Method and system for session-based secure access control to a data storage system - Patents.com

Abstract

To provide a computer implementation method for a session-based secured access control on a data storing system.SOLUTION: A method (100) decides, in response to the detection (110) of an activation signal, an empty physical storing sub area of a data storing system utilized between writing sessions in which each of at least one writing setting is for writing data and a selectively allocates (135) this storing sub area to the writing session. Next, the method receives (140) data to be written in the context of the writing session, and protect (155) the data by utilizing an access protection that protects the data storing system from a subsequent access from unauthorized another access session. Subsequently, the method writes access protected data in the selectively allocated storing sub area of the data storing system to the writing session or output the access protected data to execute the writing (160).SELECTED DRAWING: Figure 1A

Description

[Technical field]

[0001] The present invention relates to a method and a data processing system for session-based secure access control to a data storage system, a storage medium having such a data processing system and data storage system, and a recording system configured to interact with the data processing system to use the storage medium for storing recorded data. [Background technology]

[0002] Various types of recording systems are typically used to record the recorded data and to store and keep them until later processing. Such recording systems may in particular be photo or video cameras, audio recording devices such as dictation recorders, data loggers for sensor data, especially relating to the so-called "Internet of Things" ("IoT"), or other monitoring systems, for example for monitoring machines, public places, or buildings or safety-related areas.

[0003] Such recording systems typically include a storage interface for accessing a data storage system, which may be permanently integrated in the recording system or may be easily replaceable in the form of a removable data medium, such as a memory card or a memory stick, among others. Typically, such recording systems are not themselves equipped to provide access protection, such as encryption, to the stored data, since this would require additional computing power and costs for access protection, in particular for key exchange for encryption, or would have to accommodate significantly more complex operations.

[0004] The need for all kinds of data recording is constantly increasing in many areas, such as in the areas of security services, rescue services, protection systems for taxi or bus drivers, or industrial measurement and monitoring technology, e.g. for continuous temperature monitoring of cold chains, energy consumption data for allocated invoices, etc., but such data recording often has to satisfy the associated high requirements for data protection.

[0005] Data protection typically and often necessarily begins at the source of the data, followed by secure archiving to ensure that further processing is exclusively related to the specific event, and secure erasure of unnecessary data.

[0006] Therefore, the implementation of requirements for legally compliant data processing usually requires a data protection concept, since recorded data can often only be used if they are properly recorded. Sufficient precautions must also be taken against the loss of data that may affect the rights of individuals in the records, and such loss is often severely punished.

[0007] It is an object of the present invention to define a method and a system which provide a further technical improvement with regard to data protection, by which protected access to a data storage system, in particular for storing record data, can be achieved. Summary of the Invention [Means for solving the problem]

[0008] The solution to this problem is achieved according to the teaching of the independent claims. Various embodiments and refinements of the invention are subject matter of the dependent claims.

[0009] A first aspect of the solution relates to a method, in particular a computer-implemented method, for session-based secure access control to a data storage system, the method comprising: (i) detecting an activation signal for initiating access to the data storage system, and (ii) at least one write session for writing relevant data to the data storage system, each of the at least one write sessions comprising: (iii) in response to detecting the activation signal, determining a free physical storage sub-area of ​​the data storage system to be used during the write session for writing data and selectively allocating this storage sub-area to this write session, (iv) receiving or generating data to be written in the context of the write session, (v) protecting the data using access protection, in particular individually assigned to the write session, which protects the data from subsequent access to the data storage system from other unauthorized access sessions, and (vi) outputting the access-protected data, in particular directly to the data storage system, for writing the access-protected data to the storage sub-area of ​​the data storage system selectively assigned to the write session or for causing this writing to occur as part of an indirect access to the data storage system, in particular via one or more communication nodes connected in between.

[0010] The term "activation signal" as used herein means a signal, such as a wired or wireless electrical, electromagnetic or optical signal, that is detectable or designed to be detected as an activation signal in the sense of the present method, in particular by an entity executing the method, such as a correspondingly configured data processing system. Such an activation signal may be triggered in particular when switching on, when switching between different operating modes, or when switching off a recording system or a data processing system executing the method itself and then detected as described under (i).

[0011] As used herein, the term "free physical storage sub-area" is specifically a physical area of ​​a storage system, such as one or more particular pages or blocks of storage associated with a particular area of ​​physical storage addresses, or a physical area of ​​a storage system, that is still "free" at the time under consideration. In this context, "free" is specifically intended to mean that a free physical storage sub-area is available for writing data because it has not yet been written to (at least since the storage was last reset) or because it has already been released or is otherwise available for overwriting existing data.

[0012] As used herein, the term "write session related data" means, with respect to a particular write session, data specifically assigned to that write session that is output in that context for writing to a storage sub-area of ​​a data storage system assigned to the write session.

[0013] The terms "comprise," "containing," "include," "has," "having," or any other variations thereof, as appropriate, as used herein are intended to cover a non-exclusive inclusion. For example, a method or device that includes or has a list of elements is not necessarily limited to those elements, but can include other elements not expressly listed in or inherent to such method or device.

[0014] Further, unless expressly stated to the contrary below, "or" refers to an inclusive "or" rather than an exclusive "or." For example, a condition A or B is satisfied by one of the following conditions: A is true (or exists) and B is false (or absent), A is false (or absent) and B is true (or exists), and both A and B are true (or exist).

[0015] As used herein, the terms "a" or "an" have the meaning "one or more." The terms "another" and "further," and any other variations thereof, should be understood to mean "at least one other."

[0016] The term "plurality," as used herein, should be understood to mean "two or more."

[0017] The terms "configured" or "set" to perform a particular function (and their respective modifiers) should be understood in the sense of the present invention that the corresponding device is already ready for configuration or setting and the corresponding device is capable of performing the function or is at least settable, i.e. configurable, so as to perform the function after the corresponding setting has been made. The configuration may be done, for example, via a process sequence or a corresponding setting of parameters, such as switches, to activate or deactivate the function or setting. In particular, the device may have multiple predefined configurations or operating modes, so that the configuration may be accomplished by selecting one of these configurations or operating modes.

[0018] The method according to the first aspect therefore enables secure data storage in a data storage system, with access security having the effect in particular that data written in the context of a previous write session is not accessible or can only be accessed after a previously successful authorization.

[0019] By analogy, this can be contrasted with a mailbox, where mail, such as letters, can be posted at various times, but when posting a mail item, the person posting the mail item cannot gain access to mail previously posted and already in the mailbox if he is not authorized, i.e. does not have the mailbox key. Since the various writing sessions are separated from one another by the occurrence and detection of at least one activation signal, it is sufficient from the point of view of data protection to prove that such an activation signal has occurred, and has actually or at least probably also been detected, in order to prove that previously stored data was protected thereafter, and thus also during any subsequent access sessions (e.g. for write access, read access, erase access).

[0020] Thus, data written to a data storage system during a previous write session may be access protected in such a way that it cannot be seen (in particular read), overwritten, erased, or even inspected for its very existence by a later (not properly authorized) access session.

[0021] First, various exemplary embodiments of the method are described below, which in each case, unless expressly excluded or technically possible, can be combined with each other and with aspects of other solutions which are further described, as desired.

[0022] In some embodiments, the received or generated writing session related data is at least partly recorded data representing one or more real events or conditions of the subject, acquired continuously or repeatedly over a certain time period by the recording system, in particular by a sensor. The method is therefore particularly suitable for acquiring and storing the recorded data using a series of different writing sessions, and for protecting the data in such a way that it can be read out only in a manner that is specifically authorized for each writing session. For example, the recorded data may come from a so-called dash cam of a police officer and represent only the recording of individual specific events within the scope of the police officer's actions. If the recorded data is read out as evidence, for example to preserve evidence for a selected action, this may be done selectively for this action by only authorizing the removal of the access protection for the recorded data for the writing session corresponding to this action. It is also ensured that if an activation signal is subsequently detected, for example because the device has been switched off or because a later writing session exists, the recording can also be used as evidence.

[0023] In some embodiments, the access protection includes at least one of the following measures: (i) cryptographic encryption of write session related data; (ii) the or each further write session is opened dependent only on a previously successful authentication of a write request requesting the write session.

[0024] According to some of these embodiments, the write session related data is encrypted by means of integrity protection encryption and / or symmetric encryption, in particular using AES GCM (AES Galois-Counter Mode) encryption. Thus, an authenticated encryption mode with the associated data is available to allow both authentication and encryption of the data to be stored. Furthermore, the method is designed for high data throughput with the option of parallelized data streams and is therefore particularly advantageous with regard to real-time encryption of data. The term "integrity protection encryption" as used herein is understood to mean encryption that allows the reception of a corresponding encrypted message in order to identify whether the message has been modified on its transmission path and / or received incompletely.

[0025] In some embodiments, encryption of the write-session-related data is performed for each write session using an encryption key that is individually assigned to this respective write session. In this way, session-related access protection can be implemented or, if another protection concept already exists, can be additionally strengthened. The keys can in particular be pre-defined. For this purpose, they can be stored, for example, in a data processing device configured to perform the method or in a storage device assigned to the data processing device. However, it is also possible to initially define one or more keys in the course of the method, for example based on a random or pseudo-random process or depending on a session counter.

[0026] In some embodiments, the method comprises a number of write sessions, where the physical storage sub-areas of the data storage system assigned to each write session are determined in the context of a direct or indirect (particularly in a multi-level) address mapping from an address space with logical storage addresses to an address space with physical storage addresses of the physical storage areas assigned to each write session. For at least two of the write sessions, the respective logical address space to address mappings coincide at least with respect to their logical starting addresses. On the input side, a unified address space may be used for at least two, particularly all access sessions, in the address mapping (for example starting at logical address "0" or at any other fixed starting address), which on the output side corresponds to different physical address ranges depending on the session.

[0027] In particular, when the method is performed by a system (e.g., a separate semiconductor chip) separate from a data storage system, in particular a data processing system, an indirect address mapping can be used. This makes it possible to use known standard memories, for example, commercially available memory cards. Mapping logical addresses to physical addresses can then be, in a first step, mapping the logical addresses of one medium (the data processing system) to the logical addresses of another medium (such as a memory card), and in a second step, mapping the logical addresses of the other medium (such as a memory card) to its physical storage addresses.

[0028] In some embodiments, the method further comprises a step of receiving or generating an additional secret defined solely for the encryption key. To encrypt the data to be written, the additional secret is adopted for each writing session in addition to the respective encryption key provided for encryption, so that decryption of the encrypted data in question is only possible if both the secret decryption key corresponding to the encryption key and the additional secret are known. In this way, the user can include the additional secret without knowing the key, and thus influence the encryption. Meanwhile, when the data is read, information derived from this key must again be available. In this way, the owner of the data can determine who can decrypt the data of the writing session in question.

[0029] In some embodiments, a free physical storage sub-area of ​​the data storage system to be used during each write session for writing write-session related data is determined, and this storage sub-area is selectively assigned to this write session in dependence on a session counter, the session counter being modified each time an activation signal is detected, whereby each counter reading of the session counter is selectively assigned exactly one write session and exactly one specific storage sub-area corresponding to said write session. In this way, the differentiation and assignment of different storage areas to different access sessions, in particular write sessions, can be achieved particularly efficiently using a simple counter. According to some of these embodiments, it is particularly efficient if the changes in the counter reading of the session counter are always performed in the same counting direction, i.e. with respect to a strictly monotonic function.

[0030] In some embodiments, a file management structure, individually adapted and assigned to this storage sub-area, is defined at the beginning of each write session for the storage sub-area assigned to the respective write session, which storage sub-area is used to write data later in the context of the write session. Thus, the file management structure, as referred to herein, ensures that a valid file system for file-related storage access is available for each access session, especially a write session, based on the file management structure defined for the storage sub-area that corresponds to the storage sub-area and is assigned to the access session. This is essential to ensure a logical structure in each access session. In the example of the FAT format, the Master Boot Record, the Partition Boot Record, the File Allocation Table, and the Root Directory are components of the file management structure. A typical size of this file management structure (management data) is, for example, several megabytes starting at logical storage address "0".

[0031] According to some of these embodiments, the size of the allocated physical storage sub-area available for writing in the context of the respective write session via a file management structure adapted to the physical storage sub-area may in particular be presented by the file management structure as one of the following two options: (a) the total physical remaining storage size of the data storage system that has not yet been written or that has been released for overwriting; (b) a predefined storage size that may in particular be configured in advance (e.g., session-specifically) or, if this is no longer available as a whole, the physical remaining storage size of the data storage system that is actually still available and that has not been written or that has been released for overwriting.

[0032] In particular, in the case of option b), the storage size can be configured in the context of the physical residual storage size that is actually still available and has not been written or released for overwriting, and can be predefined for this purpose depending on the respective write session. In this way, the available storage size for each session can be variably defined, notably application-specifically. In some embodiments, the method further comprises at least one read session for read access data previously written to the data storage system during at least one write session. In this case, the read session comprises: (i) checking the acceptability of each pending read access by authenticating a subject, notably a user or device, to which the read access is granted; (ii) if the check indicates that the read access is acceptable, determining at least one storage sub-area assigned to the authenticated subject from a set of storage sub-areas assigned in each case to one or more of the previous write sessions; (iii) reading the access-protected data from the one or more storage sub-areas thus determined; (iv) making the read data accessible by removing the access protection in the context of the current read session; and (v) outputting the data made accessible. In this way, particularly with regard to the technical implementation of data protection requirements, during a read access to the file storage system, only those write session related data stored in the file storage system for which there is a corresponding authorization for reading are accessible.

[0033] According to some of these embodiments, a check is or will be defined such that if and to the extent that at least one of the following conditions applies in the context of a read access, the check indicates that the read access is permissible: (a) the data read in the context of a read access was written after the activation signal was last detected; (b) the data read in the context of a read access is classified as data that should be readable with all permissible read accesses. This classification can or will be characterized in particular using a corresponding identification of the data itself, a file management structure, or using the address area (logical or physical) of the storage area that stores the data. Option (a) allows easier access to the newly written data, while option (b) serves to present the file management structure in an always readable manner in order to enable smooth functioning of the storage access management in the context of the respective read session in particular.

[0034] In some embodiments ("variant 1"), the file management structures assigned to the storage sub-area for the respective write session are written, in particular copied, to the storage sub-area. This may in particular be done at the start of a write session, before data is written for the first time in the context of the write session. In the further course of writing or later reading, a simple address handling that is not particularly complex may be implemented as a result.

[0035] In the course of write accesses in a write session, directories and files may be created, modified or deleted, which may result in a modified file management structure that should or even must be preserved for later reading of this particular session. Therefore, write accesses to the address space of the adapted file management structure may be recorded in such a way that overwriting of the default file management structure is recorded. In this way, it may be determined whether and which write accesses have been made to the storage areas of the file management structure, in particular to carry out variant 2 below.

[0036] In some embodiments (hereinafter "Variant 2"), the step of reading the access protection data from each particular storage sub-area comprises the steps of (i) checking whether each read access relates to a storage address within the particular storage sub-area, the storage address data having already been written in the context of a previous write session relating to the storage sub-area, (ii-1) if this is the result of the check for each read access, reading the access protection data using a mapping step of a logical storage address to a physical address of the storage sub-area, and (ii-2) otherwise reading the access protection data using a file management structure individually assigned to the storage sub-area.

[0037] In some of these embodiments ("Variant 3"), the method further includes the steps of (iii) checking whether each read access is associated with a logical storage address for a particular storage sub-area accessible via a file management structure assigned to the storage sub-area, and (iv-1) if associated, reading the access protection data according to the method according to Variant 2, and (iv-2) if not associated, reading the access protection data using a step of mapping this logical storage address to a physical address of a storage sub-area that is not accessible via a file management structure.

[0038] The distinction between variants 2 and 3 allows for an efficient reversal of the file management structure (overlay) when reading a previous session. In this way, a file management structure that has been modified within a session (where files have been added, modified and / or deleted, resulting in a slightly modified file management structure) can be read back without any regard for the overlay logic.

[0039] A second aspect of the solution relates to a data processing system for session-based secure access control to a data storage system, the data processing system being configured to perform the method according to the first aspect. In particular, the data processing system may be embedded separately from the data storage system, for example as a separate semiconductor component (e.g. an integrated circuit, IC).

[0040] In some embodiments in this regard, the data processing system includes: (i) access protection means for protecting write session related data by access protection; (ii) detection means for detecting an activation signal; (iii) allocation means for determining free physical storage sub-areas of the data storage system to be used during each write session for storing the write session related data and selectively allocating said storage sub-areas to each write session; and (iv) an interface for outputting access protection data for writing or causing the access protection data to be written to the storage sub-areas of the data storage system selectively allocated to each current write session.

[0041] A third aspect of the solution relates to a storage medium including a data processing system according to the second aspect and a data storage system having at least one data storage device. The data processing system and the data storage system are integrated in the storage medium as a common structural unit. In addition, the data processing system is configured to perform the method according to the first aspect for session-based secure access control to the data storage system.

[0042] In some embodiments, the storage medium is designed as a mobile device, in particular a device that can be carried by hand, for example a memory card. Such a storage medium may also be called an "intelligent storage medium" by the data processing system integrated therein, which distinguishes the intelligent storage medium from "normal" standard storage systems, such as a conventional memory card, in particular for a camera.

[0043] A fourth aspect of the solution relates to a recording system for continuously or repeatedly detecting actual events or conditions of an object over a period of time with a sensor and for providing recorded data representative of these detected events or conditions. The recording system is configured to cooperate with a data processing system according to the second aspect to use a storage medium according to the third aspect for storing the recorded data. For this purpose, the recording system itself may in particular comprise this storage medium.

[0044] In some embodiments, the recording system is configured to allow a user of the recording system to exchange the storage medium in order to alternatively use a plurality of exchangeable mobile storage media (and thus removable storage media) according to the third aspect, each temporarily for storing the recording data as a storage medium. This is particularly advantageous when the storage media are read externally or without the use of the recording system, for example in terms of central data protection, evaluation or monitoring.

[0045] In some embodiments, the recording system has a data processing system according to the second aspect particularly permanently integrated therein, in this way the recording system can also be easily operated with conventional (non-intelligent as mentioned above) data storage systems such as conventional memory sticks or memory cards, using the method according to the first aspect.

[0046] A fifth aspect of the solution relates to a computer program or computer program product comprising instructions which, when executed on one or more processors of a data processing system according to the second aspect, of a storage medium according to the third aspect, or of a recording system according to the fourth aspect having an integrated data processing system according to the second aspect, cause the method according to the first aspect to be performed.

[0047] The computer program may in particular be stored on a non-volatile data carrier. Preferably, it is a data carrier in the form of an optical data carrier or a flash memory module. This may be advantageous if the computer program itself is processed independently of the processor platform on which the program or programs are executed. In another implementation, the computer program may be present as a file on a data processing unit, in particular on a server, and may be downloaded via a data connection, for example a dedicated data connection such as the Internet or a proprietary or local network. In addition, the computer program may have a number of interacting individual program modules. In particular, the modules may be configured or at least utilized such that they are executed in the sense of distributed computing on different devices (computers or processor units) that are geographically separated and connected to each other via a data network.

[0048] The data processing system may accordingly have a program storage device in which the computer program is stored. Alternatively, the data processing system may also be configured to access computer programs available externally, for example on one or more servers or other data processing means, via a communication connection, in order to exchange data with the data processing system used in particular in the course of a method or computer program or to represent the output of a computer program.

[0049] The features and advantages explained with regard to the first aspect of the solution also apply correspondingly to the further aspects of the invention.

[0050] Further advantages, features and possible applications of the solution result from the following detailed description in conjunction with the drawings. [Brief description of the drawings]

[0051] [Figure 1A] 1 is a flow chart for illustrating an exemplary embodiment of the method according to the present solution; [Figure 1B] 1 is a flow chart for illustrating an exemplary embodiment of the method according to the present solution; [Diagram 2] FIG. 2 shows a schematic diagram of an exemplary embodiment of a storage medium according to the solution having an integrated data processing device configured to perform the method according to FIG. 1A / FIG. 1B. [Diagram 3] FIG. 2 is a schematic diagram illustrating the use of a file management structure for write and read sessions according to an exemplary embodiment of the present solution; [Figure 4] FIG. 1 is a schematic diagram illustrating an integrated system for recording data management, including a recording system, a storage medium, and an archiving system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0052] In the figures, the same reference numbers indicate the same, similar, or corresponding elements. The elements depicted in the figures are not necessarily drawn to scale. Rather, the various elements shown in the figures are presented so that their functions and overall purpose can be understood by those skilled in the art. Unless expressly stated otherwise, connections and couplings between functional units and elements shown in the figures may also be implemented as indirect connections or couplings. In particular, the functional units may be implemented as hardware, as software, or as a combination of hardware and software.

[0053] In the two figures 1A and 1B, connected to each other by the conjunctions "A" and "B", an exemplary embodiment 100 of the method according to the present solution is generally shown. In this context, figure 1A relates in particular to write data in the context of one or more write sessions, while figure 1B relates to read data in the context of one or more read sessions. The method 100 is further described below with additional reference to figures 2-4.

[0054] FIG. 2, which shows an exemplary storage medium 200 according to the present solution, for example a memory card or a so-called memory stick, is first briefly described in advance. In particular in the context of the method 100, sub-figure 2(a) is used to show a write access, while sub-figure 2(b) is used to show a read access. The storage medium 200 has, in particular, a data processing system 205 and a data storage system 210, for example a flash storage system. A storage controller for the data storage system 210 (for example a flash controller in the case of a flash storage device) may in particular be integrated either in the system itself or in the data processing system 205. The data processing system 205 and / or the data storage system 210 may each in particular be an integrated circuit or may be cumulatively composed of several, in particular integrated circuits. It is also conceivable that the data processing system 205 and the data storage system 210 are included together in a single integrated circuit. The storage medium 200 has several interfaces or connections 250-275 for data input or data output, or for supply voltages and possible other signals. The storage medium 200, in particular the data processing system 205, is configured by means of a suitable computer program to carry out the method 100. The computer program may in particular be stored in the data processing system 205 itself or in the data storage system 210.

[0055] Referring again now to Fig. 1A, the method 100 starts in a start step 105, where an index i or a counter 230 of the data processing system 205 implementing said index i is initialized, the index i serving as an index for the various write sessions. In a further step 110, which may occur simultaneously with step 105, a possibly present activation signal is detected, which in Fig. 2(a) corresponds to a voltage supply signal VCC that may be applied to the interface 260. The index i is also incremented each time the storage medium is again supplied with a voltage supply signal VCC and thus activated, which may occur in particular when the storage medium 200 is connected to or disconnected from a host device that also electrically supplies the signal VCC, such as a recording system 405 (e.g. Fig. 4). This is done by incrementing the counter 230 in Fig. 2(a).

[0056] If, in step 115, an access request is received from an access subject, for example from a recording system 405 (see FIG. 4) or from a retrieval system such as a data archiving system 410, an authentication process 120 is performed to authenticate the access subject or its access request. This is done in particular by the authentication unit 240 receiving authentication information AT i , for example by (i) receiving (from the access subject) a password (e.g., PIN) at interface 275 and (ii) checking 125. If it is determined in the checking step 125 that the authentication was not successful (125-no), the system returns to step 115. In a possible modification, the authentication according to steps 120 and 125 can also be omitted.

[0057] If successful (125-YES), then the access request checks whether the type of access is requested to write data to or read data from the data storage system 210. If it is a read request (130-"READ"), then a branch occurs to the procedure shown in FIG. 1B, which is described separately below. If it is a write request (130-"WRITE"), then a new write session W is created. i is opened in a further step 135 where the current value of the index i is assigned. In addition, a write session W i is the number of physical storage subareas M that are still free, i.e., released for writing, in the file storage system 210. i In this case, the storage sub-area M i may either not yet be written or may have been released for overwriting by a storage manager, which may be part of data processing system 205, among other things.

[0058] In particular, the physical storage subarea M i But its own file management structure OL i (also called an "overlay") and a current write session W i It is possible to assign a logical start address (e.g. logical address “0”) in the logical address space that is the same for all write sessions by address mapping, so that the storage sub-area M i can be addressed by the data processing device 205 via a logical address. As proposed herein, if the same logical starting address is used for all write sessions, the logical starting addresses do not need to be treated individually on a session-specific basis, at least with respect to the starting address, thus simplifying address mapping.

[0059] File Management Structure (Overlay) OL iis primarily used to ensure that the storage medium always has a valid file system, in order to provide a logical structure, in particular a logical addressing, for each access session. For example, in the case of the known FAT format, the Master Boot Record, the Partition Boot Record, the File Allocation Table and the Root Directory may be in the overlay. A typical size of this management data is, for example, several megabytes starting at logical storage address 0. Alternatively, however, several overlays per session, or even no overlays, are also envisaged.

[0060] The write session is now ready for actual writing and in a further step 140 the current write session W i Write data written in WD i may be received from the access target. In addition, in step 145, an individual encryption key K i However, the current write session W i A key K is generated (or received) for i It is also assumed that the key is already stored in the storage medium 200 beforehand and does not need to be generated as part of a write session or received externally. It is also assumed that the key is the same for some or even all sessions.

[0061] In a further step 150, the current write session W i Additional secret for Z i For example, an additional secret Z i The signal may optionally be received at an interface 255 that is coupled to a user interface of a device that is connected to the storage medium, such as a recording system 405, through which the signal may be entered by a user.

[0062] In step 155, the received write data WD i is the key K i and possibly additional secret Zi The data may be cryptographically encrypted by an encryption unit 255 depending on the data, which may in particular be done using symmetric encryption according to the AES GCM standard.

[0063] Additional Secret Z i can be used, inter alia, to further enhance the security of data storage in storage medium 200 because subsequent successful retrieval of the known key K i Plus additional secret Z i For example, a user may have a key K i is accessible to others, an additional secret Z i The user can be sure that only he / she or someone else who owns the password can restore the stored data.

[0064] The write data thus encrypted is then stored in the current write session W i Storage subarea M assigned to i , or to have the data storage system 210 perform a write process. To enable transmission to the data storage system 210, the switch 245 in the transmission path is closed (position "1"). Thus, the session-related write data WD i is securely stored in the storage medium 200, or more precisely in its data storage system 210. i The method then ends and returns to step 110.

[0065] When the activation signal VCC is detected again, e.g. when the storage medium is reconnected to the recording system 405 or another data source, a new process execution is started and, possibly after successful authentication and recognition of the “write” access type in step 125, a new write session is opened with the incremented index i. As shown by the example in FIG. 2(a), by incrementing the index i or the counter 230, the storage addressing in the context of the address mapping between logical storage addresses and physical storage addresses is assigned to a different physical storage sub-area M for the current write session than for the previous write session. i is adapted to be used. In Fig. 2(a) five different such storage sub-areas 211-215 are shown here by way of example.

[0066] Opening a new write session is possible as long as there is still sufficient writable remaining storage space 220 in the data storage system 410. In particular, different alternative operating modes may be provided: (i) a first mode ("maximum size mode") in which the entire remaining storage space not yet written to or released for overwriting is presented as the available file system size for the current write session; and (ii) a second mode ("fixed size mode") in which a fixed, but optionally configurable, storage size is presented as the available size of the file system. Only when the available remaining storage size falls below said fixed size due to increasing writes to the data storage system, is the current remaining amount of storage presented as the available file system size.

[0067] Reference is now made to Figures 1B and 2(b), which illustrate method steps of the method 100 allocated to read data from each of the storage media in the data storage system 210 and read access r.

[0068] This stage of the method is initiated when it has been determined in step 130 already described above that for an existing access request of an access object, e.g. data archiving system 410 (see FIG. 4), the access type “read” is present and that the previous authentication of the access object in steps 120 / 125 was successful (125-Yes).

[0069] First, in step 165, a read index j is assigned to this access request, which is then opened in step 170. j , depending on the access subject that has been authenticated using its authentication information ATj provided at interface 275, to indicate the storage sub-area M i Start a new read session j is uniquely assigned to

[0070] Read Session R j In the context of this memory sub-area M j Preferably, only data stored in the file storage system 210 can be accessed, while other storage sub-areas are not accessible and are not presented as being present. The authentication unit 240 also sets the switch 245 to position "2", which on the one hand prevents write data from being written to the file storage system 210, and on the other hand opens a strictly unidirectional data path for reading (this is indicated by the symbol of a diode, but does not mean that a physical diode must actually be present here).

[0071] The following steps 175 to 185c in relation to FIG. 3 are performed by the session-related file management system (overlay) OL j FIG. 3 shows an exemplary read access using the corresponding session-related physical storage sub-area M j On the other hand, the logical address area (start address A0, end address A3) of the file management system OLj 3 shows a logical address area (starting address A0, ending address A1) of the session-related logical address space [A0,...,A3]. Also shown in FIG. 3 is an exemplary logical ending address A2 of the area occupied by data in the session-related logical address space [A0,...,A3].

[0072] Next, in step 175 of the method 100, the storage sub-area M j Each logical storage address 315, 320 or 325 required for a read access r to the file management system OL j If it is not accessible (175-NO, see logical storage address 320 in FIG. 3), a branch is followed to step 185c, where the logical storage address 320 is read from the storage subarea M j 2, the current read session R from the data storage system 210 using the address mapping to the assigned physical addresses in j If the data to be read occurs in (read data), then step 180 j 3. It is checked whether the physical storage address assigned to the logical storage address in R has already been written in before. If not (180-NO, see logical storage address 325 in FIG. 3), a branch is followed to step 185b, where the current read session R j Within, memory sub-area M j or data from one of 211-215, but not from the file management system OL assigned to this address j Only the contents of j If so (180-YES, see logical storage address 315 in FIG. 3), then branching is instead followed to step 185a, where data is written from logical storage address 315 to M j The data to be read in the current read session occurs from the data storage system 210 using an address mapping to an assigned physical address in the data storage system 210 .

[0073] In step 190, the access protection for the read data is now removed, this data is then stored as read data RD j , at the output interface 265. In this case, removing the access protection corresponds to decrypting the read data in the decryption unit 235 of the data processing system 205. For decryption, the decryption unit 235 uses the key K j and again an additional secret Zj, which is provided via interface 270.

[0074] Thus, the storage medium 200 already contains all the necessary capabilities to perform the method 100, so that no special adaptations for the method 100 need to be provided on the host device that uses the storage medium 200. The storage medium 200 can therefore be used by the host device like a conventional standard storage medium, such as an SD memory card or a memory stick, while still presenting the advantages of the solution proposed herein, in particular of the method 100. The integration of the data processing device according to the solution into the (hence) intelligent storage medium enables a data protection compliant data storage device, in particular without the host device itself, e.g. the recording system 405, having to be modified.

[0075] Referring now to FIG. 4, an integrated system 400 for record data management includes a record system 405 (or any other host device configured for use with storage media), storage media 200, and a data archiving system 410, and an exemplary application of the integrated system is described.

[0076] Before the storage medium 200 is used "in the field", the storage medium 200 can be configured, for example by a data protection officer, for example using a corresponding application program. In particular, at least one overlay can be configured, whether it is globally the same for all sessions (OL) or session-specific (OL i) may be defined. In particular, each overlay may define required formats and / or standard storage content, such as program installation files or application documents. Upon configuring the storage medium 200, it may also be determined whether a maximum size mode, a fixed size mode, or instead a third mode, still separately defined, is used for the definition of the storage sub-areas to be presented in the context of the session. The storage medium 200 is then ready for use.

[0077] The storage medium 200 can be connected to the recording system 405, especially when the pluggable storage medium 200 is inserted into a corresponding receiving slot of the recording system 405, and the recording device 405 can be brought into a state in which it outputs an activation signal VCC to the storage medium 200. This can be done especially when the recording system 405 is switched on. The recording system 405 can then recognize a valid file management system (overlay) and write data to the file storage system 210 of the storage medium 200, especially in the context of a writing process according to the method 100. After recording the writing of the data, the recording system 405 has its system switched off, whereby the activation signal VCC is removed.

[0078] The next time the device is switched on, the activation signal VCC present on the storage medium 200 is detected again, so that the recording device is again presented with an empty storage, whereby the previously written data is no longer visible.

[0079] After the recording is completed, the user can start an archiving application 415 assigned to the data archiving system 410, in particular to archive the data stored on the storage medium 200. In the context of the application 415, the user is requested to authenticate himself / herself to the storage medium 200 and is then connected to the data archiving system 410 by means of the appropriate authentication data AT, as explained above with respect to FIG. 1B. After successful authentication, the user can select one, some or all of the sessions from the list of recorded sessions according to the authentication and transfer data from these sessions to the archive 420, for example for archiving. The respective session-dependent additional secret Z i If the authentication data AT and possibly the additional secret Z are used during storage, this additional secret must also be made available to the storage medium 200 in order to read the corresponding data, as explained above with respect to FIG. i In particular, the access assigned to the data archiving system 410 may be maintained in a secure data storage device 425 .

[0080] After the data export to the archive 420 of all data to be exported, in particular of all previous writing sessions, is completed, the intelligent storage medium is reset and all data is stored in the key K or the session-related key K. i is cryptographically erased by discarding and / or overwritten in a proprietary manner, and the session counter 230 is reset again. If a change in the overlay is required, this can also be done now. The user can now reinsert the storage medium 200 into the recording device 405 and make a new secure recording.

[0081] Although at least one exemplary embodiment has been described above, it should be understood that numerous variations exist. It should also be understood that the described exemplary embodiment merely represents a non-limiting example, and is not intended to limit the scope, applicability, or configuration of the devices and methods described herein. Instead, the above description will provide those skilled in the art with guidance for implementing at least one exemplary embodiment, while it should be understood that various modifications in the operation and arrangement of elements described in the exemplary embodiment may be made without departing from the subject matter defined in the appended claims and their legal equivalents.

[0082] List of reference numbers 100 Method for Access Control According to an Exemplary Embodiment 105-190 Step or sub-process of method 100 200 Data processing system and storage medium having data storage system 205 Data Processing System 210 Data Storage System 211~215 Memory sub-area 220 remaining free memory size 225 Encryption Unit 230 One-way session counter, simultaneous detection means 235 Decoding Unit 240 Certification Units 245 Switch 250~275 Interface for data input or data output 300 Write and read sessions when using a file management system 305 Logical address area of ​​session related storage subarea 310 Logical address range of the file management system 315 A logical address already described in a session-related manner that is available in both the address area 305 and the address area 310 320 Logical addresses outside the address area 310 already described in a session-related manner 325 Logical addresses within the address range 310 that have not yet been described in a session-related manner 400 Integrated system for managing records data including recording systems, storage media, and archiving systems 405 Recording System 410 Data Archiving System 415 Archiving Applications 420 Data Archive Storage 425 Storage for Authentication Data i,j session-related index A0 Logical start address of session related storage subarea A1 Logical end address of the session-related file management system A2 The logical end address of the area occupied by data in the session-related storage subarea A3 Logical end address of session related storage subarea AT i , A.T. j Session-related authentication data K i Session-related keys M i , M j Memory sub-area Office Lady i Session-related file management system (overlay) RD i Session related read data R Read access VCC activation signals, specifically voltage supply signals W i Write session WD i Session-related write data w Write access Z i Additional session-related secrets [Explanation of symbols]

[0083] 200 Storage medium 205 Data Processing System 210 Data Storage System 211 Memory Subarea 212 Memory Subarea 213 Memory Subarea 214 Memory Subarea 215 Memory Subarea 220 Writable residual memory space 225 Encryption Unit 230 Counter 235 Decoding Unit 240 Certification Units 245 Switch 250 Interfaces or Connections 255 Interface 260 Interface 265 Output Interface 270 Interface 275 Interface 300 write and read sessions 305 Logical Address Space 310 Logical address range, address area 315 Logical Storage Address 320 Logical Storage Address 325 Logical Storage Address 400 Integrated System 405 Recording System 410 Data Archiving System 415 Archiving Applications 420 Archive 425 Secure Access Data Storage Device

Claims

1. A method (100) for session-based secure access control to a data storage system, comprising: detecting (110) an activation signal to initiate access to the data storage system; Write session related data (WD i ) to the data storage system (210). i ) and The plurality of writing sessions (W i ) each of In response to detecting the activation signal (110), the data (WD i , 215; M i ) and determine the memory subarea (211,...,215; M i ) for this writing session (W i ) from an address space (305) having logical storage addresses to each write session (W i ) physical storage area (211,...,215; M i ) into an address space having physical storage addresses of i , 215 of the data storage system (210); i ) and determining the write session (W i ), the respective logical address space to address mappings (305) corresponding to at least two of the first and second logical address spaces (305) that match at least with respect to their logical starting addresses; The write session ( i ) in the context of the data (WD i ) and The data (WD) is protected from subsequent access to the data storage system (210) using access protection that protects the data from other unauthorized access sessions. i ) (155) protecting the The storage sub-areas (211,...,215; M) of the data storage system (210) selectively assigned to the write session i and outputting (160) the access protection data to the memory device or to cause the access protection data to be written. Method(100).

2. The received or generated write session related data (WD i 2. The method of claim 1, wherein the recorded data represents, at least in part, one or more actual events or conditions of a subject that are continuously or repeatedly acquired over a particular period of time by a recording system.

3. The access protection includes the following means: The write session related data (WD i ) by cryptography (155), The write session ( i 2. The method of claim 1, further comprising at least one of: the or each further write session being opened only dependent on a preceding successful authentication of a write request requiring a write session.

4. The write session related data (WD i 4. The method (100) of claim 3, wherein said encryption (155) of said first bit is performed by integrity protection encryption and / or symmetric encryption.

5. Each writing session (W i ) for the write session related data (WD i ) encryption (155) for each write session (W i ) is assigned an individual encryption key (K i 4. The method (100) of claim 3, wherein the method is performed using

6. The encryption key (K i ) and an additional secret (Z i ) or generating (150), The data to be written (WD i ) to encrypt (155) the additional secret (Z i ) is the encryption key (K i ) plus each writing session (W i ), whereby the decryption of the encrypted data in question is performed using a secret decryption key corresponding to the encryption key and the additional secret (Z i 2. The method (100) of claim 1, wherein said method (100) is possible only if both

7. The write session related data (WD i ) (160), each write session (W i vacant physical storage sub-areas (211,...,215) of said data storage system (210) used during i ), and this storage sub-area (211,...,215; M i ) to this write session is performed in dependence on a session counter (230), said session counter being modified each time said activation signal is detected (110), so that each counter reading (i) of said session counter (230) corresponds to exactly one write session (W i ) and exactly one specific storage subarea (211,...,215; M i 2. The method of claim 1 , wherein the first and second buses are selectively assigned to the first and second buses.

8. 8. The method (100) of claim 7, wherein the change in the counter reading (i) is always made in the same counting direction.

9. Each of the write sessions ( i The storage sub-areas (211,...,215; M i ) for each write session (W i At the beginning of this memory subarea (211,...,215; M i ) are individually adapted and assigned to the file management structure (OL i ) is defined (135), which is the write session (W i 2. The method of claim 1, wherein the subsequent writing of data is performed in the context of

10. The file management structure (OL) adapted to the physical storage sub-area i ) via each of the write sessions (W i ) available for writing (160) in the context of the allocated physical storage sub-areas (211,...,215; M i ) is the size of the file management structure (OL i ) gives you two options: a) the total physical remaining storage size (220) of said data storage system (210) that has not yet been written or released for overwriting; 10. The method (100) of claim 9, wherein the data storage system (210) is presented as one of: a predetermined storage size, or, if the entirety of the predetermined storage size is no longer available, a physical remaining storage size (220) of the data storage system (210) that is actually still available and has not been written to or is released for overwriting.

11. In the context of option b), the storage size is configurable in the context of the physical remaining storage size (220) that is actually still available and has not been written or released for overwriting, and the respective write session (W i 11. The method (100) of claim 10, wherein the first and second inputs are predefined depending on the first and second inputs.

12. At least one write session (W j ) at least one read session (R j ), and the read session (R j )teeth, - checking (120, 125) the acceptability of each pending read access by authenticating the subject to which the read access is granted; Each time the check (120, 125) indicates that the read access is permissible, the previous write session (W j ) are assigned to one or more of the storage subareas (211,...,215; M i ) assigned to the authenticated subject from the set of at least one storage sub-area (211,...,215; M i ) (170); The one or more storage sub-areas (211,...,215; M i ) reading the access protected data from the Current read session (R j ) by removing (190) the access protection in the context of the read data (RD j ) accessible; The data made accessible (RD j and outputting (160) the signal from said first iteration of said second iteration of said second iteration of said first ...

13. The following conditions: The data (RD j ) is written since the activation signal was last detected, The data (RD j ) is classified as data that should be readable with all allowed read accesses, to the extent that the check (120, 125) is defined, or will be defined, such that if and to the extent that at least one of the following applies in the context of the read access, the check indicates that the read access is permissible.

14. Each specific memory subarea (211,...,215; M i ) to the access protection data (RD j ) is read out by Each of the read accesses is to a particular storage sub-area (211,...,215; M i A step (180) of checking whether the storage address data is associated with a storage address (315) in said storage sub-areas (211,...,215; M i ) which has already been written in the context of a previous writing session; If this is the result of the check (180) for each read access, the logical storage address is assigned to the storage sub-area (211,...,215; M i ) to the physical address of the access protection data (RD j ) (185a); Otherwise, the storage sub-areas (211,...,215; M i The file management structure (OL j ) to the access protection data (RD j The method (100) of claim 12 as per claim 9, further comprising the step of reading (185b) the

15. Each of the read accesses is performed in one of the storage sub-areas (211,...,215; M i The file management structure (OL j ), the particular storage sub-areas (211,...,215; M i a step (175) of checking whether the logical storage address (315, 325) is related to the If relevant, the access protection data (RD) is read according to the method (100) of claim 14. j (185a, 185b) reading out If not, this logical storage address is written to the file management structure (OL j ) are not accessible via the storage sub-areas (211,...,215; M i ) to the physical address of the access protection data (RD j 15. The method (100) of claim 14, further comprising the step of reading (185c) the

16. For each of the write sessions, the storage sub-areas (211,...,215; M i The file management structure (OLj) allocated to the storage sub-area (211,...,215; M i The method (100) of claim 9, wherein the

17. A data processing system (205) for session-based secure access control to a data storage system (210), the data processing system (205) being configured to perform the method (100) of claim 1.

18. The access protection is provided to the write session related data (WD i ) access protection means (225) for protecting the detection means (230) for detecting said activation signal; M of the free physical storage sub-areas (211,...,215; M i ) and determine the memory subarea (211,...,215; M i allocation means for selectively allocating the first and second write sessions to the respective write sessions; The storage sub-areas (211,...,215; M) of the data storage system (210) selectively assigned to the respective current write session i and an interface for outputting said access protection data to write or cause to be written said access protection data to a data processing system (205) according to claim 17.

19. A storage medium (200), A data processing system (205) according to claim 17; a data storage system (210) having at least one data storage device; said data processing system (205) and said data storage system (210) being integrated within said storage medium (200) as a common structural unit; The data processing system (205) is configured to perform the method (100) of claim 1 for session-based secure access control to the data storage system (210).

20. 20. The storage medium (200) according to claim 19, designed as a mobile device.

21. a recording system (405) for continuously or repeatedly detecting actual events or conditions of interest with a sensor over a period of time and for providing recorded data representative of those detected events or conditions, The recording system (405) is configured to cooperate with a data processing system (205) as claimed in claim 17 to use a storage medium (200) as claimed in claim 19 for storing the recording data.

22. The recording system (405) of claim 21, configured to enable a user of the recording system (405) to exchange the storage medium (200) for alternative use of a plurality of exchangeable mobile storage media (200) of claim 20, each of which is temporarily used to store the recording data as a storage medium.

23. A recording system (405) according to claim 21, comprising a data processing system (205) according to claim 17 integrated therein.

24. A computer program comprising instructions which, when executed on one or more processors of a data processing system (205) according to claim 17, of a storage medium (200) according to claim 19, or of a recording system (405) according to claim 23, cause the method (100) according to claim 1 to be performed.

Images