[go: up one dir, main page]

WO2011147116A1 - 一种复合型usub设备及其实现方法 - Google Patents

一种复合型usub设备及其实现方法 Download PDF

Info

Publication number
WO2011147116A1
WO2011147116A1 PCT/CN2010/075508 CN2010075508W WO2011147116A1 WO 2011147116 A1 WO2011147116 A1 WO 2011147116A1 CN 2010075508 W CN2010075508 W CN 2010075508W WO 2011147116 A1 WO2011147116 A1 WO 2011147116A1
Authority
WO
WIPO (PCT)
Prior art keywords
operation instruction
data
smart key
host
composite
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2010/075508
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Feitian Technologies Co Ltd
Original Assignee
Feitian Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Feitian Technologies Co Ltd filed Critical Feitian Technologies Co Ltd
Priority to US12/989,671 priority Critical patent/US20120124380A1/en
Publication of WO2011147116A1 publication Critical patent/WO2011147116A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/4401—Bootstrapping
    • G06F9/4411—Configuring for operating with peripheral devices; Loading of device drivers
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/0604—Improving or facilitating administration, e.g. storage management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0629—Configuration or reconfiguration of storage systems
    • G06F3/0632—Configuration or reconfiguration of storage systems by initialisation or re-initialisation of storage systems
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671—In-line storage system
    • G06F3/0673—Single storage device
    • G06F3/0679—Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G06F3/0622—Securing storage systems in relation to access

Definitions

  • the present invention relates to the field of information security, and in particular, to a composite USB device and an implementation method thereof.
  • a composite device is a device that performs the functions of two or more different devices.
  • the existing universal serial bus storage technology utilizes a universal serial bus block transfer protocol and has good usability.
  • Devices that use this technology typically have:
  • the first type of removable storage devices mainly including disks, CDs, flash drives, and so on.
  • the smart key device mainly includes a software protection device, an authentication security device, and the like.
  • Information security devices are usually usb interfaces, also known as usbkey, which are simple to use and low in cost. It has a built-in single-chip or smart card chip, which can store the user's key or digital certificate, and uses the built-in cryptographic algorithm of the smart key device to authenticate the user's identity.
  • Smart key devices with email encryption, digital signatures, security certificates, secure network logins, and access to SSL (Security Socket Layer, Secure Socket Layer protocol layer, security network and other functions, and has the feature of ensuring that the user's private key never leaves the hardware, and also has physical anti-attack characteristics, and the security is extremely high.
  • the smart key device be declared as CCID (usb Chip/Smart Card) in the computer.
  • Interface Devices-usb, the chip smart card interface device operates on it, and can also be declared as HID (Human Interface) Device, human interface device), enables the smart key device to comply with the communication rules of the HID protocol specification, and complete various functions of the smart key device.
  • HID device is one of the usb devices fully supported by the Windows operating system, running Windows. On computers of 98 or higher, the application can communicate with HID devices that use the operating system's built-in drivers, so USB devices that conform to the HID protocol specification can be easily set up and run on Windows systems.
  • SCSI Small Computer System Interface
  • SCSI Small Computer System Interface
  • SCSI is an interface standard for computers connected to external devices, can provide faster data transfer rate.
  • SCSI reserves the extension commands for developers to use. To complete the SCSI communication of the smart key device, the developer designs the SCSI extension command as a command of the smart key device to complete the function of the smart key device.
  • the invention provides a composite USB device and an implementation method thereof.
  • the technical solution is as follows:
  • a method for implementing a composite USB device comprising:
  • the composite usb device establishes a connection with the host and declares its own device type
  • the composite usb device receives an operation instruction issued by the host, and determines whether the operation instruction is a smart key operation instruction;
  • the method for establishing a connection between the composite USB device and the host, and the method for declaring its own device type specifically includes:
  • the composite usb device declares itself to be a predetermined number of mass storage devices.
  • the mass storage device includes an optical disk and a magnetic disk.
  • the operation instructions issued by the host are commands encapsulated according to the SCSI protocol specification.
  • the method for determining whether the operation instruction is a smart key operation instruction by the composite type USB device is specifically:
  • the operation instruction Determining whether the value of the specified field in the operation instruction is an agreed value, if it is an agreed value, the operation instruction is a smart key operation instruction, otherwise it is a data read/write operation instruction; or
  • the operation instruction Determining whether the value of the specified bit in the special field in the operation instruction is an agreed value, and if it is an agreed value, the operation instruction is a smart key operation instruction, otherwise it is a data read/write operation instruction; or
  • the operation instruction is an extended SCSI instruction, and if it is an extended SCSI instruction, the operation instruction is a smart key operation instruction, otherwise it is a data read/write operation instruction.
  • the specified domain in the operation instruction is specifically: a LUN domain, a reserved domain, or an LBA domain in the operation instruction;
  • the specified bit in the special field in the operation instruction is specifically: Special bits in the LUN domain, special bits in the reserved domain, or reserved bits in other domains.
  • the composite USB device establishes a connection with the host and declares its own device type.
  • the method further includes:
  • the composite usb device is declared as one HID device and a predetermined number of mass storage devices.
  • the method for receiving the operation instruction issued by the host by the composite USB device and determining whether the operation instruction is a smart key operation instruction is specifically:
  • the composite usb device parses and determines whether the operation instruction is encapsulated according to a SCSI protocol specification, and if so, the operation instruction is a data read/write operation instruction, otherwise the operation instruction is a smart key operation instruction;
  • the composite usb device determines whether the operation instruction is passed through the usb control transmission pipeline, and if so, the operation instruction is a smart key operation instruction, otherwise the operation instruction is a data read/write operation instruction.
  • the composite USB device establishes a connection with the host and declares its own device type.
  • the method further includes:
  • the composite usb device is declared as one CCID device and a predetermined number of mass storage devices.
  • the method for receiving the operation instruction issued by the host by the composite USB device and determining whether the operation instruction is a smart key operation instruction is specifically:
  • the composite usb device parses and determines whether the operation instruction is encapsulated according to a SCSI protocol specification, and if so, the operation instruction is a data read/write operation instruction, otherwise the operation instruction is a smart key operation instruction.
  • the smart key operation specifically includes:
  • a composite USB device characterized in that the device comprises:
  • the interface module is used for establishing a connection between the composite USB device and the host, and performing data parsing/encapsulation and communication based on the usb protocol;
  • the instruction determining module is configured to determine whether the operation instruction obtained by the interface module to parse the usb data packet is a standard SCSI data read/write operation instruction or a smart key operation instruction;
  • a data storage module configured to store data, when the operation instruction is the standard SCSI data read/write operation instruction, execute the operation instruction to perform a data read/write operation;
  • the smart key module is configured to perform a corresponding smart key operation when the operation instruction is the smart key operation instruction.
  • the smart key module further includes:
  • a digital signature unit configured to perform a data signature operation on the incoming data according to the signature instruction in the smart key operation instruction.
  • the smart key module further includes:
  • An identity authentication unit configured to perform an identity authentication operation according to the identity authentication command in the smart key operation instruction.
  • the smart key module further includes:
  • a data encryption/decryption unit configured to perform an add/close operation on the incoming/outgoing data according to the data encryption/decryption instruction in the smart key operation instruction;
  • the data encryption/decryption unit is further configured to perform an encryption/decryption operation on data transmitted to and from the data storage module.
  • the smart key device generally has a much smaller storage space than the ordinary storage device because of security and cost.
  • Embodiment 1 is a method for implementing a composite USB device according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic diagram of a method for implementing a composite USB device according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic diagram of a method for implementing a composite USB device according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic diagram of a method for implementing a composite USB device according to Embodiment 4 of the present invention.
  • FIG. 5 is a functional block diagram of a composite USB device according to Embodiment 5 of the present invention.
  • FIG. 6 is a schematic diagram showing the hardware structure of a composite USB device according to Embodiment 6 of the present invention.
  • FIG. 7 is a schematic structural diagram of hardware of a composite USB device according to Embodiment 7 of the present invention.
  • FIG. 8 is a schematic structural diagram of hardware of a composite USB device according to Embodiment 8 of the present invention.
  • FIG. 9 is a schematic diagram showing the hardware structure of a composite USB device according to Embodiment 9 of the present invention.
  • FIG. 10 is a schematic diagram showing the hardware structure of a composite USB device according to Embodiment 10 of the present invention.
  • the problem of integrating a storage device and a smart key device into one device is solved, and the function of the storage device in the composite device and the function of the smart key device are implemented by one microprocessor or a plurality of microprocessor chips; Referring to Figure 1, the steps of the implementation are as follows:
  • Step 101 The composite device is connected to the host, and the device type is declared as a large-capacity storage device.
  • the composite device is connected to the host through the usb interface, and the host sends a usb enumeration command to the composite device to obtain the type of the composite device;
  • the composite device After receiving the enumeration command issued by the host, the composite device reports to the host that it is a mass storage device and supports the interface standard of the SCSI protocol.
  • Step 102 The host acquires the number of logical units of the composite device.
  • the usb mass storage device supports multiple logical units with common device characteristics.
  • the logical unit can be a physical storage unit or a logical address space, and each logical unit can be a LUN (Logic). Unit Number, logical unit number) to identify.
  • LUN Logical Unit Number, logical unit number
  • the command for obtaining the LUN sent by the host to the composite device is the GET_MAX_LUN command, and the composite device returns the pre-agreed LUN value to the host.
  • the LUN ranges from 0 to 15.
  • the LUN value returned by the composite device to the host may be any value from 0 to 15.
  • the LUN value is 1 as an example, indicating that the composite device can implement the functions of the two devices.
  • Step 103 The host acquires specific information of the composite device.
  • the host sends an INQUIRY command to each logical unit (LUN from 0 to the maximum) in the composite device to query device specific information; each logical unit is considered as a separate storage device, and reports the characteristics of each storage device in response to the INQUIRY command.
  • LUN logical unit
  • each logical unit is considered as a separate storage device, and reports the characteristics of each storage device in response to the INQUIRY command.
  • the composite device After receiving the INQUIRY command from the host, the composite device sends a character set description (unicode) to the host, including the manufacturer, product description, model, and other information.
  • a character set description unicode
  • the mass storage device is included in the character set description, including disks, optical disks, and the like.
  • the composite device declares itself to the optical device as an optical disk device.
  • the composite device may declare the multiple logical units as different types in step 103, respectively.
  • Step 104 The host loads the driver of the composite device.
  • the host selects the interface of the device communication according to the response information of the composite device in the above step, and loads the device driver.
  • Step 105 Generate an operation instruction in the host, and send the operation instruction to the composite device.
  • a standard data read/write operation instruction is generated according to the SCSI protocol, and then the operation instruction is sent to the composite device;
  • the host If the host wants to use the smart key function of the composite device, the host generates a smart key operation instruction according to a pre-agreed rule, and then delivers the smart key operation instruction to the composite device.
  • the smart key function of the composite device includes: digital signature, data encryption/decryption, identity authentication, and the like;
  • the issued smart key operation instruction is a specific SCSI command
  • the command is a specific SCSI command by using a special value in a special field or bit in the SCSI command.
  • the above special domain includes a LUN domain, a reserved domain, and special bits include special bits in the LUN domain, reserved. a special bit in the domain or a reserved bit in another domain;
  • sequence of SCSI commands issued by the host is as follows:
  • the SCSI command is:
  • the first byte 0x28 is an opcode indicating that the SCSI command is a read10 command (read data command). If the opcode is 0x2a, the SCSI command is a write10 command (write data command). ); the second byte 0x00 is the LUN domain, the LUN value is 0 in the instruction; the third byte to the sixth byte is LBA (Logical) Block Address, the value in the field 0x00 00 00 48 indicates the LBA address; the 7th byte to the 9th byte 0x00 00 04 indicates the offset; the 10th byte is the control parameter.
  • the smart key operation instruction adopts a special domain form in the SCSI instruction:
  • the value of the LUN does not change to 0. If the digital signature is performed, the value of the LUN is 1.
  • sequence of instructions issued by the host is:
  • the opcode of the SCSI command is 0x2a, indicating that the SCSI command is a write10 command;
  • the LUN value is 1, indicating that the instruction is a signed instruction;
  • the 13th byte of the instruction sequence is 0x00, indicating that the host is going to The composite device sends the data to be signed;
  • the data to be signed is sent to the composite device according to the SCSI protocol.
  • Step 106 The composite device receives the operation instruction, and analyzes the received operation instruction to determine whether it is a data read/write operation instruction;
  • the method for the composite device to determine whether the received operation instruction is a data read/write operation instruction is:
  • the composite device determines whether the operation instruction is a data read/write operation instruction according to the value of the special field in the received SCSI command or a special bit in the field, and if so, proceeds to step 107; otherwise, step 108 is performed.
  • the composite device determines the value of the LUN domain: if the value of the LUN domain is 0, the SCSI command is a data read/write operation instruction, and step 107 is performed; if the value of the LUN domain is 1, the SCSI The instruction is a smart key operation instruction, and step 108 is performed.
  • Step 107 The composite device executes a data read/write operation instruction, and returns an instruction execution result to the host;
  • the operation instruction is a read/write operation instruction, and at this time, the SCSI instruction is executed to perform read/write of data. Operation; then return the execution result of the instruction (read data or information that successfully writes data) to the host.
  • Step 108 The composite device executes the received operation instruction and performs a smart key operation
  • the composite device After the composite device determines that the received SCSI command is a smart key operation command, parses the received SCSI command, determines a specific type of smart key operation (digital signature, data encryption/decryption, identity authentication, etc.), and then receives the data to be operated. According to the smart key operation instruction, the corresponding intelligent key operation is performed on the operation data.
  • a specific type of smart key operation digital signature, data encryption/decryption, identity authentication, etc.
  • step 106 if the value of the LUN field in the received SCSI command is 1, the composite device may determine that the operation instruction is a signature instruction in the smart key operation instruction, and then receive the data to be signed. And digitally sign the signature data.
  • Step 109 The composite device returns the execution result of the operation instruction to the host, and ends.
  • the host may also send an instruction for obtaining the signature result to the composite device;
  • the host may send a special read data instruction or a predetermined extended SCSI command to the composite device;
  • the composite device returns the execution result of the operation instruction to the host after being encapsulated by the SCSI protocol.
  • the instruction for obtaining a signature result sent by the host to the composite device is as follows:
  • the composite device After receiving the instruction, the composite device encapsulates the result of the digital signature according to the SCSI protocol and returns it to the host.
  • the smart key function in the composite device includes at least one of a function of digital signature, identity authentication, data encryption/decryption, and the like;
  • the LUN value returned is 4;
  • the instruction when the LUN value in the SCSI command is 0, the instruction is a data read/write instruction; when the LUN value is 1, the instruction is a signature instruction; when the LUN value is 2, the instruction is a data encryption instruction.
  • the instruction may also be a data decryption instruction; when the LUN value is 4, the instruction is an identity authentication instruction;
  • the method for implementing the functions of identity authentication, data encryption/decryption, and the like by the composite device can refer to the above method for implementing the data word signature function.
  • the methods used for data encryption/decryption include custom algorithm encryption and standard algorithm encryption;
  • Standard encryption algorithms include: RSA, DES, 3DES, MD5, SHA-1, SSF33, AES, ECC, RC, PGP, BASE64 algorithms;
  • the method used in custom algorithm encryption is a user-defined algorithm.
  • the device provided in Embodiment 1 of the present invention is represented as one or more mass storage devices after being accessed by the operating system, and on the basis of the mass storage device, the smart device is also implemented.
  • the advantages of the key device are:
  • the problem of integrating a storage device and a smart key device into one device is solved, and the function of the storage device in the composite device and the function of the smart key device are implemented by one microprocessor or a plurality of microprocessor chips; Referring to Figure 2, the steps of the implementation are as follows:
  • Step 201 The composite device is connected to the host, and the device type is a large-capacity storage device.
  • the composite device is connected to the host through the usb interface, and the host sends a usb enumeration command to the composite device to obtain the type of the composite device;
  • the composite device After receiving the enumeration command sent by the host, the composite device reports to the host that it is a mass storage device and supports the interface standard of the SCSI protocol.
  • Step 202 The host acquires the number of logical units of the composite device.
  • the command for obtaining the LUN sent by the host to the composite device is the GET_MAX_LUN command, and the composite device returns the pre-agreed LUN value to the host.
  • the value of the LUN is 0 to 15.
  • the LUN value returned by the composite device to the host is 0, indicating that the composite device has only one logical unit.
  • Step 203 The host acquires specific information of the composite device.
  • the host sends an INQUIRY command to each logical unit (LUN from 0 to the maximum) in the composite device to query device specific information; each logical unit is considered as a separate storage device, and reports the characteristics of each storage device in response to the INQUIRY command.
  • LUN logical unit
  • each logical unit is considered as a separate storage device, and reports the characteristics of each storage device in response to the INQUIRY command.
  • the composite device After receiving the INQUIRY command from the host, the composite device sends a character set description (unicode) to the host, including the manufacturer, product description, model, and other information.
  • a character set description unicode
  • the specific type of the mass storage device is included in the character set description, including disks, optical disks, and the like.
  • the composite device declares itself to the host as a disk device.
  • Step 204 The host loads the driver of the composite device.
  • the host selects the interface of the device communication according to the response information of the composite device in the above step, and loads the device driver.
  • Step 205 Generate an operation instruction in the host, and send the operation instruction to the composite device.
  • the instructions sent and received during communication between the host and the composite device are encapsulated according to the specifications of the SCSI interface protocol.
  • the data read/write operation instruction is generated according to the standard of the SCSI protocol, and then the operation instruction is sent to the composite device;
  • the host If the host wants to use the smart key function of the composite device, the host generates an operation instruction according to a pre-agreed rule, and then delivers the operation instruction to the composite device.
  • the smart key function of the composite device includes: digital signature, data encryption/decryption, identity authentication, and the like;
  • the issued operation instruction is a SCSI command for accessing a specific location in the disk
  • Specific locations on the disk include specific files on the disk, specific sectors in the disk, etc.
  • This particular file or specific sector is pre-agreed in the composite device.
  • the signature instruction sequence sent by the host to the composite device is as follows:
  • the host passes a special LBA address 0xaa aa aa Aa, indicating that the SCSI command is a signature instruction;
  • the data to be signed is sent to the composite device according to the SCSI protocol.
  • Step 206 The composite device receives the operation instruction, and analyzes the received operation instruction to determine whether it is a data read/write operation instruction;
  • step 207 is performed; otherwise, the operation instruction is a smart key operation instruction, and step 208 is performed.
  • the method for the composite device to determine whether the received operation instruction is a data read/write operation instruction is:
  • the composite device parses and determines whether the received operation instruction is an operation instruction for accessing a specific file or a specific sector or file in the disk, and if so, the operation instruction is a smart key operation instruction, otherwise the operation instruction is data read/write Operation instructions.
  • the composite device is 0xaa aa aa according to the received LBA address in the operation instruction.
  • Aa can determine that the operation instruction is a signature instruction;
  • the composite device determines that the instruction is a signature instruction and receives the data to be signed issued by the host.
  • Step 207 The composite device executes a data read/write operation instruction, and returns an instruction execution result to the host.
  • step 206 it is determined in step 206 that the received SCSI command is a read/write operation command, and the composite device executes the SCSI command to perform a data read/write operation; and then the execution result of the instruction (read The data to be sent or the information to successfully write the data is returned to the host.
  • Step 208 The composite device executes the received SCSI command and performs a smart key operation.
  • the composite device determines that the received SCSI command is a smart key operation command
  • the corresponding smart key operation is performed according to the SCSI command, and a smart key operation such as digital signature, data encryption/decryption, or identity authentication is performed.
  • the digital signature operation is performed on the incoming data to be signed in the instruction.
  • Step 209. The composite device returns the execution result of the operation instruction to the host, and ends.
  • the host may also send an instruction for obtaining the signature result to the composite device;
  • the instruction for obtaining a signature result sent by the host to the composite device is as follows:
  • the composite device After receiving the instruction to obtain the signature result, the composite device encapsulates the execution result of the smart key operation instruction and returns it to the host according to the SCSI protocol.
  • the smart key function in the composite device includes at least one of a function of digital signature, identity authentication, data encryption/decryption, and the like;
  • smart key operation types can be distinguished by different special LBA addresses.
  • Methods used for data encryption/decryption include custom algorithm encryption and standard algorithm encryption;
  • Standard encryption algorithms include: RSA, DES, 3DES, MD5, SHA-1, SSF33, AES, ECC, RC, PGP, BASE64 algorithms;
  • the method used in custom algorithm encryption is a user-defined algorithm.
  • the device provided in the second embodiment of the present invention is a mass storage device after being accessed by the operating system, and the smart key device is also implemented on the basis of the mass storage device.
  • the advantages of the function are:
  • the problem of integrating a storage device and a smart key device into one device is solved, and the function of the storage device in the composite device and the function of the smart key device are implemented by one microprocessor or a plurality of microprocessor chips; Referring to Figure 3, the steps of the implementation are as follows:
  • Step 301 The composite device is connected to the host, and the device type is a large-capacity storage device.
  • the composite device is connected to the host through the usb interface, and the host sends a usb enumeration command to the composite device to obtain the type of the composite device;
  • the composite device After receiving the enumeration command sent by the host, the composite device reports to the host that it is a mass storage device and supports the interface standard of the SCSI protocol.
  • Step 302 The host acquires the number of logical units of the composite device.
  • the command for obtaining the LUN sent by the host to the composite device is the GET_MAX_LUN command, and the composite device returns the pre-agreed LUN value to the host.
  • the value of the LUN is 0 to 15.
  • the LUN value returned by the composite device to the host is 0, indicating that the composite device has only one logical unit.
  • Step 303 The host acquires specific information of the composite device.
  • the host sends an INQUIRY command to each logical unit (LUN from 0 to the maximum) in the composite device to query device specific information; each logical unit is considered as a separate storage device, and reports the characteristics of each storage device in response to the INQUIRY command.
  • LUN logical unit
  • each logical unit is considered as a separate storage device, and reports the characteristics of each storage device in response to the INQUIRY command.
  • the composite device After receiving the INQUIRY command from the host, the composite device sends a character set description (unicode) to the host, including the manufacturer, product description, model, and other information.
  • a character set description unicode
  • the specific type of the mass storage device is included in the character set description, including disks, optical disks, and the like.
  • the composite device declares itself to the host as a disk device.
  • Step 304 The host loads the driver of the composite device.
  • the host selects the interface of the device communication according to the response information of the composite device in the above step, and loads the device driver.
  • Step 305 Generate an operation instruction in the host, and send it to the composite device.
  • the instructions sent and received during communication between the host and the composite device are encapsulated according to the specifications of the SCSI interface protocol.
  • a standard data read/write operation instruction is generated according to the SCSI protocol standard, and then the operation instruction is sent to the composite device;
  • the host If the host wants to use the smart key function of the composite device, the host generates an operation instruction according to a pre-agreed rule, and then delivers the operation instruction to the composite device.
  • the smart key function of the composite device includes: digital signature, data encryption/decryption, identity authentication, and the like;
  • the issued operation instruction is an extended SCSI command
  • the so-called extended SCSI command uses an opcode that is not used in the standard SCSI protocol in the SCSI command sequence (that is, the usage and meaning of the opcode is not specified in the standard SCSI protocol), and the host expands the SCSI through pre-agreed.
  • the command controls the composite device to perform multiple types of smart key operations.
  • the signature instruction sequence sent by the host to the composite device is as follows:
  • the first byte opcode 0xee is not used in the standard SCSI protocol, which means that this SCSI command is an extended SCSI command, and the remaining 9 after the opcode
  • the value of the byte can be a pre-agreed value or a random number
  • the data to be signed is sent to the composite device according to the SCSI protocol.
  • the host may generate a different operation code when generating the smart key operation instruction, or use the operation code 9 Byte data to agree on different types of smart key operations.
  • Step 306. The composite device receives the operation instruction, and analyzes the received operation instruction to determine whether it is a data read/write operation instruction;
  • step 307 is performed; otherwise, the operation instruction is a smart key operation instruction, and step 308 is performed.
  • the method for the composite device to determine whether the received operation instruction is a data read/write operation instruction is:
  • the composite device determines whether the operation instruction is an extended SCSI command according to the operation code in the received operation instruction, and if so, the operation instruction is a smart key operation instruction, otherwise the operation instruction is a data read/write operation instruction.
  • the composite device determines, according to the operation code 0xee in the received SCSI operation instruction, that the operation instruction is an extended SCSI command, so that the operation instruction is a signature instruction;
  • the composite device determines that the instruction is a signature instruction and receives the data to be signed issued by the host.
  • Step 307. The composite device executes a data read/write operation instruction, and returns an instruction execution result to the host;
  • step 306 it is determined in step 306 that the received operation instruction is a data read/write operation instruction in a standard SCSI instruction, and the composite device executes the operation instruction to perform a data read/write operation;
  • the result of the execution (read data or information that successfully writes the data) is returned to the host.
  • Step 308 The composite device executes the received extended SCSI command to perform a smart key operation.
  • the composite device determines that the received operation command is an extended SCSI command
  • the corresponding smart key operation is performed according to the extended SCSI command, and a smart key operation such as digital signature, data encryption/decryption, or identity authentication is performed.
  • the digital signature operation is performed on the incoming data to be signed in the instruction.
  • Step 309. The composite device returns the execution result of the operation instruction to the host, and ends.
  • the host may also send an instruction for obtaining the signature result to the composite device;
  • the instruction for obtaining a signature result sent by the host to the composite device is as follows:
  • the opcode 0xdd indicates that the operation instruction is an instruction to obtain a signature result
  • the host modifies the previously issued signature instruction, and changes the 13th byte of the signature instruction from 0x00 to 0x80.
  • the operation instruction indicates that the composite device needs to return data to the host, that is, the signature result, and the acquisition signature result instruction is as follows Shown as follows:
  • the 9 bytes after the operation code may be used to indicate that the extended SCSI command is an instruction to obtain a signature result different from the signature instruction.
  • the instruction to obtain the signature result may also be in the following form:
  • the composite device After receiving the instruction to obtain the signature result, the composite device encapsulates the execution result of the smart key operation instruction and returns it to the host according to the SCSI protocol.
  • the smart key function in the composite device includes at least one of a function of digital signature, identity authentication, data encryption/decryption, and the like;
  • Methods used for data encryption/decryption include custom algorithm encryption and standard algorithm encryption;
  • Standard encryption algorithms include: RSA, DES, 3DES, MD5, SHA-1, SSF33, AES, ECC, RC, PGP, BASE64 algorithms;
  • the method used in custom algorithm encryption is a user-defined algorithm.
  • the device provided in the third embodiment of the present invention is a mass storage device after being accessed by the operating system, and the smart key device is also implemented on the basis of the mass storage device.
  • the advantages of the function are:
  • the problem of integrating a storage device and a smart key device into one device is solved, and the function of the storage device in the composite device and the function of the smart key device are implemented by one microprocessor or a plurality of microprocessor chips; Referring to Figure 3, the steps of the implementation are as follows:
  • Step 401 The composite device establishes a connection with the host, and reports device information and device type.
  • the composite device is connected to the host through the usb interface, and the host sends a usb enumeration command to the composite device to obtain the type of the composite device;
  • the composite device After receiving the enumeration command issued by the host, the composite device reports to the host that it is a mass storage device supporting the SCSI protocol interface standard and an HID device;
  • the composite device declares its own device type as a SCSI protocol mass storage device with a CCID (usb Chip/Smart) Card Interface Devices, usb chip smart card interface device) device.
  • CCID usb Chip/Smart Card Interface Devices, usb chip smart card interface device
  • the mass storage device may include one or more than 16 logical units, and the device type of each logical unit may be either a disk or an optical disk.
  • Step 402. The host loads the driver of the composite device.
  • the host selects the interface protocol of the corresponding device communication according to the response information of the composite device, and loads the device driver.
  • Step 403. Generate an operation instruction in the host, and send the operation instruction to the composite device.
  • the data read/write operation command is generated according to the SCSI protocol standard, and then sent to the composite device through the bulk transfer pipeline;
  • the host invokes the PCSC interface to generate an APDU conforming to the 7816 protocol standard (Application Protocol). Data Unit, application protocol data unit), and encapsulates the APDU command according to the HID protocol, and then sends it to the composite device through the control transmission pipeline;
  • the host invokes the PCSC interface to generate an APDU command conforming to the 7816 protocol standard, and encapsulates the APDU command according to the CCID protocol, and then delivers the APDU command to the composite device through the bulk transmission pipeline.
  • the smart key function of the composite device includes: digital signature, data encryption/decryption, identity authentication, and the like.
  • the host invokes the PCSC interface to generate an APDU command, which is a random number instruction:
  • the host encapsulates the received data using the instruction header specified in the CCID protocol.
  • the instruction header is:
  • Step 404 The composite device receives the operation instruction, and analyzes the received operation instruction to determine whether it is a data read/write operation instruction;
  • step 405 is performed; otherwise, the operation instruction is a smart key operation instruction, and step 406 is performed.
  • the method for the composite device to determine whether the received operation instruction is a data read/write operation instruction is:
  • the composite device determines whether the received operation instruction is encapsulated according to the SCSI protocol specification, and if so, the operation instruction is a data read/write operation instruction of the SCSI protocol, otherwise the operation instruction is a smart key encapsulated according to the HID protocol or the CCID protocol. Key operation instruction
  • the composite device determines whether the received operation instruction is transmitted through the control transmission pipeline, and if so, the operation instruction is the intelligence of the HID protocol package. Key operation instruction, otherwise the operation instruction is a data read/write operation instruction of the SCSI protocol.
  • Step 405. The composite device executes a data read/write operation instruction, and returns an instruction execution result to the host.
  • step 404 it is determined in step 404 that the received operation instruction is a read/write operation instruction, and the composite device executes the SCSI instruction to perform a data read/write operation; and then executes the instruction execution result (reading The data to be sent or the information to successfully write the data is returned to the host.
  • Step 406 The composite device executes the received smart key operation instruction and performs a smart key operation.
  • the composite device After the composite device determines that the received operation instruction is a smart key operation instruction, parses the operation instruction and performs a corresponding smart key operation to perform operations such as digital signature, data encryption/decryption, or identity authentication.
  • the composite device pairs the received CCID instruction 0x6f 05 00 00 00 00 10 00 00 00 00
  • the composite device After parsing 00 84 00 00 08 and obtaining the APDU command 0x00 84 00 00 08, the composite device performs the operation of taking the random number according to the APDU instruction.
  • Step 407. The composite device returns the execution result of the operation instruction to the host, and ends.
  • the composite device encapsulates the execution result of the smart key operation instruction according to the HID protocol and returns it to the host through the interrupt transmission pipeline;
  • the composite device encapsulates the execution result of the smart key operation instruction according to the CCID protocol and returns it to the host through the bulk transmission pipeline.
  • the smart key function in the composite device includes at least one of functions such as digital signature, identity authentication, and data encryption/decryption.
  • the device provided in Embodiment 4 of the present invention appears as a mass storage device and an HID device after being connected to the operating system, or represents a mass storage device and a CCID device.
  • the advantages are:
  • the smart key device is generally much smaller than the ordinary storage device because of security and cost.
  • Embodiments of the present invention provide a composite device of a usb interface.
  • the composite device integrates a storage device and a smart key device into a device, and the functions of the storage and the function of the smart key in the composite device can be implemented by a microprocessor or a plurality of microprocessor chips.
  • the composite USB device 500 provided by the embodiment of the present invention includes: a usb interface module 501, an instruction determining module 502, a data storage module 503, and a smart key module 504.
  • the USB interface module 501 is configured to establish a connection between the composite USB device 500 and the host, and perform data parsing/encapsulation and communication based on the USB protocol;
  • the instruction judging module 502 is configured to determine whether the operation instruction obtained by the usb interface module 501 parsing the usb data packet is a standard SCSI data read/write instruction or a smart key operation instruction, and then send a standard SCSI data read/write operation instruction to the data.
  • the storage module 503 sends the smart key operation instruction to the smart key module 504;
  • a data storage module 503, configured to store data and perform a data read/write operation
  • the smart key module 504 is configured to perform a corresponding smart key operation according to the smart key operation instruction.
  • the smart key operation includes: digital signature and/or identity authentication and/or data encryption/decryption;
  • the smart key module includes: a digital signature unit 504A, an identity authentication unit 504B, and a data encryption/decryption unit 504C;
  • the digital signature unit 504A is configured to perform a data signature operation on the incoming data according to the signature instruction in the smart key operation instruction;
  • the identity authentication unit 504B is configured to perform an identity authentication operation according to the identity authentication command in the smart key operation instruction.
  • the data encryption/decryption unit 504C is configured to perform an encryption/decryption operation on the incoming data according to the data encryption/decryption instruction in the smart key operation instruction, and then return the ciphertext/cleartext after the encryption/hardening operation to the host or
  • the data is added to the data storage module 503 for storage; the data encryption/decryption unit 504C is further configured to perform an encryption/decryption operation on the data read out from the storage module 503, and then return the ciphertext/cleartext after the encryption/decryption operation to the host.
  • the usb interface module 501 establishes a connection with the host through the usb interface module 501, and declares itself to a predetermined number of large-capacity storage devices; the usb interface module 501 receives the usb data packet delivered by the host, and receives the usb data. After the packet is parsed, an operation instruction is obtained, and the instruction judging module 502 determines whether the operation instruction is a smart key operation instruction, and if it is a smart key operation instruction, the smart key module 504 executes the corresponding smart key according to the smart key operation. Operation, otherwise the parsed data packet is transferred to the data storage module 503, and the data storage module 503 performs a data read/write operation.
  • the composite USB device 500 can also perform encrypted storage. After the USB interface module 501 receives the data read command sent by the host, the data storage module 503 executes the data read command to read the ciphertext of the data, and the smart key module 504 The data encryption/decryption unit 504C decrypts the read ciphertext, and then sends the plaintext of the data to the host through the usb interface module 501.
  • the embodiment of the present invention provides a composite USB device, which has both a storage function of a USB disk and a smart key function of a usbkey.
  • the composite USB device also uses an existing interface technology to the existing The host system does not need to be modified, and it has good portability and ease of use.
  • a composite USB device which has both a storage function of a USB disk and a smart key function of a usbkey.
  • the composite USB device includes: a usb_Hub chip, a usbkey chip, a U disk chip, and a NAND-Flash chip.
  • the usb-Hub chip is respectively connected to the Host (host), the usbkey chip, and the U disk chip;
  • the usbkey chip is used to implement the smart key function of data encryption, decryption, digital signature, etc., and performs USB communication data communication with the host through the usb-Hub chip;
  • the U disk chip is also connected to the NAND-Flash chip, and the U disk chip is used to control the operation of writing data and reading data by the NAND-Flash chip of the large-capacity flash memory chip.
  • the usbkey chip includes a first usb interface unit, a data operation unit, and a key storage unit.
  • the U disk chip includes a second usb interface unit, a data read/write unit, and a first bus interface unit
  • the NAND-Flash chip includes a flash. a storage unit and a second bus interface unit;
  • the first usb interface unit is configured to parse or encapsulate the data according to the usb protocol, and perform data communication with the host through the usb-Hub chip by using the usb protocol;
  • a data operation unit configured to read a key from the key storage unit according to the received operation instruction, and execute a smart key function such as data encryption/decryption and digital signature indicated in the operation instruction;
  • a key storage unit configured to store a user's key
  • the second usb interface unit is configured to parse or encapsulate the data according to the usb protocol, and perform data communication with the host through the usb-Hub chip by using the usb protocol;
  • a data reading and writing unit configured to send an instruction to the flash memory unit in the NAND-Flash chip according to the received operation instruction of the read/write data, and perform an operation of reading/writing data
  • a first bus interface unit for connecting to a second bus interface unit in the NAND-Flash chip, and communicating with the NAND-Flash chip according to a specification of a bus interface protocol
  • a flash storage unit configured to store data, and execute a read/write data instruction sent by the U disk chip, and return an execution result of the read data or the instruction to the U disk chip;
  • the second bus interface unit is configured to be connected to the first bus interface unit in the U disk chip, and communicate with the U disk chip according to the specification of the bus interface protocol.
  • a composite USB device which has both a storage function of a USB disk and a smart key function of a usbkey.
  • the composite USB device includes: a U disk control chip, a usbkey chip, and a NAND-Flash chip.
  • the U disk control chip is respectively connected to a Host (host), a usbkey chip, and a NAND-Flash chip;
  • the U disk control chip in the embodiment of the present invention integrates the functions of the U disk chip and the function of the usb-Hub chip described in Embodiment 6 of the present invention, and the USB card controls the data communication between the chip and the host through the USB protocol.
  • the usbkey chip is used to implement smart key functions such as encryption, decryption, and digital signature of data.
  • the U disk control chip is also connected to the NAND-Flash chip, and controls the NAND-Flash chip to perform operations such as writing data and reading data.
  • the U disk control chip includes a usb-Hub unit, a first usb interface unit, a data read/write unit, and a first bus interface unit
  • the usbkey chip includes a second usb interface unit, a data operation unit, and a key storage unit.
  • the NAND-Flash chip includes a flash memory unit and a second bus interface unit;
  • the first usb interface unit is configured to parse or encapsulate the data according to the usb protocol, and perform data communication with the host by using the usb protocol;
  • a data reading and writing unit configured to send an instruction to the flash memory unit in the NAND-Flash chip according to the received operation instruction of the read/write data, and perform an operation of reading/writing data
  • a first bus interface unit for connecting to a second bus interface unit in the NAND-Flash chip, and communicating with the NAND-Flash chip according to a specification of a bus interface protocol
  • the second usb interface unit is configured to parse or encapsulate the data according to the usb protocol, and perform data communication with the host through the usb-Hub unit in the U disk control chip by using the usb protocol;
  • a data operation unit configured to read a key from the key storage unit according to the received operation instruction, and execute a smart key function such as data encryption/decryption and digital signature indicated in the operation instruction;
  • a key storage unit configured to store a user's key
  • a flash storage unit for storing data, and executing a read/write data command sent by the U disk control chip, and returning the read data or the execution result of the instruction to the U disk control chip;
  • the second bus interface unit is configured to be connected to the first bus interface unit in the U disk control chip, and communicate with the U disk control chip according to the specification of the bus interface protocol.
  • a circuit diagram of a composite USB device is provided.
  • the composite USB device has both a storage function of a USB disk and a smart key function of a usbkey.
  • the composite USB device includes: a U disk control chip, a usbkey chip, and a NAND-Flash chip.
  • the U disk control chip is respectively connected to a Host (host), a usbkey chip, and a NAND-Flash chip;
  • the U disk control chip provided in the eighth embodiment integrates the functions of the U disk chip in the sixth embodiment, and also integrates the functions of data encapsulation and parsing, performs data communication with the host for the usb protocol, and performs 7816 with the usbkey chip or Data communication of the spi protocol;
  • the U disk control chip is also used to control the NAND-Flash chip connected thereto to perform operations of writing data, reading data, and the like;
  • the usbkey chip is used to implement smart key functions such as encryption, decryption, and digital signature of data.
  • the U disk control chip includes a usb interface unit, a first interface unit, a data read/write unit, and a first bus interface unit
  • the USB interface chip includes a second interface unit, a data operation unit, and a key storage unit.
  • the NAND-Flash chip includes a flash memory unit and a second bus interface unit;
  • the usb interface unit is configured to parse the data sent by the host according to the usb protocol and send the data to the first interface unit or the data read/write unit, or send the data returned by the first interface unit or the data read/write unit according to the usb protocol.
  • the first interface unit is used to provide a 7816 interface or an SPI interface (Serial Peripheral) Interface, serial peripheral interface), so that the U disk control chip and the usbkey chip for data interaction;
  • a data reading and writing unit configured to send an instruction to the flash memory unit in the NAND-Flash chip according to the received operation instruction of the read/write data, and perform an operation of reading/writing data
  • a first bus interface unit for connecting to a second bus interface unit in the NAND-Flash chip, and communicating with the NAND-Flash chip according to a specification of a bus interface protocol
  • the second usb interface unit is configured to parse or encapsulate the data according to the usb protocol, and perform data communication with the host through the usb-Hub unit in the U disk control chip by using the usb protocol;
  • a data operation unit configured to read a key from the key storage unit according to the received operation instruction, and execute a smart key function such as data encryption/decryption and digital signature indicated in the operation instruction;
  • a key storage unit configured to store a user's key
  • a flash storage unit for storing data, and executing a read/write data command sent by the U disk control chip, and returning the read data or the execution result of the instruction to the U disk control chip;
  • the second bus interface unit is configured to be connected to the first bus interface unit in the U disk control chip, and communicate with the U disk control chip according to the specification of the bus interface protocol.
  • a composite USB device which has both a storage function of a USB disk and a smart key function of a usbkey.
  • the composite usb device includes: Usbkey chip, SPI-Flash chip.
  • the usbkey chip is respectively connected to the Host (host) and the SPI-Flash chip;
  • USB read and write control function and smart key function are integrated in the usbkey chip, through the SPI interface (Serial) Peripheral Interface (Serial Peripheral Interface) controls the SPI-Flash chip to perform operations such as writing data and reading data.
  • SPI interface Serial Peripheral Interface
  • SPI Peripheral Interface controls the SPI-Flash chip to perform operations such as writing data and reading data.
  • the SPI-Flash chip is a flash chip that uses an SPI interface. Its capacity is generally smaller than that of the NAND-Flash chip.
  • the usbkey chip includes a usb interface unit, a data operation unit, a key storage unit, a data read/write unit, and a first SPI interface unit.
  • the SPI-Flash chip includes a flash memory unit and a second SPI interface unit;
  • the usb interface unit is configured to parse the data sent by the host according to the usb protocol and send the data to the first SPI interface unit or the data read/write unit, or encapsulate the data returned by the second SPI interface unit and the data read/write unit according to the usb protocol. After being sent to the host;
  • a data operation unit configured to read a key from the key storage unit according to the received operation instruction, and execute a smart key function such as data encryption/decryption and digital signature indicated in the operation instruction;
  • a key storage unit configured to store a user's key
  • a data reading and writing unit configured to send an instruction to the flash memory unit in the SPI-Flash chip according to the received operation instruction of the read/write data, and perform an operation of reading/writing data
  • First SPI interface unit for providing SPI interface (Serial Peripheral Interface, serial peripheral interface), according to the SPI interface specification to encapsulate or parse the data, so that the usbkey chip and the SPI-Flash chip for data interaction;
  • a flash storage unit for storing data, and executing a read/write data instruction sent by the data read/write unit of the usbkey chip, and returning the read data or the execution result of the instruction to the usbkey chip;
  • Second SPI interface unit for providing SPI interface (Serial Peripheral Interface, serial peripheral interface), according to the SPI interface specification to encapsulate or parse the data, so that the SPI-Flash chip and the usbkey chip for data interaction.
  • SPI interface Serial Peripheral Interface, serial peripheral interface
  • a composite USB device which has both a storage function of a USB disk and a smart key function of a usbkey.
  • the composite USB device includes: Usbkey chip, NAND-Flash chip.
  • the usbkey chip is respectively connected to the Host (host) and the NAND-Flash chip;
  • the function of the U disk chip is integrated in the usbkey chip, and the flash memory unit in the NAND-Flash chip is controlled by the bus interface to perform operations such as writing data and reading data.
  • the usbkey chip includes a usb interface unit, a data operation unit, a key storage unit, a data read/write unit, and a first bus interface unit.
  • the NAND-Flash chip includes a flash memory unit and a second bus interface unit;
  • the usb interface unit is configured to parse the data sent by the host according to the usb protocol and send the data to the first bus interface unit or the data read/write unit, or package the data returned by the second bus interface unit and the data read/write unit according to the usb protocol. After being sent to the host;
  • a data operation unit configured to read a key from the key storage unit according to the received operation instruction, and execute a smart key function such as data encryption/decryption and digital signature indicated in the operation instruction;
  • a key storage unit configured to store a user's key
  • the Flash memory unit in the Flash chip sends an instruction to perform an operation of reading/writing data
  • the first bus interface unit is configured to be connected to the second bus interface unit in the NAND-Flash chip, and perform data interaction with the NAND-Flash chip according to the specification of the bus interface protocol;
  • a flash storage unit for storing data, and executing a read/write data instruction sent by the data read/write unit of the usbkey chip, and returning the read data or the execution result of the instruction to the usbkey chip;
  • the second bus interface unit is configured to connect with the first bus interface unit in the usbkey chip, and perform data interaction with the usbkey chip according to the specification of the bus interface protocol.
  • the composite USB device provided by the present invention can be represented as multiple types of devices after being connected to a host, and has the functions of a mass storage device and the function of a smart key device.
  • the advantages are:
  • the data stored by the storage device is often easily acquired, and is implemented by a certain algorithm and an API, and the storage device can be encrypted by using a smart key device to protect data security;

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Human Computer Interaction (AREA)
  • Computer Hardware Design (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Systems (AREA)

Abstract

本发明公开了一种复合型usb设备及其实现方法，涉及信息安全领域，解决了在单一设备中集成大容量存储功能和智能密钥功能的问题。复合型usb设备与主机建立连接，声明其自身的设备类型；所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令；如果是，则执行所述操作指令中指示的智能密钥操作；否则，则执行数据读/写操作。本发明在一个设备中集成了大容量存储和信息安全功能，使用方便，提高了数据安全性，增强了用户的体验。

Description

一种复合型usb设备及其实现方法 技术领域
本发明涉及信息安全领域，特别涉及一种复合型usb设备及其实现方法。
背景技术
复合设备是指一种能完成两个或多个不同设备的功能的设备。
现有的通用串行总线存储技术，是利用通用串行总线块传输协议，具有良好的使用性。使用这种技术的设备通常有：
第一类 可移动存储设备，主要包括磁盘、光盘、闪存盘等。
第二类 智能密钥设备，主要包括软件保护设备、身份验证安全设备等。信息安全设备通常是usb接口，也称usbkey，它使用简单、成本较低。它内置单片机或智能卡芯片，可以存储用户的密钥或数字证书，利用智能密钥设备内置的密码算法实现对用户身份的认证。智能密钥设备具有电子邮件加密、数字签名、安全证书、安全网络登录和访问SSL（Security Socket Layer，安全套接层协议层）安全网络等功能，并且具有保证用户的私钥永远不离开硬件的特征，还具有物理上防攻击的特性，安全性极高。
以上两类设备的外形差不多，但功能却是有很大的不同的。
在现在技术中不仅可以将智能密钥设备在计算机中声明为CCID（usb Chip/Smart Card Interface Devices-usb，芯片智能卡接口设备）设备对其进行操作，还可以声明为HID（Human Interface Device，人机接口设备）设备，使智能密钥设备遵守HID协议规范的通信规则，完成智能密钥设备的各种功能。HID设备是Windows操作系统完全支持的usb设备中的一种，在运行Windows 98或更高版本的计算机上，应用程序可以与使用操作系统内置驱动的HID设备通信，因此，符合HID协议规范的usb设备在Windows系统中可以很容易的设置并运行。
现有智能密钥设备的通讯还可以通过SCSI（Small Computer System Interface，小型计算机系统接口）命令的方式来实现，SCSI是计算机连接外接设备的一种接口标准，能够提供更快的数据传输率。SCSI为方便开发者使用预留了扩展命令，为完成智能密钥设备的SCSI通讯，开发者将SCSI扩展命令设计成智能密钥设备的命令，以完成智能密钥设备的功能。
 发明内容
目前，可移动存储设备和智能密钥设备已经广为普及，而且为了满足广大用户的需要，开发出了既具有可移动存储设备的功能又具有智能密钥设备的功能的复合设备。本发明提供了一种复合型usb设备及其实现方法，所述技术方案如下：
一种复合型usb设备的实现方法，其特征在于，包括：
复合型usb设备与主机建立连接，声明其自身的设备类型；
所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令；
如果是，则执行所述操作指令中指示的智能密钥操作；
否则，则执行数据读/写操作。
所述复合型usb设备与主机建立连接，声明其自身的设备类型的方法具体还包括：
所述复合型usb设备声明其自身为预定个数的大容量存储设备。
所述大容量存储设备包括：光盘、磁盘。
所述主机下发的操作指令为按照SCSI协议规范封装的命令。
所述复合型usb设备判断所述操作指令是否是智能密钥操作指令的方法具体为：
判断所述操作指令中指定域的值是否是约定值，如果是约定值，则所述操作指令是智能密钥操作指令，否则是数据读/写操作指令；或者
判断所述操作指令中特殊域中指定位的值是否是约定值，如果是约定值，则所述操作指令是智能密钥操作指令，否则是数据读/写操作指令；或者
判断所述操作指令是否是扩展SCSI指令，如果是扩展SCSI指令，则所述操作指令是智能密钥操作指令，否则是数据读/写操作指令。
所述操作指令中指定域具体为：所述操作指令中的LUN域、预留域或LBA域；
所述操作指令中特殊域中指定位具体为： LUN域中特殊的位、预留域中特殊的位或其它域中的预留位。
所述复合型usb设备与主机建立连接，声明其自身的设备类型，所述方法还包括：
所述复合型usb设备声明为1个HID设备和预定个数的大容量存储设备。
所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令的方法具体为：
所述复合型usb设备解析并判断所述操作指令是否是按照SCSI协议规范封装的，如果是，则所述操作指令为数据读/写操作指令，否则所述操作指令是智能密钥操作指令；
或者，
所述复合型usb设备判断所述操作指令是否是通过usb控制传输管道传入的，如果是，则所述操作指令为智能密钥操作指令，否则所述操作指令是数据读/写操作指令。
所述复合型usb设备与主机建立连接，声明其自身的设备类型，所述方法还包括：
所述复合型usb设备声明为1个CCID设备和预定个数的大容量存储设备。
所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令的方法具体为：
所述复合型usb设备解析并判断所述操作指令是否是按照SCSI协议规范封装的，如果是，则所述操作指令为数据读/写操作指令，否则所述操作指令是智能密钥操作指令。
所述智能密钥操作具体包括：
数字签名、身份认证、数据加/解密。
一种复合型usb设备，其特征在于，所述设备包括：
接口模块，用于复合型usb设备与主机建立连接，进行基于usb协议的数据解析/封装及通信；
指令判断模块，用于判断所述接口模块解析usb数据包得到的操作指令是是标准的SCSI数据读/写操作指令还是智能密钥操作指令；
数据存储模块，用于存储数据，当所述操作指令是所述标准的SCSI数据读/写操作指令时，执行所述操作指令进行数据读/写操作；
智能密钥模块，用于当所述操作指令是所述智能密钥操作指令时执行相应的智能密钥操作。
所述智能密钥模块还包括：
数字签名单元，用于根据所述智能密钥操作指令中的签名指令对传入的数据进行数据签名操作。
所述智能密钥模块还包括：
身份认证单元，用于根据所述智能密钥操作指令中的身份认证指令进行身份认证操作。
所述智能密钥模块还包括：
数据加/解密单元，用于根据所述智能密钥操作指令中的数据加/解密指令，对传入/传出的数据进行加/密操作；
所述数据加/解密单元，还用于对传入/传出所述数据存储模块的数据进行加/解密操作。
本发明提供的技术方案带来的有益效果是：
1.使用方便，用户只需要一个设备就可以满足大容量数据存储和智能密钥的相关功能需求。
2.解决智能密钥设备存储空间小的问题，智能密钥设备一般因为安全和成本的原因，存储空间往往比普通存储设备小得多。
3.解决存储设备的安全性问题，存储设备存储的数据往往容易获取，通过本发明提供的技术方案可以存储的数据进行加密，以保护数据安全。
 附图说明
图1是本发明实施例一提供的一种复合型usb设备的实现方法；
图2是本发明实施例二提供的一种复合型usb设备的实现方法；
图3是本发明实施例三提供的一种复合型usb设备的的实现方法；
图4是本发明实施例四提供的一种复合型usb设备的的实现方法；
图5是本发明实施例五提供的一种复合型usb设备的功能模块图；
图6是本发明实施例六提供的一种复合型usb设备的硬件结构示意图；
图7是本发明实施例七提供的一种复合型usb设备的硬件结构示意图；
图8是本发明实施例八提供的一种复合型usb设备的硬件结构示意图；
图9是本发明实施例九提供的一种复合型usb设备的硬件结构示意图。
图10是本发明实施例十提供的一种复合型usb设备的硬件结构示意图。
 具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
实施例一
本发明的目的是提供一种复合型usb设备的实现方法。解决了将存储设备和智能密钥设备集成到一个设备中的问题，复合设备中的存储设备的功能和智能密钥设备的功能是通过一个微处理器或多个微处理器芯片来实现的；参见图1，实现的步骤具体如下：
步骤101.复合设备与主机连接，声明设备类型为大容量存储设备；
复合设备通过usb接口连接到主机，主机向复合设备发送usb枚举命令，以获取复合设备的类型；
复合设备接收到主机下发的枚举命令后，向主机报告其为大容量存储设备，并且支持SCSI协议的接口标准。
步骤102.主机获取复合设备的逻辑单元个数；
usb大容量存储设备支持具有共同设备特性的多个逻辑单元，逻辑单元可以是物理存储单元或者逻辑地址空间，每个逻辑单元可以由LUN（Logic Unit Number，逻辑单元号）来标识。
具体地，主机向复合设备发送的获取LUN的命令为GET_MAX_LUN命令，复合设备向主机返回预先约定的LUN值，LUN的取值范围为0至15。
在本发明实施例中，复合设备返回给主机的LUN值可以为0至15的任意值；此处以LUN值为1举例说明，表示该复合设备可以实现两种设备的功能。
步骤103.主机获取复合设备的具体信息；
主机向复合设备中的各个逻辑单元（LUN从0到最大）下发INQUIRY命令，查询设备具体信息；每个逻辑单元被认为是单独的存储设备，响应INQUIRY命令，报告每个存储设备的特性。
复合设备收到主机下发的INQUIRY命令后，向主机发送字符集描述(unicode)，包括生产厂商、产品描述、型号等信息；
在字符集描述中包含有该大容量存储设备的具体类型，包括磁盘、光盘等。本发明实施例中，复合设备向主机声明自身为光盘设备。
另外，如果在步骤102中，若复合设备返回的LUN大于0，即复合设备向主机报告有多个逻辑单元，则在步骤103中复合设备可将这多个逻辑单元分别声明为不同的类型。
步骤104.主机加载该复合设备的驱动程序。
主机根据上述步骤中复合设备的应答信息，选择设备通信的接口，加载设备驱动程序。
步骤105.主机中生成操作指令，下发给复合设备；
如果主机是要对复合设备进行数据的读取或写入操作，则按照SCSI协议生成标准的数据读/写操作指令，然后将操作指令下发给复合设备；
如果主机要使用复合设备的智能密钥功能，则主机根据预先约定的规则生成智能密钥操作指令，然后将智能密钥操作指令下发给复合设备。
其中，复合设备的智能密钥功能包括：数字签名、数据加/解密、身份认证等；
其中，当主机使用复合设备的智能密钥功能时，下发的智能密钥操作指令为特定的SCSI指令；
一般通过在SCSI指令中特殊的域或位使用特殊的值来表示此命令为特定的SCSI指令，上述特殊的域包括LUN域、预留域，特殊的位包括LUN域中特殊的位、预留域中特殊的位或其它域中的预留位；
例如，主机下发的SCSI指令序列如下：
0x55 53 42 43 28 9b a5 85 00 08 00 00 80 00 0a 28 00 00 00 00 48 00 00 04 00 00 00 00 00 00 00
其中，该指令序列的前4个字节数据0x55 53 42 43表示该指令序列为SCSI请求；第13个字节0x80表示复合设备需要向主机返回数据，如果该字节为0x00则表示主机将要向复合设备发送数据；第15个字节0x0a表示该字节后有10字节的SCSI指令，SCSI指令为：
0x28 00 00 00 00 48 00 00 04 00
在该10字节的SCSI指令中，第一字节0x28为操作码，表示该SCSI指令为read10指令（读数据指令）,若操作码为0x2a，则表示该SCSI指令为write10指令（写数据指令）；第2个字节0x00为LUN域，该指令中LUN值为0；第3字节至第6字节为LBA（Logical Block Address，逻辑块地址）域，域中的值 0x00 00 00 48表示的是LBA地址；第7字节至第9字节0x00 00 04表示偏移量；第10字节为控制参数。
在本发明实施例中，智能密钥操作指令采用的是使用SCSI指令中特殊的域的形式：
若当前主机要对复合设备进行数据读/写操作，则LUN的值不变，为0；若是执行数字签名操作，则LUN的值为1。
例如，主机下发的指令序列为：
0x55 53 42 43 28 9b a5 85 00 08 00 00 00 00 0a 2a 01 00 00 a0 e8 00 00 a4 00 00 00 00 00 00 00
在该指令序列中，SCSI指令的操作码为0x2a，表示该SCSI指令为write10指令；LUN值为1，表示该指令为签名指令；该指令序列的第13个字节为0x00，表示主机将要向复合设备发送待签名数据；
主机下发上述指令序列后，将待签名数据按SCSI协议发送给复合设备。
步骤106.复合设备接收操作指令，并对接收到的操作指令进行分析，判断其是否是数据读/写操作指令；
具体地，复合设备判断接收到的操作指令是否是数据读/写操作指令的方法为：
复合设备根据接收到的SCSI指令中特殊域的值、或域中特殊的位判断该操作指令是否是数据读/写操作指令，若是，则执行步骤107；否则执行步骤108。
在本发明实施例中，复合设备判断LUN域的值：若LUN域的值为0，则该SCSI指令为数据读/写操作指令，执行步骤107；若LUN域的值为1，则该SCSI指令为智能密钥操作指令，执行步骤108。
步骤107.复合设备执行数据读/写操作指令，并向主机返回指令执行结果；
在本发明实施例中，在步骤106中判断接收到的SCSI指令中LUN域的值为0，则该操作指令是读/写操作指令，此时复合设执行该SCSI指令进行数据的读/写操作；然后将指令的执行结果（读取到的数据或写入数据成功的信息）返回给主机。
步骤108.复合设备执行接收到的操作指令，进行智能密钥操作；
复合设备判断接收到的SCSI指令为智能密钥操作指令后，解析接收到的SCSI指令，判断智能密钥操作的具体类型（数字签名、数据加/解密、身份认证等），然后接收待操作数据，根据该智能密钥操作指令对待操作数据进行相应的智能密钥操作。
在本发明实施例中，步骤106中解析出接收到的SCSI指令中LUN域的值为1，则复合设备可以判断出该操作指令是智能密钥操作指令中的签名指令，然后接收待签名数据，并对待签名数据进行数字签名操作。
步骤109. 复合设备将操作指令的执行结果返回给主机，结束。
在复合设备将操作指令的执行结果返回给主机之前，主机还可以向复合设备下发获取签名结果的指令；
如，主机可以向复合设备发送特殊的读数据指令或预定的扩展SCSI指令；
复合设备将操作指令的执行结果按SCSI协议封装后返回给主机。
在本发明实施例中，主机向复合设备下发的获取签名结果指令如下所示：
0x55 53 42 43 28 9b a5 85 00 08 00 00 80 00 0a 28 01 00 00 a0 e8 00 00 a4 00 00 00 00 00 00 00
复合设备接收到该指令后将数字签名的结果按SCSI协议封装后返回给主机。
在本发明实施例中，复合设备中的智能密钥功能至少包括数字签名、身份认证、数据加/解密等功能中的至少一个功能；
例如，若复设备响应主机的GET-MAX-LUN命令时所返回的LUN值为4；
则相应地，当SCSI指令中的LUN值为0时，该指令为数据读/写指令；当LUN值为1时，该指令为签名指令；当LUN值为2时，该指令为数据加密指令；当LUN值为3时，该指令还可以为数据解密指令；当LUN值为4时，该指令为身份认证指令；
相应地，复合设备实现身份认证、数据加/解密等功能的方法，可以参照上述的实现数据字签名功能的方法。
其中，数据加/解密使用的方法包括自定义算法加密和标准算法加密；
标准加密算法包括：RSA、DES、3DES、MD5、SHA-1、SSF33、AES、ECC、RC、PGP、BASE64算法；
自定义的算法加密中使用的方法为用户自定义的算法。
本发明的有益效果从以上技术方案可以看出，本发明实施例1所提供的设备在接入操作系统后表现为一个或多个海量存储设备，在海量存储设备的基础上，还实现了智能密钥设备的功能，所占有的优势是：
1.使用方便，用户只需要一个设备就可以满足存储和智能密钥相关功能；
2.解决智能密钥设备存储空间小的问题，智能密钥设备一般因为安全和成本的原因，存储空间往往比普通存储设备小得多；
3.解决存储设备的安全性问题，存储设备存储的数据往往容易获取，通过本发明提供的技术方案可以存储的数据进行加密，以保护数据安全。
4. 完全兼容现在有各种操作系统提供的接口。
实施例二
本发明的目的是提供一种复合型usb设备的实现方法。解决了将存储设备和智能密钥设备集成到一个设备中的问题，复合设备中的存储设备的功能和智能密钥设备的功能是通过一个微处理器或多个微处理器芯片来实现的；参见图2，实现的步骤具体如下：
步骤201.复合设备与主机连接，声明设备类型为大容量存储设备；
复合设备通过usb接口连接到主机，主机向复合设备发送usb枚举命令，以获取复合设备的类型；
复合设备接收到主机下发的的枚举命令后，向主机报告其为大容量存储设备，并且支持SCSI协议的接口标准。
步骤202.主机获取复合设备的逻辑单元个数；
具体地，主机向复合设备发送的获取LUN的命令为GET_MAX_LUN命令，复合设备向主机返回预先约定的LUN值，LUN的取值为0至15。
在本发明实施例中，复合设备返回给主机的LUN值为0，表示该复合设备只有一个逻辑单元。
步骤203.主机获取复合设备的具体信息；
主机向复合设备中的各个逻辑单元（LUN从0到最大）下发INQUIRY命令，查询设备具体信息；每个逻辑单元被认为是单独的存储设备，响应INQUIRY命令，报告每个存储设备的特性。
复合设备收到主机下发的INQUIRY命令后，向主机发送字符集描述(unicode)，包括生产厂商、产品描述、型号等信息；
在字符集描述中包含有该大容量存储设备的具体类型，包括磁盘、光盘等。
本发明实施例中，复合设备向主机声明自身为磁盘设备。
步骤204.主机加载该复合设备的驱动程序。
主机根据上述步骤中复合设备的应答信息，选择设备通信的接口，加载设备驱动程序。
步骤205.主机中生成操作指令，下发给复合设备；
主机与复合设备通信过程中收发的指令是按照SCSI接口协议的规范进行封装的。
在主机中，如果主机是要对复合设备进行数据的读取或写入操作，则按照SCSI协议的标准生成数据读/写操作指令，然后将操作指令下发给复合设备；
如果主机要使用复合设备的智能密钥功能，则主机根据预先约定的规则生成操作指令，然后将操作指令下发给复合设备。
其中，复合设备的智能密钥功能包括：数字签名、数据加/解密、身份认证等；
具体地，当主机使用复合设备的智能密钥功能时，下发的操作指令为访问磁盘中特定位置的SCSI指令；
磁盘中特定位置包括，磁盘中的特定文件，磁盘中特定扇区等；
该特定文件或特定扇区为复合设备中预先约定的。
例如，主机向复合设备下发的签名指令序列如下所示：
0x55 53 42 43 28 9b a5 85 00 08 00 00 00 00 0a 2a 00 aa aa aa aa 00 00 a4 00 00 00 00 00 00 00
上述指令序列中，主机通过一个特殊的LBA地址0xaa aa aa aa，表示了该SCSI指令是签名指令；
主机下发上述指令序列后，将待签名数据按SCSI协议发送给复合设备。
步骤206.复合设备接收到操作指令，并对接收到的操作指令进行分析，判断其是否是数据读/写操作指令；
若判断出该操作指令是数据读/写操作指令，则执行步骤207，否则该操作指令为智能密钥操作指令，执行步骤208。
复合设备判断接收到的操作指令是否是数据读/写操作指令的方法为：
复合设备解析并判断接收到的操作指令是否是访问磁盘中特定文件或特定扇区或文件的操作指令，如果是，则该操作指令为智能密钥操作指令，否则该操作指令是数据读/写操作指令。
具体地，本发明实施例中，复合设备根据接收到的操作指令中的LBA地址为0xaa aa aa aa，可以判断出该操作指令为签名指令；
复合设备判断出该指令为签名指令后接收主机下发的待签名数据。
步骤207.复合设备执行数据读/写操作指令，并向主机返回指令执行结果；
在本发明实施例中，在步骤206中判断出接收到的SCSI指令是读/写操作指令，此时复合设备执行该SCSI指令进行数据的读/写操作；然后将指令的执行结果（读取到的数据或写入数据成功的信息）返回给主机。
步骤208.复合设备执行接收到的SCSI指令，进行智能密钥操作；
复合设备判断接收到的SCSI指令为智能密钥操作指令后，根据该SCSI指令执行相应的智能密钥操作，进行数字签名、数据加/解密或身份认证等智能密钥操作。
在本发明实施例中，步骤206中判断出接收到的SCSI指令为签名指令后，对指令中传入的待签名数据进行数字签名操作。
步骤209. 复合设备将操作指令的执行结果返回给主机，结束。
在复合设备将操作指令的执行结果返回给主机之前，主机还可能向复合设备下发获取签名结果的指令；
在本发明实施例中，主机向复合设备下发的获取签名结果指令如下所示：
0x55 53 42 43 28 9b a5 85 00 08 00 00 80 00 0a 28 01 aa aa aa aa 00 00 a4 00 00 00 00 00 00 00
复合设备接收到获取签名结果的指令后，将智能密钥操作指令的执行结果按SCSI协议封装后返回给主机。
在本发明实施例中，复合设备中的智能密钥功能至少包括数字签名、身份认证、数据加/解密等功能中的至少一个功能；
例如，可以通过不同的特殊的LBA地址对智能密钥操作类型加以区分。
数据加/解密使用的方法包括自定义算法加密和标准算法加密；
标准加密算法包括：RSA、DES、3DES、MD5、SHA-1、SSF33、AES、ECC、RC、PGP、BASE64算法；
自定义的算法加密中使用的方法为用户自定义的算法。
本发明的有益效果从以上技术方案可以看出，本发明实施例二所提供的设备在接入操作系统后表现为一个海量存储设备，在海量存储设备的基础上，还实现了智能密钥设备的功能，所占有的优势是：
1.使用方便，用户只需要一个设备就可以满足存储和智能密钥相关功能；
2.解决智能密钥设备存储空间小的问题，智能密钥设备一般因为安全和成本的原因，存储空间往往比普通存储设备小得多；
3.解决存储设备的安全性问题，存储设备存储的数据往往容易获取，通过本发明提供的技术方案可以存储的数据进行加密，以保护数据安全；
4. 完全兼容现在有各种操作系统提供的接口。
实施例三
本发明的目的是提供一种复合型usb设备的实现方法。解决了将存储设备和智能密钥设备集成到一个设备中的问题，复合设备中的存储设备的功能和智能密钥设备的功能是通过一个微处理器或多个微处理器芯片来实现的；参见图3，实现的步骤具体如下：
步骤301.复合设备与主机连接，声明设备类型为大容量存储设备；
复合设备通过usb接口连接到主机，主机向复合设备发送usb枚举命令，以获取复合设备的类型；
复合设备接收到主机下发的的枚举命令后，向主机报告其为大容量存储设备，并且支持SCSI协议的接口标准。
步骤302.主机获取复合设备的逻辑单元个数；
具体地，主机向复合设备发送的获取LUN的命令为GET_MAX_LUN命令，复合设备向主机返回预先约定的LUN值，LUN的取值为0至15。
在本发明实施例中，复合设备返回给主机的LUN值为0，表示该复合设备只有一个逻辑单元。
步骤303.主机获取复合设备的具体信息；
主机向复合设备中的各个逻辑单元（LUN从0到最大）下发INQUIRY命令，查询设备具体信息；每个逻辑单元被认为是单独的存储设备，响应INQUIRY命令，报告每个存储设备的特性。
复合设备收到主机下发的INQUIRY命令后，向主机发送字符集描述(unicode)，包括生产厂商、产品描述、型号等信息；
在字符集描述中包含有该大容量存储设备的具体类型，包括磁盘、光盘等。
本发明实施例中，复合设备向主机声明自身为磁盘设备。
步骤304.主机加载该复合设备的驱动程序。
主机根据上述步骤中复合设备的应答信息，选择设备通信的接口，加载设备驱动程序。
步骤305.主机中生成操作指令，下发给复合设备；
主机与复合设备通信过程中收发的指令是按照SCSI接口协议的规范进行封装的。
在主机中，如果主机是要对复合设备进行数据的读取或写入操作，则按照SCSI协议的标准生成标准的数据读/写操作指令，然后将操作指令下发给复合设备；
如果主机要使用复合设备的智能密钥功能，则主机根据预先约定的规则生成操作指令，然后将操作指令下发给复合设备。
其中，复合设备的智能密钥功能包括：数字签名、数据加/解密、身份认证等；
具体地，在本实施例中，当主机使用复合设备的智能密钥功能时，下发的操作指令为扩展SCSI指令；
所谓扩展SCSI指令，是在SCSI指令序列中使用了在标准的SCSI协议中没有使用的操作码（即在标准的SCSI协议中没有规定该操作码的用法及意义），主机通过预先约定的扩展SCSI指令控制复合设备进行多种类型的智能密钥操作。
例如，主机向复合设备下发的签名指令序列如下所示：
0x55 53 42 43 28 9b a5 85 00 08 00 00 00 00 0a ee 0e 34 00 4a 00 00 00 a4 00 00 00 00 00 00 00
在上述指令序列中，0x0a之后的10个字节中，第一个字节操作码0xee在标准SCSI协议中没有被使用，这表示这条SCSI指令是扩展SCSI指令，操作码之后的其余9个字节的值可以是预先约定的值或随机数；
主机下发上述指令序列后，将待签名数据按SCSI协议发送给复合设备。
另外，若该复设备还同时拥有除数字签名功能以外的其它智能密钥功能，如数据加密等，则主机生成智能密钥操作指令时可以使用不同的操作码，或是使用操作码后的9个字节数据来约定不同的智能密钥操作类型。
步骤306.复合设备接收操作指令，并对接收到的操作指令进行分析，判断其是否是数据读/写操作指令；
若判断出该操作指令是数据读/写操作指令，则执行步骤307，否则该操作指令为智能密钥操作指令，执行步骤308。
复合设备判断接收到的操作指令是否是数据读/写操作指令的方法为：
复合设备根据接收到的操作指令中的操作码判断该操作指令是否是扩展SCSI指令，如果是，则该操作指令为智能密钥操作指令，否则该操作指令是数据读/写操作指令。
具体地，本发明实施例中，复合设备根据接收到的SCSI操作指令中的操作码0xee判断出该操作指令是扩展SCSI指令，于是可知该操作指令为签名指令；
复合设备判断出该指令为签名指令后接收主机下发的待签名数据。
步骤307.复合设备执行数据读/写操作指令，并向主机返回指令执行结果；
在本发明实施例中，在步骤306中判断出接收到的操作指令是标准SCSI指令中的数据读/写操作指令，此时复合设备执行该操作指令进行数据的读/写操作；然后将指令的执行结果（读取到的数据或写入数据成功的信息）返回给主机。
步骤308.复合设备执行接收到的扩展SCSI指令，进行智能密钥操作；
复合设备判断接收到的操作指令为扩展SCSI指令后，根据该扩展SCSI指令执行相应的智能密钥操作，进行数字签名、数据加/解密或身份认证等智能密钥操作。
在本发明实施例中，步骤306中判断出接收到的操作指令为签名指令后，对指令中传入的待签名数据进行数字签名操作。
步骤309. 复合设备将操作指令的执行结果返回给主机，结束。
在复合设备将操作指令的执行结果返回给主机之前，主机还可能向复合设备下发获取签名结果的指令；
在本发明实施例中，主机向复合设备下发的获取签名结果指令如下所示：
0x55 53 42 43 28 9b a5 85 00 08 00 00 80 00 0a dd 00 00 00 00 00 00 00 a4 00 00 00 00 00 00 00
在该扩展SCSI指令序列中，操作码0xdd表示该操作指令为获取签名结果指令；
或者，主机对之前下发的签名指令进行修改，将签名指令的第13个字节由0x00改为0x80，该操作指令表示复合设备需要向主机返回数据，即签名结果，该获取签名结果指令如下所示：
0x55 53 42 43 28 9b a5 85 00 08 00 00 80 00 0a ee 0e 34 00 4a 00 00 00 a4 00 00 00 00 00 00 00
另外，还可以使用操作码之后的9个字节来表示该扩展SCSI指令为区别于签名指令的获取签名结果指令，相应地，获取签名结果指令还可以是下面这样一种形式：
0x55 53 42 43 28 9b a5 85 00 08 00 00 80 00 0a ee 0e 34 00 4a 00 00 00 a4 00 00 00 00 00 00 00
复合设备接收到获取签名结果的指令后，将智能密钥操作指令的执行结果按SCSI协议封装后返回给主机。
在本发明实施例中，复合设备中的智能密钥功能至少包括数字签名、身份认证、数据加/解密等功能中的至少一个功能；
数据加/解密使用的方法包括自定义算法加密和标准算法加密；
标准加密算法包括：RSA、DES、3DES、MD5、SHA-1、SSF33、AES、ECC、RC、PGP、BASE64算法；
自定义的算法加密中使用的方法为用户自定义的算法。
本发明的有益效果从以上技术方案可以看出，本发明实施例三所提供的设备在接入操作系统后表现为一个海量存储设备，在海量存储设备的基础上，还实现了智能密钥设备的功能，所占有的优势是：
1.使用方便，用户只需要一个设备就可以满足存储和智能密钥相关功能；
2.解决智能密钥设备存储空间小的问题，智能密钥设备一般因为安全和成本的原因，存储空间往往比普通存储设备小得多；
3.解决存储设备的安全性问题，存储设备存储的数据往往容易获取，通过本发明提供的技术方案可以存储的数据进行加密，以保护数据安全；
4. 完全兼容现在有各种操作系统提供的接口。
实施例四
本发明的目的是提供一种复合型usb设备的实现方法。解决了将存储设备和智能密钥设备集成到一个设备中的问题，复合设备中的存储设备的功能和智能密钥设备的功能是通过一个微处理器或多个微处理器芯片来实现的；参见图3，实现的步骤具体如下：
步骤401.复合设备与主机建立连接，报告设备信息及设备类型；
复合设备通过usb接口连接到主机，主机向复合设备发送usb枚举命令，以获取复合设备的类型；
复合设备接收到主机下发的枚举命令后，向主机报告其为一个支持SCSI协议接口标准的大容量存储设备和一个HID设备；
或者，
复合设备声明自身设备类型为SCSI协议的大容量存储设备与一个CCID（usb Chip/Smart Card Interface Devices，usb芯片智能卡接口设备）设备。
在本发明实施例中，大容量存储设备可以包含有1个或1个以上至16个逻辑单元，每个逻辑单元的设备类型既可以是磁盘也可以是光盘。
步骤402.主机加载该复合设备的驱动程序。
主机根据复合设备的应答信息，选择相应的设备通信的接口协议，加载设备驱动程序。
步骤403.主机中生成操作指令，下发给复合设备；
如果主机是要对复合设备进行数据的读取或写入操作，则按照SCSI协议的标准生成数据读/写操作指令，然后通过批量传输管道下发给复合设备；
如果主机要使用复合设备的智能密钥功能，则主机调用PCSC接口生成符合7816协议标准的APDU（Application Protocol Data Unit，应用协议数据单元）指令，并按HID协议对APDU指令进行封装，然后通过控制传输管道下发给复合设备；
或者，
如果主机要使用复合设备的智能密钥功能，则主机调用PCSC接口生成符合7816协议标准的APDU指令，并按CCID协议对APDU指令进行封装，然后通过批量传输管道下发给复合设备。
其中，复合设备的智能密钥功能包括：数字签名、数据加/解密、身份认证等。
例如，主机调用PCSC接口生成一条APDU指令，该指令为取随机数指令：
0x00 84 00 00 08
然后，主机使用CCID协议中规定的指令头对接收到的数据进行封装，指令头为：
0x6f 05 00 00 00 00 10 00 00 00
封装后得到指令为：
0x6f 05 00 00 00 00 10 00 00 00 00 84 00 00 08
步骤404.复合设备接收到操作指令，并对接收到的操作指令进行分析，判断其是否是数据读/写操作指令；
若判断出该操作指令是数据读/写操作指令，则执行步骤405，否则该操作指令为智能密钥操作指令，执行步骤406。
具体地，复合设备判断接收到的操作指令是否是数据读/写操作指令的方法为：
复合设备判断接收到的操作指令是否是按照SCSI协议规范封装的，如果是，则该操作指令为SCSI协议的数据读/写操作指令，否则该操作指令是按照HID协议或CCID协议封装的智能密钥操作指令；
或者，
当复合设备声明设备类型为HID设备与SCSI协议的大容量存储设备时，复合设备判断接收到的操作指令是否是通过控制传输管道传入的，如果是，则该操作指令为HID协议封装的智能密钥操作指令，否则该操作指令是SCSI协议的数据读/写操作指令。
步骤405.复合设备执行数据读/写操作指令，并向主机返回指令执行结果；
在本发明实施例中，在步骤404中判断出接收到的操作指令是读/写操作指令，此时复合设备执行该SCSI指令进行数据的读/写操作；然后将指令的执行结果（读取到的数据或写入数据成功的信息）返回给主机。
步骤406.复合设备执行接收到的智能密钥操作指令，进行智能密钥操作；
复合设备判断接收到的操作指令为智能密钥操作指令后，解析该操作指令并执行相应的智能密钥操作，进行数字签名、数据加/解密或身份认证等操作。
例如，复合设备对接收到的CCID指令0x6f 05 00 00 00 00 10 00 00 00 00 84 00 00 08进行解析，得到APDU指令0x00 84 00 00 08后，复合设备根据该APDU指令执行取随机数的操作。
步骤407. 复合设备将操作指令的执行结果返回给主机，结束。
复合设备将智能密钥操作指令的执行结果按HID协议封装后通过中断传输管道返回给主机；
或者，
复合设备将智能密钥操作指令的执行结果按CCID协议封装后通过批量传输管道返回给主机。
在本发明实施例中，复合设备中的智能密钥功能至少包括数字签名、身份认证、数据加/解密等功能中的至少一个功能。
本发明的有益效果从以上技术方案可以看出，本发明实施例四所提供的设备在接入操作系统后表现为一个海量存储设备和一个HID设备，或者表现为一个海量存储设备和一个CCID设备，所占有的优势是：
1.可以方便的通过计算机访问复合设备，设备管理方便，完全兼容现在有各种操作系统提供的接口；
2.使用方便，用户只需要一个设备就可以满足存储和智能密钥相关功能；
3.解决智能密钥设备存储空间小的问题，智能密钥设备一般因为安全和成本的原因，存储空间往往比普通存储设备小得多；
4.解决存储设备的安全性问题，存储设备存储的数据往往容易获取，通过本发明实施例提供的技术方案可以存储的数据进行加密，以保护数据安全。
实施例五
本发明实施例提供一种usb接口的复合设备。该复合设备将存储设备和智能密钥设备集成到一个设备中，该复合设备中的存储的功能和智能密钥的功能可以是通过一个微处理器或多个微处理器芯片来实现的。
如图5所示，本发明实施例提供的复合型usb设备500包括：usb接口模块501、指令判断模块502、数据存储模块503和智能密钥模块504。
usb接口模块501，用于复合型usb设备500与主机建立连接，进行基于usb协议的数据解析/封装及通信；
指令判断模块502，用于判断usb接口模块501解析usb数据包得到的操作指令是标准的SCSI数据读/写指令还是智能密钥操作指令，然后将标准的SCSI数据读/写操作指令发送给数据存储模块503，将智能密钥操作指令发送给智能密钥模块504；
数据存储模块503，用于存储数据，并执行数据读/写操作；
智能密钥模块504，用于根据智能密钥操作指令执行相应的智能密钥操作。
其中，智能密钥操作包括：数字签名和/或身份认证和/或数据加/解密等；
相应地，智能密钥模块包括：数字签名单元504A、身份认证单元504B、数据加/解密单元504C；
数字签名单元504A，用于根据智能密钥操作指令中的签名指令对传入的数据进行数据签名操作；
身份认证单元504B，用于根据智能密钥操作指令中的身份认证指令进行身份认证操作；
数据加/解密单元504C，用于根据智能密钥操作指令中的数据加/解密指令，对传入的数据进行加/密操作，然后将加/密操作后的密文/明文返回给主机或发送到数据存储模块503进行存储；数据加/解密单元504C还用于对从存储模块503读出数据的数据进行加/解密操作，然后将加/密操作后的密文/明文返回给主机。
复合型usb设备500通过usb接口模块501与主机建立连接，向主机声明其自身为预定个数的大容量存储设备；usb接口模块501接收到主机下发的usb数据包，对接收到的usb数据包进行解析后得到操作指令，指令判断模块502判断该操作指令是否是智能密钥操作指令，若是智能密钥操作指令，则由智能密钥模块504根据该智能密钥操作执行相应的智能密钥操作，否则将解析后的数据包转给数据存储模块503，由数据存储模块503执行数据读/写操作。
复合型usb设备500还可以进行加密存储，usb接口模块501接收到主机下发的数据读取指令后，数据存储模块503执行该数据读取指令读取数据的密文，智能密钥模块504中的数据加/解密单元504C对读取出的密文进行解密操作，然后通过usb接口模块501将数据的明文发送给主机。
本发明实施例提供了一种复合型usb设备，该复合型usb设备既具有U盘的存储功能又具有usbkey的智能密钥功能，该复合型usb设备还使用现有的接口技术，对现有主机系统不需要进行修改，有着良好的便携性和易用性。
实施例六
在本发明实施例六中，提供了一种复合型usb设备，该复合型usb设备既具有U盘的存储功能又具有usbkey的智能密钥功能。如图6所示，该复合型usb设备中包括：usb_Hub芯片、usbkey芯片、U盘芯片、NAND-Flash芯片。
其中，usb-Hub芯片分别与Host（主机）、usbkey芯片、U盘芯片连接；
usbkey芯片用于实现数据的加密、解密、数字签名等智能密钥功能，通过usb-Hub芯片与主机进行usb协议的数据通信；
U盘芯片还与NAND-Flash芯片相连接，U盘芯片用于控制大容量闪存芯片NAND-Flash芯片执行写数据、读数据等操作。
具体地，usbkey芯片中包括第一usb接口单元、数据运算单元、密钥存储单元，U盘芯片中包括第二usb接口单元、数据读写单元、第一总线接口单元，NAND-Flash芯片包括Flash存储单元和第二总线接口单元；
第一usb接口单元，用于按照usb协议对数据进行解析或封装，并以usb协议通过usb-Hub芯片与主机进行数据通信；
数据运算单元，用于根据接收到的操作指令，从密钥存储单元中读取密钥，执行操作指令中所指示的数据加/解密、数字签名等智能密钥功能；
密钥存储单元，用于存储用户的密钥；
第二usb接口单元，用于按照usb协议对数据进行解析或封装，并以usb协议通过usb-Hub芯片与主机进行数据通信；
数据读写单元，用于根据接收到的读/写数据的操作指令，向NAND-Flash芯片中的Flash存储单元发送指令，执行读/写数据的操作；
第一总线接口单元，用于与NAND-Flash芯片中第二总线接口单元连接，按照总线接口协议的规范与NAND-Flash芯片进行通信；
Flash存储单元，用于存储数据，并执行U盘芯片发送的读/写数据指令，向U盘芯片返回读取的数据或指令的执行结果；
第二总线接口单元，用于与U盘芯片中的第一总线接口单元连接，按照总线接口协议的规范与U盘芯片进行通信。
实施例七
在本发明实施例七中，提供了一种复合型usb设备，该复合型usb设备既具有U盘的存储功能又具有usbkey的智能密钥功能。如图7所示，该复合型usb设备中包括：U盘控制芯片、usbkey芯片、NAND-Flash芯片。
其中，U盘控制芯片分别与Host（主机）、usbkey芯片、NAND-Flash芯片连接；
本实施例中的U盘控制芯片中集成了本发明实施例六中所述的U盘芯片的功能和usb-Hub芯片的功能，usbkey芯片通过U盘控制芯片与主机进行usb协议的数据通信；
usbkey芯片用于实现数据的加密、解密、数字签名等智能密钥功能，
U盘控制芯片还与NAND-Flash芯片相连接，控制NAND-Flash芯片执行写数据、读数据等操作。
具体地，U盘控制芯片中包括usb-Hub单元、第一usb接口单元、数据读写单元、第一总线接口单元，usbkey芯片中包括第二usb接口单元、数据运算单元、密钥存储单元， NAND-Flash芯片包括Flash存储单元和第二总线接口单元；
第一usb接口单元，用于按照usb协议对数据进行解析或封装，并以usb协议与主机进行数据通信；
数据读写单元，用于根据接收到的读/写数据的操作指令，向NAND-Flash芯片中的Flash存储单元发送指令，执行读/写数据的操作；
第一总线接口单元，用于与NAND-Flash芯片中第二总线接口单元连接，按照总线接口协议的规范与NAND-Flash芯片进行通信；
第二usb接口单元，用于按照usb协议对数据进行解析或封装，并以usb协议通过U盘控制芯片中的usb-Hub单元与主机进行数据通信；
数据运算单元，用于根据接收到的操作指令，从密钥存储单元中读取密钥，执行操作指令中所指示的数据加/解密、数字签名等智能密钥功能；
密钥存储单元，用于存储用户的密钥；
Flash存储单元，用于存储数据，并执行U盘控制芯片发送的读/写数据指令，向U盘控制芯片返回读取的数据或指令的执行结果；
第二总线接口单元，用于与U盘控制芯片中的第一总线接口单元连接，按照总线接口协议的规范与U盘控制芯片进行通信。
实施例八
在本发明实施例八中，提供了一种复合型usb设备电路图，该复合型usb设备既具有U盘的存储功能又具有usbkey的智能密钥功能。如图8所示，该复合型usb设备中包括：U盘控制芯片、usbkey芯片、NAND-Flash芯片。
其中，U盘控制芯片分别与Host（主机）、usbkey芯片、NAND-Flash芯片连接；
本实施例八提供的U盘控制芯片中集成了实施例六中的U盘芯片的功能，同时还集成了数据封装和解析的功能，与主机进行usb协议的数据通信，与usbkey芯片进行7816或spi协议的数据通信；
U盘控制芯片还用于控制与之相连的NAND-Flash芯片执行写数据、读数据等操作；
usbkey芯片用于实现数据的加密、解密、数字签名等智能密钥功能。
具体地，U盘控制芯片中包括usb接口单元、第一接口单元、数据读写单元、第一总线接口单元，usbkey芯片中包括第二接口单元、数据运算单元、密钥存储单元， NAND-Flash芯片包括Flash存储单元和第二总线接口单元；
usb接口单元，用于按照usb协议对主机下发的数据进行解析并发送给第一接口单元或数据读写单元，或者将第一接口单元或数据读写单元返回的数据按照usb协议封装后发送给主机；
第一接口单元，用于提供7816接口或SPI接口（Serial Peripheral Interface，串行外围接口），使U盘控制芯片与usbkey芯片进行数据交互；
数据读写单元，用于根据接收到的读/写数据的操作指令，向NAND-Flash芯片中的Flash存储单元发送指令，执行读/写数据的操作；
第一总线接口单元，用于与NAND-Flash芯片中第二总线接口单元连接，按照总线接口协议的规范与NAND-Flash芯片进行通信；
第二usb接口单元，用于按照usb协议对数据进行解析或封装，并以usb协议通过U盘控制芯片中的usb-Hub单元与主机进行数据通信；
数据运算单元，用于根据接收到的操作指令，从密钥存储单元中读取密钥，执行操作指令中所指示的数据加/解密、数字签名等智能密钥功能；
密钥存储单元，用于存储用户的密钥；
Flash存储单元，用于存储数据，并执行U盘控制芯片发送的读/写数据指令，向U盘控制芯片返回读取的数据或指令的执行结果；
第二总线接口单元，用于与U盘控制芯片中的第一总线接口单元连接，按照总线接口协议的规范与U盘控制芯片进行通信。
实施例九
在本发明实施例九中，提供了一种复合型usb设备，该复合型usb设备既具有U盘的存储功能又具有usbkey的智能密钥功能。如图9所示，该复合型usb设备中包括： usbkey芯片、SPI-Flash芯片。
其中， usbkey芯片分别与Host（主机）、SPI-Flash芯片连接；
usbkey芯片中集成了Flash读写控制功能和智能密钥功能，通过SPI接口（Serial Peripheral Interface，串行外围接口）控制SPI-Flash芯片执行写数据、读数据等操作。
SPI-Flash芯片是一种使用SPI接口的闪存芯片， 其容量一般小于NAND-Flash芯片。
具体地，usbkey芯片中包括usb接口单元、数据运算单元、密钥存储单元、数据读写单元、第一SPI接口单元， SPI-Flash芯片中包括Flash存储单元和第二SPI接口单元；
usb接口单元，用于按照usb协议对主机下发的数据进行解析并发送给第一SPI接口单元或数据读写单元，或者将第二SPI接口单元、数据读写单元返回的数据按照usb协议封装后发送给主机；
数据运算单元，用于根据接收到的操作指令，从密钥存储单元中读取密钥，执行操作指令中所指示的数据加/解密、数字签名等智能密钥功能；
密钥存储单元，用于存储用户的密钥；
数据读写单元，用于根据接收到的读/写数据的操作指令，向SPI-Flash芯片中的Flash存储单元发送指令，执行读/写数据的操作；
第一SPI接口单元，用于提供SPI接口（Serial Peripheral Interface，串行外围接口），按照SPI接口规范对数据进行封装或解析，使usbkey芯片与SPI-Flash芯片进行数据交互；
Flash存储单元，用于存储数据，并执行usbkey芯片的数据读写单元发送的读/写数据指令，向usbkey芯片返回读取的数据或指令的执行结果；
第二SPI接口单元，用于提供SPI接口（Serial Peripheral Interface，串行外围接口），按照SPI接口规范对数据进行封装或解析，使SPI-Flash芯片与usbkey芯片进行数据交互。
实施例十
在本发明实施例十中，提供了一种复合型usb设备，该复合型usb设备既具有U盘的存储功能又具有usbkey的智能密钥功能。如图10所示，该复合型usb设备中包括： usbkey芯片、NAND-Flash芯片。
其中， usbkey芯片分别与Host（主机）、NAND-Flash芯片连接；
usbkey芯片中集成了U盘芯片的功能，通过总线接口控制NAND-Flash芯片中的Flash存储单元执行写数据、读数据等操作。
具体地，usbkey芯片中包括usb接口单元、数据运算单元、密钥存储单元、数据读写单元、第一总线接口单元， NAND-Flash芯片中包括Flash存储单元和第二总线接口单元；
usb接口单元，用于按照usb协议对主机下发的数据进行解析并发送给第一总线接口单元或数据读写单元，或者将第二总线接口单元、数据读写单元返回的数据按照usb协议封装后发送给主机；
数据运算单元，用于根据接收到的操作指令，从密钥存储单元中读取密钥，执行操作指令中所指示的数据加/解密、数字签名等智能密钥功能；
密钥存储单元，用于存储用户的密钥；
数据读写单元，用于根据接收到的读/写数据的操作指令，向NAND -Flash芯片中的Flash存储单元发送指令，执行读/写数据的操作；
第一总线接口单元，用于与NAND-Flash芯片中第二总线接口单元连接，按照总线接口协议的规范与NAND-Flash芯片进行数据交互；
Flash存储单元，用于存储数据，并执行usbkey芯片的数据读写单元发送的读/写数据指令，向usbkey芯片返回读取的数据或指令的执行结果；
第二总线接口单元，用于与usbkey芯片中的第一总线接口单元连接，按照总线接口协议的规范与usbkey芯片进行数据交互。
本发明的有益效果从以上技术方案可以看出，本发明所提供的复合型usb设备在连接到主机后可以表现为多种类型的设备，同时具有海量存储设备的功能和智能密钥设备的功能，所占有的优势是：
1.使用方便，用户只需要一个设备就可以满足存储和智能密钥相关功能；
2.解决智能密钥设备存储空间小的问题，智能密钥设备一般因为安全和成本的原因，存储空间往往比普通存储设备小得多；
3.解决存储设备的安全性问题，存储设备存储的数据往往容易获取，通过一定的算法和API实现，可以利用智能密钥设备将存储设备进行加密，以保护数据安全；
4. 完全兼容现在有各种操作系统提供的接口。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种复合型usb设备的实现方法，其特征在于，包括：
    复合型usb设备与主机建立连接，声明其自身的设备类型；
    所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令；
    如果是，则执行所述操作指令中指示的智能密钥操作；
    否则，则执行数据读/写操作。
  2. 如权利要求1所述的复合型usb设备的实现方法，其特征在于，所述复合型usb设备与主机建立连接，声明其自身的设备类型的方法具体还包括：
    所述复合型usb设备声明其自身为预定个数的大容量存储设备。
  3. 如权利要求2所述的复合型usb设备的实现方法，其特征在于，所述大容量存储设备包括：光盘、磁盘。
  4. 如权利要求2所述的复合型usb设备的实现方法，其特征在于，所述主机下发的操作指令为按照SCSI协议规范封装的命令。
  5. 如权利要求4所述的复合型usb设备的实现方法，其特征在于，所述复合型usb设备判断所述操作指令是否是智能密钥操作指令的方法具体为：
    判断所述操作指令中指定域的值是否是约定值，如果是约定值，则所述操作指令是智能密钥操作指令，否则是数据读/写操作指令；或者
    判断所述操作指令中特殊域中指定位的值是否是约定值，如果是约定值，则所述操作指令是智能密钥操作指令，否则是数据读/写操作指令；或者
    判断所述操作指令是否是扩展SCSI指令，如果是扩展SCSI指令，则所述操作指令是智能密钥操作指令，否则是数据读/写操作指令。
  6. 如权利要求5所述的复合型usb设备的实现方法，其特征在于，
    所述操作指令中指定域具体为：所述操作指令中的LUN域、预留域或LBA域；
    所述操作指令中特殊域中指定位具体为： LUN域中特殊的位、预留域中特殊的位或其它域中的预留位。
  7. 如权利要求1所述的复合型usb设备的实现方法，其特征在于，所述复合型usb设备与主机建立连接，声明其自身的设备类型，所述方法还包括：
    所述复合型usb设备声明为1个HID设备和预定个数的大容量存储设备。
  8. 如权利要求7所述的复合型usb设备的实现方法，其特征在于，所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令的方法具体为：
    所述复合型usb设备解析并判断所述操作指令是否是按照SCSI协议规范封装的，如果是，则所述操作指令为数据读/写操作指令，否则所述操作指令是智能密钥操作指令；
    或者，
    所述复合型usb设备判断所述操作指令是否是通过usb控制传输管道传入的，如果是，则所述操作指令为智能密钥操作指令，否则所述操作指令是数据读/写操作指令。
  9. 如权利要求1所述的复合型usb设备的实现方法，其特征在于，所述复合型usb设备与主机建立连接，声明其自身的设备类型，所述方法还包括：
    所述复合型usb设备声明为1个CCID设备和预定个数的大容量存储设备。
  10. 如权利要求9所述的复合型usb设备的实现方法，其特征在于，所述复合型usb设备接收所述主机下发的操作指令，并判断所述操作指令是否是智能密钥操作指令的方法具体为：
    所述复合型usb设备解析并判断所述操作指令是否是按照SCSI协议规范封装的，如果是，则所述操作指令为数据读/写操作指令，否则所述操作指令是智能密钥操作指令。
  11. 如权利要求1所述的复合型usb设备的实现方法，其特征在于，所述智能密钥操作具体包括：
    数字签名、身份认证、数据加/解密。
  12. 一种复合型usb设备，其特征在于，所述设备包括：
    接口模块，用于复合型usb设备与主机建立连接，进行基于usb协议的数据解析/封装及通信；
    指令判断模块，用于判断所述接口模块解析usb数据包得到的操作指令是是标准的SCSI数据读/写操作指令还是智能密钥操作指令；
    数据存储模块，用于存储数据，当所述操作指令是所述标准的SCSI数据读/写操作指令时，执行所述操作指令进行数据读/写操作；
    智能密钥模块，用于当所述操作指令是所述智能密钥操作指令时执行相应的智能密钥操作。
  13. 如权利要求12所述的复合型usb设备，其特征在于，所述智能密钥模块还包括：
    数字签名单元，用于根据所述智能密钥操作指令中的签名指令对传入的数据进行数据签名操作。
  14. 如权利要求12所述的复合型usb设备，其特征在于，所述智能密钥模块还包括：
    身份认证单元，用于根据所述智能密钥操作指令中的身份认证指令进行身份认证操作。
  15. 如权利要求12所述的复合型usb设备，其特征在于，所述智能密钥模块还包括：
    数据加/解密单元，用于根据所述智能密钥操作指令中的数据加/解密指令，对传入/传出的数据进行加/密操作；
    所述数据加/解密单元，还用于对传入/传出所述数据存储模块的数据进行加/解密操作。
PCT/CN2010/075508 2010-05-26 2010-07-28 一种复合型usub设备及其实现方法 Ceased WO2011147116A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/989,671 US20120124380A1 (en) 2010-05-26 2010-07-28 Usb composite device and method therefor

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010191950A CN101872334A (zh) 2010-05-26 2010-05-26 一种复合型usb设备及其实现方法
CN201010191950.9 2010-05-26

Publications (1)

Publication Number Publication Date
WO2011147116A1 true WO2011147116A1 (zh) 2011-12-01

Family

ID=42997200

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/075508 Ceased WO2011147116A1 (zh) 2010-05-26 2010-07-28 一种复合型usub设备及其实现方法

Country Status (3)

Country Link
US (1) US20120124380A1 (zh)
CN (1) CN101872334A (zh)
WO (1) WO2011147116A1 (zh)

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101968723A (zh) * 2010-10-27 2011-02-09 四川和芯微电子股份有限公司 存储控制系统及存储控制方法
CN102222050A (zh) * 2011-05-23 2011-10-19 郑州信大捷安信息技术股份有限公司 高效数据处理和安全存储方法及安全智能密码存储芯片
CN103324587B (zh) * 2012-03-20 2016-08-03 安凯(广州)微电子技术有限公司 一种nandflash设备加解密实现方法及系统
CN103544037B (zh) * 2013-10-29 2016-08-17 飞天诚信科技股份有限公司 一种支持OpenSC的软硬件驱动的实现方法
CN104951417A (zh) * 2014-03-26 2015-09-30 北京同方微电子有限公司 一种实现适用于大容量usim的usb复合设备的方法
CN105094880A (zh) * 2014-05-23 2015-11-25 中兴通讯股份有限公司 通用串行总线的驱动方法、计算机及复合设备
CN104571962B (zh) * 2014-12-31 2017-11-17 上海动联信息技术股份有限公司 一种适合批量生产的usbkey设备内固件的实现方法
CN106339621B (zh) * 2015-07-17 2024-03-29 北京握奇智能科技有限公司 一种usb设备的数据处理方法、及该usb设备
CN106295372B (zh) * 2016-08-23 2019-01-01 记忆科技(深圳)有限公司 一种基于EMMC接口实现的加密Hub装置
CN106649175B (zh) * 2016-10-19 2019-12-06 深圳市共进电子股份有限公司 一种usb hub接口功能分离的方法
CN108108317B (zh) * 2017-12-29 2019-11-15 飞天诚信科技股份有限公司 一种实现用于苹果移动终端的多接口设备的方法和装置
CN109977050A (zh) * 2019-03-12 2019-07-05 福建升腾资讯有限公司 一种usb复合设备及其工作方法
CN111539040B (zh) * 2020-03-27 2022-03-15 郑州信大捷安信息技术股份有限公司 一种安全智能卡系统及其密码服务方法
CN112084524B (zh) * 2020-09-30 2023-10-13 北京智芯微电子科技有限公司 U盘访问方法及u盘
CN113204801B (zh) * 2021-05-20 2022-02-18 郑州信大捷安信息技术股份有限公司 基于安全芯片的安全环境构建方法及系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6862643B2 (en) * 2001-07-13 2005-03-01 Prolific Technology, Inc. USB compound device operates a plurality of devices by using the same USB logic circuit and the method for implementation thereof
CN101004660A (zh) * 2006-11-30 2007-07-25 北京飞天诚信科技有限公司 一种实现通用串行总线复合设备的方法
US7395366B1 (en) * 2002-09-27 2008-07-01 Cypress Semiconductor Corp. System, method, and apparatus for connecting USB peripherals at extended distances from a host computer

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6216199B1 (en) * 1999-08-04 2001-04-10 Lsi Logic Corporation Hardware mechanism for managing cache structures in a data storage system
CN2906747Y (zh) * 2006-04-29 2007-05-30 北京飞天诚信科技有限公司 带有数据存储和智能密钥的usb设备
CN1929379A (zh) * 2006-07-18 2007-03-14 菜艳 可对移动存储设备安全控制的智能密码钥匙及其工作方法
CN1912883A (zh) * 2006-08-01 2007-02-14 高玉华 电子媒体读物存读器
CN100501676C (zh) * 2006-11-02 2009-06-17 北京飞天诚信科技有限公司 提高智能密钥设备易用性的方法及其设备
US7921244B2 (en) * 2007-07-04 2011-04-05 Ours Technology, Inc. Data sharing and transfer systems and methods
CN101551784B (zh) * 2008-04-02 2011-04-13 西北工业大学 一种usb接口的ata类存储设备中数据的加密方法及装置
CN101266590B (zh) * 2008-04-22 2010-09-08 北京飞天诚信科技有限公司 动态切换设备配置的方法和系统
CN101587519B (zh) * 2008-05-21 2011-05-18 北京飞天诚信科技有限公司 一种实现多功能信息安全设备的系统及方法
CN101303674A (zh) * 2008-06-27 2008-11-12 彭增金 包含自身设备驱动程序的usb设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6862643B2 (en) * 2001-07-13 2005-03-01 Prolific Technology, Inc. USB compound device operates a plurality of devices by using the same USB logic circuit and the method for implementation thereof
US7395366B1 (en) * 2002-09-27 2008-07-01 Cypress Semiconductor Corp. System, method, and apparatus for connecting USB peripherals at extended distances from a host computer
CN101004660A (zh) * 2006-11-30 2007-07-25 北京飞天诚信科技有限公司 一种实现通用串行总线复合设备的方法

Also Published As

Publication number Publication date
US20120124380A1 (en) 2012-05-17
CN101872334A (zh) 2010-10-27

Similar Documents

Publication Publication Date Title
WO2011147116A1 (zh) 一种复合型usub设备及其实现方法
WO2018082482A1 (zh) 一种网络共享方法、接入网络方法及系统
WO2011076035A1 (zh) 一种实现多卡槽访问的方法和装置
WO2011134208A1 (zh) 一种基于时钟的安全装置的软件保护方法及安全装置
WO2021025482A1 (en) Electronic device and method for generating attestation certificate based on fused key
WO2015163735A1 (en) Mobile device and method of sharing content
WO2020197221A1 (ko) 통신 방법 및 통신 디바이스
WO2020105892A1 (ko) 디바이스가 디지털 키를 공유하는 방법
WO2015061992A1 (zh) 一种密钥配置方法、系统和装置
WO2016186241A1 (ko) 데이터 암호화 장치 및 방법과 및 데이터 복호화 장치 및 방법
WO2019216739A1 (en) Security protection method and apparatus in wireless communication system
WO2014042332A1 (en) Image forming apparatus, driving method thereof, and computer-readable recording medium
WO2021045463A1 (en) Electronic device and authentication method of electronic device
WO2015061941A1 (zh) 一种密钥配置方法和装置
WO2011079753A1 (zh) 认证方法、认证交易系统和认证装置
WO2013075546A1 (zh) 一种USB Key及其与终端进行通信的方法
WO2020122593A1 (en) Electronic device for attenuating at least part of signal received by antenna and method for controlling communication signal
WO2018076875A1 (zh) 备份数据的同步方法、装置、存储介质、电子设备及服务器
WO2020141773A1 (ko) 출입 관리 시스템 및 이를 이용한 출입 관리 방법
WO2019000466A1 (zh) 人脸识别方法、装置、存储介质及电子设备
WO2021256843A1 (ko) 동형 암호문에 대한 통계 연산 수행하는 장치 및 방법
WO2022173245A2 (ko) 초광대역통신을 이용한 결제 방법 및 장치
WO2016108407A1 (ko) 주석 제공 방법 및 장치
WO2011097794A1 (zh) Sd卡的分区处理方法及装置、sd卡、终端设备
WO2019143081A1 (ko) 데이터 통신을 제어하는 방법 및 전자 장치

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 12989671

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10851988

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10851988

Country of ref document: EP

Kind code of ref document: A1