiment, the method of combining the encryption chip and the clock chip increases multiple levels of data security, which not only protects the security of data content, but also increases the restrictiveness of access through time control.

[0112] Optionally, the storage address of the secure storage module 21 is the original address of the memory 2 plus a preset offset.

[0113] Specifically, the storage address of the secure storage module 21 is determined by adding a preset offset to the original address of the storage space of the storage device. This method increases the security of the data through physical isolation, so that the storage area of ​​the secure storage module 21 is fixed in the storage device and is not easily accessible to the outside. In order to limit different applications from accessing the secure storage module 21, a dedicated interface is set. The use of the dedicated interface is subject to strict access control, and only applications that have passed identity authentication are allowed to call it. Therefore, any unauthorized attempt to access the secure area will be blocked, thereby protecting the data from the risk of unauthorized access.

[0114] In this embodiment, by storing the data in the secure storage module 21 after the preset offset, and limiting the access interface to be open only to the authentication application, the security of the data and the legitimacy of the access are ensured. , and limiting the access interface to be open only to the authentication application, the security of the data and the legitimacy of the access are ensured.

[0115] Optionally, the processor 31 is further configured to read encrypted data from the secure storage module 211 , decrypt the encrypted data, and send the decrypted sensitive data to an application that has passed authority authentication.

[0116] Specifically, when the second application needs to read the target data (equivalent to the above-mentioned sensitive data), the processor 31 can send a read request, and the processor 31 authenticates the second application based on the second authentication information in the read request. If the second application is authenticated and the permissions of the second application match the target data access permissions, the encrypted data of the target data is read from the secure storage module 211, the encrypted data is decrypted and restored to the target data, and then the target data is sent to the second application.

[0117] In this embodiment, by receiving and verifying the read request of the second application, it is ensured that only applications that have undergone strict identity authentication and have matching permissions can access the encrypted data stored in the secondary secure storage module 211, and then the target data is sent to the second application after decryption. In this way, the secure reading and transmission of data is effectively achieved, ensuring the high security and integrity of data during storage and access.

[0118] In a specific embodiment, Figure 6 The above storage device can implement a data processing method comprising the following steps:

[0119] (1) Modify the EMMC and NAND bottom-level drivers to move the real 0 address to open up a security and data encryption area (i.e., the secure storage area 211 mentioned above), which cannot be accessed without a dedicated interface and permissions.

[0120] (2) Add a security and data encryption-backup partition (i.e., the backup area 212 mentioned above), perform necessary data backup each time data is stored, verify the security and data encryption area when reading, and restore from the security write data encryption-backup partition if the verification is abnormal.

[0121] The security partition (i.e., the security storage module 21 mentioned above) will calculate a CRC value each time the computer is turned on and used, and then save it in a fixed location. The CRC value of the entire current security partition will be recalculated on subsequent startups to obtain a specific value, which will be matched and verified with the CRC value saved in the fixed location. If they are different, it is recognized that the security partition is damaged (i.e., the data in the security zone is verified to obtain a verification result to determine whether there is any data anomaly in the security zone).

[0122] Flashing, upgrading, restoring factory settings, etc. cannot access the data in the security and data encryption area, so the data in the security and data encryption area will not be erased or destroyed.

[0123] (3) Use hardware + customized underlying driver + customized software interface to achieve data security and data isolation during business operation.

[0124] Specific as Figure 6As shown, the partitions include a security and data encryption isolation partition (security storage area 211), a security and data encryption isolation backup partition (backup area 212), a kernel partition, a system partition, an application partition introduction, and a user partition, among which "security and data encryption isolation partition, security and data encryption isolation backup partition" are invisible partitions and cannot be accessed by interfaces not provided by the system.

[0125] Security and data encryption isolation partition: This is used to store different types of data to ensure that data is isolated from each other in different partitions, thereby preventing data confusion and cross-contamination and improving data security. For example, user private data and system configuration can be stored in this partition.

[0126] Data encryption isolation backup partition: It is a backup of the security and data encryption isolation partition. It is synchronized at all times. When the data in the data encryption isolation partition changes, it will be synchronized to the backup partition immediately to ensure that the data in the data encryption isolation area and the corresponding backup partition are the same at all times. When the data in the security and data encryption isolation partition is abnormal or the verification fails, it will be restored from this partition.

[0127] Kernel partition: used to store the kernel and related data of the operating system. The kernel is the core part of the computing device, responsible for managing system resources, controlling hardware, and providing system services. Storing the kernel and related data in a separate partition can prevent illegal access and tampering, ensuring the stability and security of the system.

[0128] System partition: It is a partition used to store the operating system and system files. The system partition contains the core components of the operating system, system library files, configuration files, etc. The isolation of the system partition can protect the integrity of the operating system and prevent users or applications from making improper modifications to system files, which may cause system crashes or instability.

[0129] Application partition: A partition used to store applications and their related data. Isolating applications from system partitions and user partitions can prevent applications from affecting the system and increase system stability. Application partitions also help manage and maintain applications, making it easier to update and upgrade applications without affecting other partitions and data.

[0130] User partition: A partition used to store user data and personal settings. In a user partition, users can store personal files, documents, photos and other data, and perform personalized settings. The isolation of user partitions can protect the security of user data and prevent user data from being accessed or modified by other users or applications.

[0131] Encryption chips and clock chips are important hardware technologies for achieving data security and isolation. They can work together to protect data security, achieve data isolation between different businesses, and provide reliable hardware guarantees for data application and sharing.

[0132] In a specific embodiment, Figure 7 The hardware structure of a storage device shown in the figure is that the storage device is provided with an encryption chip and a clock chip in the storage device, and the encryption chip is used to encrypt the data in the security and data encryption isolation partition; the clock chip is used to set the access time for the data in the security and data encryption isolation partition. Thus, the physical isolation of the data in the security and data encryption areas in the storage medium is achieved, and the data security is improved.

[0133] The business functions of the encryption chip in this system invention are as follows: (1) Data encryption protection: The encryption chip can encrypt sensitive data stored in the device or system, so that even if the data is stolen or leaked, it cannot be interpreted. This can protect the user's privacy and data security. (2) Data transmission protection: During the data transmission process, the encryption chip can encrypt the data to prevent the data from being stolen or tampered with during the transmission process. This is very important for protecting network communications and data transmission. (3) Digital signature and authentication: The encryption chip can be used to generate digital signatures to ensure the integrity and authentication of the data. The recipient can use the public key to verify the digital signature to ensure that the data has not been tampered with.

[0134] The business functions of the clock chip in this system invention are as follows: (1) Data time-sharing processing: The clock chip can provide independent clock signals for different business systems or functional modules, allowing them to operate in different time slices. This can achieve data isolation and prevent cross-contamination of data between different modules. (2) Data synchronization: When data is exchanged between devices or systems, the synchronous clock signal provided by the clock chip can ensure data synchronization and consistency. This is very important for achieving data security and preventing data conflicts.

[0135] (4) Limited-time access to data: When a business is running, in addition to applying for the data content that needs to be accessed, it is also necessary to apply for the access time of the data. The system will release different access limit times based on different business priorities to prevent arbitrary access to data.

[0136] Operating system + driver + EMMC, NAND bottom isolation driver: Provide basic access interface, modify EMMC, NAND bottom driver to move the real 0 address, open up security and data encryption area, which cannot be accessed without dedicated interface and applied time slice and permission.

[0137] Specific as Figure 8As shown, the security and data isolation area access interface: modify the standard driver interface so that it cannot access the data in the security and data encryption area during flashing, upgrading, restoring factory settings, etc., so the data in the security and data encryption area will not be erased, destroying the standard and system access interface: normal kernel partition, system partition, application partition introduction, user partition access interface.

[0138] The specific software calling process is as follows: Figure 8 As shown:

[0139] The entire calling process is divided into four layers, among which the storage medium layer is described above.

[0140] The system and driver layer provides customized and standard drivers, including encryption drivers and interfaces, clock drivers and interfaces, storage driver security and data encryption drivers, and storage driver standard storage drivers and interfaces.

[0141] The HAL layer is an intermediate interface layer that provides an intermediate interface between the application layer and the system and driver layer.

[0142] The application layer is divided into two categories: private security applications and common applications. Only applications that have applied for private security application permissions and time permissions can access

[0143] Security and data isolation area access interfaces are programming interfaces that implement data isolation and security. These interfaces provide data access and management functions for different areas, ensuring that data is isolated from each other in different areas and improving data security.

[0144] It should be noted that, in this article, the terms "comprises", "includes" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or apparatus.

[0145] This article uses specific examples to illustrate the principles and implementation methods of this application. The above examples are only used to help understand the method and its core ideas of this application. The above are only preferred implementation methods of this application. It should be pointed out that due to the limitations of textual expression and the objective existence of infinite specific structures, ordinary technicians in this technical field can make several improvements, modifications or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes or combinations, or the direct application of the concept and technical solution of the utility model to other occasions without improvement, should be regarded as the scope of protection of this application.

Claims

1. A storage device, characterized in that: include: A data input port, used for receiving input data; The memory includes a secure storage module and a non-secure storage module, wherein the secure storage module is used to store encrypted data in the input data, and the non-secure storage module is connected to the data input port and is used to store other data in the input data. The processing component includes a processor, which is respectively connected to the data input port and the security storage module, and is used to detect input data input from the data input port, and when the input data is sensitive data of an application that has passed authority authentication, encrypt the sensitive data to obtain encrypted data, and transmit the encrypted data to the security storage module.

2. The storage device according to claim 1, characterized in that The secure storage module includes a secure storage area and a backup area. The secure storage area is used to store the encrypted data; The backup area is used to back up the encrypted data in the secure storage area in real time.

3. The storage device according to claim 2, characterized in that: The processing component also includes a monitor, The monitor is used to monitor whether there is data anomaly in the secure storage area.

4. The storage device according to claim 3, characterized in that: The monitor is connected to the processor and is also used to send an alarm signal to the processor when detecting data anomalies in the secure storage area. The processor is further configured to restore the abnormal encrypted data in the secure storage area based on the encrypted data in the backup area when the alarm signal is received.

5. The storage device according to claim 4, characterized in that: The storage device also includes a USB female socket for connecting to an external device; The USB female socket comprises: main body of mother seat; USB contact pin, connected to the female socket body, used for data transmission with external devices; A limit assembly, used to limit the insertion of external devices; The processor is also connected to the limit component and is used to send a limit signal to the limit component when receiving the alarm signal to prevent the external device from being inserted.

6. The storage device according to claim 5, characterized in that: The limiting component comprises: Ejector pin with serrations on the sides; The transmission mechanism comprises a first transmission shaft and a second transmission shaft, wherein the first transmission shaft and the second transmission shaft are connected via a conveyor belt, and a gear is provided on the first transmission shaft, which meshes with the saw teeth on the side of the ejector pin through the gear; A motor, used for driving the second transmission shaft to rotate; When a restriction signal is received, the motor drives the transmission mechanism to move, and drives the ejector pin to rise through the gear to restrict the insertion of an external USB male connector.

7. The storage device according to claim 1, characterized in that: The processor comprises: The encryption chip encrypts the sensitive data to obtain encrypted data, and stores the encrypted data in the secure storage module.

8. The storage device according to claim 1, characterized in that: The processor further comprises: A clock chip is used to set an access time for the encrypted data.

9. The storage device according to claim 1, characterized in that: The storage address of the secure storage module is the original address of the memory plus a preset offset.

10. The storage device according to claim 1, characterized in that: The processor is also used to read the encrypted data from the secure storage module, decrypt the encrypted data, and send the decrypted sensitive data to the application that has passed the authority authentication.

Images