WO2024045909A1 - 可内置独立数据的存储设备 - Google Patents

可内置独立数据的存储设备 Download PDF

Info

Publication number
WO2024045909A1
WO2024045909A1 PCT/CN2023/106778 CN2023106778W WO2024045909A1 WO 2024045909 A1 WO2024045909 A1 WO 2024045909A1 CN 2023106778 W CN2023106778 W CN 2023106778W WO 2024045909 A1 WO2024045909 A1 WO 2024045909A1
Authority
WO
WIPO (PCT)
Prior art keywords
storage device
host
built
layer
data
Prior art date
Application number
PCT/CN2023/106778
Other languages
English (en)
French (fr)
Inventor
向家强
王若海
王颖学
孙舒
Original Assignee
武汉攀升鼎承科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 武汉攀升鼎承科技有限公司 filed Critical 武汉攀升鼎承科技有限公司
Publication of WO2024045909A1 publication Critical patent/WO2024045909A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0602—Interfaces specially adapted for storage systems specifically adapted to achieve a particular effect
    • G06F3/062—Securing storage systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0629—Configuration or reconfiguration of storage systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0628—Interfaces specially adapted for storage systems making use of a particular technique
    • G06F3/0653—Monitoring storage devices or systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers
    • G06F3/0601—Interfaces specially adapted for storage systems
    • G06F3/0668—Interfaces specially adapted for storage systems adopting a particular infrastructure
    • G06F3/0671—In-line storage system
    • G06F3/0673—Single storage device
    • G06F3/0679—Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]

Definitions

  • the present invention relates to the technical field of independent data storage devices, and in particular, to a storage device capable of built-in independent data.
  • the data backup devices currently used are generally external mobile hard drives or storage devices, which need to be connected to the host when used. They can be plugged in and out at will when not in use. This process involves the risk of data leakage or device loss.
  • this type of external storage system can effectively perform data backup, after being separated from the host, it requires separate power supply and hard disk installation, which results in low system availability.
  • the Chinese invention patent titled "Secure USB flash drive system supporting multi-user data protection” discloses a secure USB flash drive system, including: a host computer Execution subsystem and embedded execution subsystem; among them, the host computer execution subsystem includes: status monitor, login window, log manager, user manager, destruction control switch, file operator, log generator, operation permission filter , special file system and SCSI protocol generator, the executable program of the host computer execution subsystem is saved in the program area of the secure USB flash drive; the embedded execution subsystem includes: SCSI protocol parser, login authentication, status responder, login lock, Destruction control, user management, fast access memory, audit management, hard algorithm encryptor, user information library, key library, program area, data area and log area, the executable target code is solidified in the main control chip inside the secure USB disk .
  • the secure USB flash drive system proposed in the above technical solution can achieve multi-user data security, it cannot protect individual user data.
  • the purpose of the present invention is to provide an integrated storage device capable of realizing data security, integrated power supply and centralized storage and capable of built-in independent data.
  • the present invention provides a storage device that can have built-in independent data.
  • the storage device is composed of hardware and software; the software includes an underlying system, a permission control layer, an application layer and a front-end UI;
  • the permission control layer includes a presentation layer, a business layer, a data layer and a network layer; the network layer can be data flow-oriented and can transmit and interact with data through a virtual network; the data layer is used to secure user data. Storage and data disaster backup;
  • the network layer includes a virtual network, SMB, firewall, and login logs.
  • the data layer includes storage procedures, recycle bins, snapshots, and operation logs.
  • the virtual network can configure the storage device, and is mainly configured to store host files.
  • the folder is added to the storage device, and the folder and the data in the folder are automatically uploaded to the storage device in real time through a private protocol.
  • the middle-end service monitors the folder and decides independently whether a snapshot is needed.
  • the files in the recycle bin Stored for a certain period of time by default;
  • the front-end UI includes Html, CSS, jQuery and multi-platform applications.
  • the display layer includes module engine rendering, POST requests and Get requests.
  • the display layer and the front-end UI realize the communication between the system and the user through corresponding web means. human-computer interaction;
  • the business layer is used to configure and record corresponding permissions, including content management, user management, system settings, trigger management and system logs;
  • the application layer provides middle-end services for the system, including private sync, virtual network, perception service, and authentication service.
  • the middle-end service is used to connect the software system and the host and can use the middle-end service.
  • the platform service accesses the software system; the underlying system provides a running environment for the software system, and the running environment is lightweight Linux.
  • the hardware includes a main control chip, a storage chip and a NAND flash memory, and the storage device adopts the nvme protocol; the storage device is provided with an interface that matches the built-in interface on the host motherboard, and the type of the interface is One of pcie interface, built-in USB and m.2nvme interface.
  • a middle-end service controller and a storage controller are integrated on the front of the storage device to provide communication for the storage device and monitor the operating status of the storage device.
  • the memory chip is disposed on the back of the storage device, and a power supply module is provided at the rear of the front of the storage device for providing power to the storage device when the host does not power the storage device.
  • the storage device is also provided with a micro switch, and the micro switch can monitor changes in the storage device and the connection status between the storage device and the host.
  • the storage device is accessed through the following steps: first, the host is connected to the storage device, and the background service installed in the host and the middle-end service in the storage device are used to access all the data.
  • Configure the storage device After the initial configuration is successful, the user enters the login user and password. After the login user and password are correctly entered, an authorization key is generated, the storage device is encrypted and authenticated, and the authorization key is used. Be able to edit and modify the files stored in the storage device; during the login process, if the login user and password entered are incorrect, they can be entered again. When the number of incorrect entries exceeds 3 times, the system will automatically lock 3 to 5 minutes, and send a login failure email to the user or remind the user in other ways.
  • the power supply module is provided with a four-pin power supply interface, and the four-pin power supply interface can be connected to the corresponding interface on the host through a conversion line to realize power supply.
  • the storage device is also provided with a micro switch for monitoring whether the storage device is detached from the host.
  • the host will push the message after it is started, and needs to be pushed again. Enter the authorization key for decryption, and only after passing the authentication can you start the service and access the storage device.
  • the storage device cannot access, read, and modify data by default. If the user needs to restore the data in the storage device, he needs to enter the web configuration interface again for authorization, enter the authorization key, and open Sharing service of the storage device.
  • the host pushes messages about abnormal communication and operation of the storage device through Windows barrage to ensure that the host and the storage device Communication between devices is stable and data transmission is timely.
  • the data recovery process also limits the configured opening time. After a certain period of time, the sharing service is automatically closed.
  • the storage device provided by the present invention that can have built-in independent data has the following beneficial effects:
  • the storage device provided by the present invention that can have built-in independent data.
  • the software is set to include the underlying system, the permission control layer, the application layer and the front-end UI, and different levels of data are set up in the storage device.
  • the functional layer uses each layer to execute corresponding instructions during the operation of the storage device, effectively ensuring data security.
  • the middle-end service can also be used to access the device and monitor the operating status of the device, so that after the device is connected to the host, Not being detected by the system ensures the security of the device and enables data independence of the data storage device.
  • the host system is reset and the host hard disk is replaced, the data in the storage device will not be affected. You only need to reinstall the host service for authentication to obtain the data in the storage device.
  • the hardware is set to include a main control chip, a storage chip and a NAND flash memory, and at the same time, the storage device is provided with the built-in memory on the host motherboard.
  • the interface matches the interface, and a power supply module is set at the end of the storage device, and a micro switch is set on the storage device.
  • the micro switch can trigger the work of the power supply module and use the data line to enable power supply.
  • the power supply interface of the module is connected to the power supply interface of the power hard disk to supply power to the storage device.
  • the setting of the micro switch can also monitor the device when an abnormality occurs between the storage device and the host or the host is replaced.
  • the authorization key can be reconfigured and verified. After the verification is passed, the device can be continued. Access.
  • the storage device provided by the present invention that can have built-in independent data can achieve data security, integrated power supply and centralized storage at the same time through the collaborative improvement of the hardware structure and software system. It has an integrated structure and can be placed inside the host and connected to the motherboard.
  • FIG. 1 is a schematic diagram of an internal system of a storage device capable of building independent data provided by the present invention.
  • the storage device provided by the present invention that can have built-in independent data refers to an independent data storage device that can be built into the host, and is composed of hardware and software.
  • the hardware includes a main control chip, a memory chip, a NAND flash memory, an interface, a power supply module, and a micro switch.
  • this interface is used to match the built-in interface on the motherboard inside the host, so that the storage device can be built inside the host and connected to the motherboard; the power supply module is provided at the tail of the storage device for use in the host.
  • the storage device is powered when the storage device is not powered; the micro switch is used to monitor changes in the storage device and the connection status between the storage device and the host.
  • the work of the power supply module is triggered by the micro switch, and the data cable is used to connect the power supply interface of the power supply module to the power supply interface of the power hard disk to power the storage device; at the same time, based on the setting of the micro switch, if the storage device If there is an abnormality with the host or the host is replaced, push messages can be sent to the user after the host is started. After receiving the push message, the user can reconfigure and verify the authorization key, and regain access to the device after passing the verification. permissions, you can continue to access the device and modify files.
  • the storage device adopts the nvme protocol (non-volatile memory transmission protocol), and the type of interface set on the storage device to match the built-in interface on the host motherboard is One of pcie interface, built-in USB and m.2nvme interface.
  • nvme protocol non-volatile memory transmission protocol
  • a middle-end service controller and a storage controller are integrated on the front of the storage device to provide communication for the subject and monitor the operation of the device.
  • the memory chip is arranged on the back of the device and can be customized according to needs;
  • the power supply module is arranged on the tail of the front of the storage device.
  • the power supply module is provided with a four-pin power supply interface, which can be Connect the four-pin power supply interface to the corresponding interface on the host to realize power supply.
  • the software includes the underlying system, permission control layer, application layer and front-end UI.
  • the permission control layer can be divided into four layers according to its different levels in the operating system, including display layer, business layer, data layer and network layer.
  • the front-end UI includes Html, CSS, jQuery and multi-platform applications
  • the presentation layer includes module engine rendering, POST requests and Get requests
  • the front-end UI and presentation layer work together through corresponding web means, Realize human-computer interaction between the system and the user.
  • the network layer includes virtual networks, SMB, firewalls, login logs, etc. Storage devices can be configured through virtual networks.
  • the main configuration is to add host folders to independent data storage devices.
  • the folders and the data in the folders can be configured in real time through private
  • the protocol is automatically uploaded to an independent data storage device.
  • the middle-end service monitors the folder and decides independently whether a snapshot is needed.
  • the host service can also push messages about device communication abnormalities and abnormal operation through Windows barrage to ensure that the host Communication with storage devices is stable and data transmission is timely.
  • the business layer can configure and record corresponding permissions, including content management, user management, system settings, trigger management, system logs, etc.; the data layer is used to secure user data.
  • Storage and disaster backup including stored procedures, recycle bin, snapshots and operation logs, etc.
  • Files in the recycle bin are stored for 30 days by default and will not be deleted. If deleted accidentally, they can be retrieved through the recycle bin and can be modified in the configuration interface;
  • the network layer is oriented by user data flow, and performs data transmission and interaction through virtual networks;
  • the application layer provides middle-end services for the system, including private Sync, background process services, perception services, and authentication services.
  • the middle-end services are used to combine the above
  • the system is connected to the host, and the above-mentioned system can be accessed using middle-end services;
  • the underlying system provides an operating environment for data storage devices, and the operating environment is lightweight Linux.
  • the host and the storage device can be connected by means of the background service installed in the host and the middle-end service in the storage device, and the storage device can be connected.
  • the user enters the login user and password to log in, and generates an authorization key to encrypt and authenticate the device. If the login user or password entered is incorrect three times during the login process, the system will automatically lock for a certain period of time and send the The user sends an email indicating login failure or reminds the user in other ways that the system is locked for 3 to 5 minutes.
  • the obtained authorization key is used to access the device and modify documents when you need to edit and modify storage files, reconnect the storage device to the host, or change the host. For example, if the storage device is separated from the host and is monitored by the micro switch, a push message can be sent to the user after the host is started. After receiving the push message, the user can re-enter the authorization key and regain access to the device. permissions, you can continue to access the device and modify files.
  • the storage device In order to ensure the data security of the storage device, the storage device cannot access, read, and modify the data by default. If the user needs to restore the data of the storage device, he needs to enter the web configuration interface again for authorization, enter the authorization key, and turn on device sharing. Service, during this process, the configured opening time is also limited. The shared service is automatically closed when the set time is exceeded. At this time, the host accesses the data of the independent data storage device or the data of the recycle bin through the SMB protocol. By default, it only has read permission. , such setting can ensure the concealment of data of the independent data storage device; through the above setting, the storage device cannot be discovered by other hosts and users, ensuring the security of the storage device and the data independence of the independent data storage device.
  • the present invention also provides a method for using the above-mentioned storage device that can have built-in independent data.
  • the specific operation process is as follows:
  • the background service installed in the host starts, automatically discovers the storage device and configures it.
  • the user enters the login user and password to log in. If the entered login information is accurate, the authorization key can be generated. If the entered login information is incorrect, it can be entered again. When the number of incorrect entries reaches three times, the system It will be automatically locked for a certain period of time, and the generated authorization key can be entered when modifying files in the device to obtain permission to modify the files.
  • the business layer is used to configure and configure device permissions accordingly. Record and use the data layer to securely store user data.
  • the data transmission and interaction process is carried out through the network layer.
  • the host service can be used to monitor the stability of the data transmission and timely push reminder messages for abnormal device operation; storage device with the Lord
  • the connection process of the computer if the device is separated from the host, under the monitoring of the micro switch, the host will send a push message to the user after starting.
  • the authorization can be obtained by re-entering the authorization key, and then the device can be operated. access.
  • the present invention provides a storage device capable of built-in independent data, which is composed of hardware and software.
  • the software includes the underlying system, permission control layer, application layer and front-end UI;
  • the permission control layer includes the display layer, business layer, data layer and network layer;
  • the application layer provides middle-end services for the system and is used to connect the software system and the host. Connect between them in order to access the software system, including private Sync, background process service, perception service, and authentication service.
  • the storage device is provided with an interface that matches the built-in interface on the host motherboard, a power supply module is provided at the rear of the storage device, and a micro switch is also provided on the storage device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Storage Device Security (AREA)

Abstract

一种可内置独立数据的存储设备，由硬件和软件组成。其中软件包括底层***、权限控制层、应用层及前端UI；权限控制层包括展示层、业务层、数据层及网络层；应用层为***提供中台服务，用于将软件的***与主机之间进行连接，以便对软件的***进行访问，包括私有Sync、后台进程服务、感知服务、认证服务。存储设备上设有与主机主板上的内置接口相匹配的接口，在存储设备的尾部设置有供电模块，在存储设备上还设有微动开关。可内置独立数据的存储设备能够同时实现数据安全、集成供电及集中存储，呈一体式结构，能够置于主机内部与主板连接。

Description

可内置独立数据的存储设备 技术领域
本发明涉及独立数据存储设备技术领域，尤其涉及一种可内置独立数据的存储设备。
背景技术
现下使用的数据备份设备一般为外置的移动硬盘或存储设备，其使用时均需要外接到主机上，在不需要使用时也可以任意插拔，该过程存在数据泄漏或设备丢失的风险。另外，这类外置的存储***虽然可以有效地进行数据备份，但是脱离了主机后，需要单独供电和安装硬盘，***的可用性低。
现有技术中，申请号为201811372902.2，公开日期为2018年11月19日，名称为“支持多用户数据保护的安全优盘***”的中国发明专利中公开了一种安全优盘***，包括：上位机执行子***以及嵌入式执行子***；其中，上位机执行子***包括：状态监视器、登录窗口、日志管理器、用户管理器、销毁控制开关、文件操作器、日志生成器、操作权限过滤器、专用文件***和SCSI协议生成器，上位机执行子***的可执行程序保存在安全优盘的程序区中；嵌入式执行子***包括：SCSI协议解析器、登录认证、状态响应器、登录锁、销毁控制、用户管理、快速访存器、审计管理、硬算法加密器、用户信息库、密钥库、程序区、数据区和日志区，其可执行目标码固化在安全优盘内部的主控芯片。上述技术方案中提出的安全优盘***虽然可以实现多用户数据安全，但是并不能对个人用户数据进行保护。
有鉴于此，有必要设计一种改进的可内置独立数据的存储设备，以解决上述问题。
发明内容
针对上述现有技术的缺陷，本发明的目的在于提供一种能够实现数据安全、集成供电及集中存储的一体式可内置独立数据的存储设备。
为实现上述目的，本发明提供了一种可内置独立数据的存储设备，所述存储设备由硬件和软件组成；所述软件包括底层***、权限控制层、应用层及前端UI；
所述权限控制层包括展示层、业务层、数据层及网络层；所述网络层能够以数据流为导向，通过虚拟网络进行数据的传输和交互；所述数据层用于对用户数据进行安全存储和数据灾难备份；
所述网络层包括虚拟网络、SMB、防火墙及登录日志，所述数据层包括存储过程、回收站、快照及操作日志，所述虚拟网络能够对所述存储设备进行配置，主要配置为将主机文件夹添加到所述存储设备中，文件夹及文件夹内的数据实时通过私有协议自动上传到所述存储设备中，中台服务监听文件夹自主决定是否需要进行快照，所述回收站中的文件默认存储一定时间；
所述前端UI包括Html、CSS、jQuery及多平台应用，所述展示层包括模块引擎渲染、POST请求及Get请求，所述展示层和所述前端UI通过相应的web手段，实现***与用户之间的人机互动；
所述业务层用于对权限进行对应的配置及记录，包括内容管理、用户管理、***设置、触发管理及***日志；
所述应用层为***提供中台服务，包括私有Sync、虚拟网络、感知服务、认证服务，所述中台服务用于将所述软件的***与主机之间进行连接，并能利用所述中台服务对所述软件的***进行访问；所述底层***为所述软件的***提供运行环境，所述运行环境为轻量Linux。
优选的，所述硬件包括主控芯片、存储芯片及NAND闪存，所述存储设备采用nvme协议；所述存储设备上设置有与主机主板上的内置接口相匹配的接口，所述接口的类型为pcie接口、内置USB及m.2nvme接口中的一种。
优选的，所述存储设备的正面集成设置中台服务控制器、存储控制器，用于为所述存储设备提供通讯和监听所述存储设备的运行状况。
优选的，所述存储芯片设置于所述存储设备的背面，所述存储设备的正面的尾部设有供电模块，用于在所述主机未对所述存储设备供电时为所述存储设备进行供电；所述存储设备上还设有微动开关，所述微动开关能监听所述存储设备的异动和所述存储设备与所述主机之间的连接状况。
优选的，所述存储设备的访问通过如下步骤进行：先使所述主机与所述存储设备进行连接，利用所述主机内安装的后台服务和所述存储设备内的所述中台服务对所述存储设备进行配置，初次配置成功后用户输入登录用户和密码，所述登录用户和所述密码均正确输入后，生成授权密匙，对所述存储设备进行加密认证，利用所述授权密匙能够对所述存储设备内的存储文件进行编辑和修改；登录过程中，若输入的所述登录用户和所述密码有误，还能够再次输入，当输入错误次数超过3次，***会自动锁定3～5min，并向用户发送登录失败的邮件或以其他方式提醒用户。
优选的，所述供电模块上设有四针供电接口，通过转换线能够使所述四针供电接口与所述主机上的相应接口进行连接，实现供电。
优选的，所述存储设备上还设有微动开关，用于监听所述存储设备是否脱离所述主机，当所述存储设备脱离所述主机，所述主机启动后进行消息推送，并需要再次输入所述授权密钥进行解密，认证通过后才能够启动服务和访问所述存储设备。
优选的，所述存储设备默认无法对数据进行访问、读取和修改，若用户需对所述存储设备内的数据进行恢复，需要再次进入web配置界面进行授权，输入所述授权密匙，打开所述存储设备的共享服务。
优选的，所述主机与所述存储设备之间进行数据传输的过程中，所述主机通过Windows弹幕推送所述存储设备通讯异常和运行异常的消息，用于确保所述主机与所述存储设备之间通讯稳定，数据传输及时。
优选的，所述数据恢复过程中还对配置的打开时间进行了限制，超出设 定时长后，所述共享服务自动关闭。
与现有技术相比，本发明提供的可内置独立数据的存储设备具有如下有益效果：
1、本发明提供的可内置独立数据的存储设备，在对软件***进行设计时，通过将软件设置为包括底层***、权限控制层、应用层及前端UI，在存储设备内设置了层次不同的功能层，利用每一层执行运行存储设备过程中的相应指令，有效确保了数据的安全。同时，通过在存储设备内设置中台服务，不仅能够将主机和存储设备进行连接，还可利用中台服务对设备进行访问，并对设备的运行状况进行监听，使得设备在与主机连接后，不被***检测到，确保了设备的安全性，并能实现数据存储设备的数据独立性。另外，在主机***重置和主机硬盘被更换后，存储设备内的数据不会受到影响，只需重新安装主机服务进行认证，即可获取存储设备内的数据。
2、本发明提供的可内置独立数据的存储设备，在对硬件结构进行设计时，通过将硬件设置为包括主控芯片、存储芯片及NAND闪存，同时在存储设备上设置与主机主板上的内置接口相匹配的接口，在存储设备的尾部设置供电模块，并在存储设备上设置微动开关，能够在主机未对设备进行供电时，通过微动开关触发供电模块的工作，利用数据线使供电模块的供电接口与电源硬盘供电接口进行连接，对存储设备进行供电。同时，微动开关的设置还能够在存储设备与主机之间出现异常或主机被更换时对设备进行监听，出现上述异常时可通过重新配置和验证授权密匙，验证通过后可继续进行对设备的访问。
3、本发明提供的可内置独立数据的存储设备通过对硬件结构和软件***的协同改进，能够同时实现数据安全、集成供电及集中存储，呈一体式结构，能够置于主机内部与主板连接。
附图说明
图1为本发明提供的可内置独立数据的存储设备的内部***的示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面结合附图和具体实施例对本发明进行详细描述。
本发明提供的可内置独立数据的存储设备，指的是能够内置于主机内部的独立数据存储设备，由硬件和软件组成。
在本发明的一些实施例中，硬件包括主控芯片、存储芯片、NAND闪存、接口、供电模块以及微动开关。具体地，该接口用于与主机内部的主板上的内置接口相匹配的接口，以使存储设备能够内置于主机内部并与主板连接；供电模块设置于存储设备的尾部，用于在所述主机未对所述存储设备供电时为所述存储设备进行供电；微动开关则用于监听存储设备的异动和存储设备与主机之间的连接状况。并且，供电模块的工作通过微动开关触发，利用数据线将供电模块的供电接口与电源硬盘的供电接口进行连接，即可对存储设备进行供电；同时，基于微动开关的设置，若存储设备与主机之间出现异常或主机被更换，在主机启动后即可向用户发送推送消息，用户在收到推送消息后，可通过重新配置和验证授权密匙，验证通过便重新获得对设备进行访问的权限，即可继续进行对设备的访问和文件的修改。
更具体的，在本发明的一些实施例中，存储设备采用nvme协议(非易失性存储器的传输协议)，存储设备上设置的用于与主机主板上的内置接口相匹配的接口的类型为pcie接口、内置USB及m.2nvme接口中的一种。
更进一步地，在本发明的一些实施例中，存储设备的正面集成设置中台服务控制器、存储控制器，用于为主体提供通讯和进行设备运行的监听。
在本发明的一些实施例中，存储芯片设置于设备的背面，并可根据需求进行定制；供电模块设置于存储设备的正面的尾部，该供电模块上设有四针供电接口，通过转换线能够使四针供电接口与主机上的相应接口进行连接，实现供电。
请参阅图1所示，在本发明提供的可内置独立数据的存储设备中，软件 包括底层***、权限控制层、应用层及前端UI，其中，权限控制层根据其在操作***中所处的层次不同，可分为四层，包括展示层、业务层、数据层及网络层。
具体地，在本发明的一些实施例中，前端UI包括Html、CSS、jQuery及多平台应用，展示层包括模块引擎渲染、POST请求及Get请求，前端UI和展示层一起通过相应的web手段，实现***与用户之间的人机交互。网络层包括虚拟网络、SMB、防火墙及登录日志等，通过虚拟网络可对存储设备进行配置，主要配置为将主机文件夹添加到独立数据存储设备中，文件夹及文件夹内的数据实时通过私有协议自动上传到独立数据存储设备中，中台服务监听文件夹自主决定是否需要进行快照，特别地，数据传输过程中主机服务还可通过Windows弹幕推送设备通讯异常和运行异常的消息，确保主机与存储设备之间通讯稳定，数据传输及时。
进一步地，在本发明的一些实施例中，业务层可对权限进行对应的配置及记录，包括内容管理、用户管理、***设置、触发管理及***日志等；数据层用于对用户数据进行安全存储和灾难备份，包括存储过程、回收站、快照及操作日志等，回收站内的文件默认存储30天，不会被删除，误删时可通过回收站找回，并可在配置界面进行修改；网络层是以用户数据流为导向，通过虚拟网络进行数据的传输及互动；应用层为***提供中台服务，包括私有Sync、后台进程服务、感知服务、认证服务，中台服务用于将上述***与主机之间进行连接，利用中台服务可对上述***进行访问；底层***为数据存储设备提供运行环境，运行环境为轻量Linux。
特别地，当本发明提供的可内置独立数据的存储设备与主机连接后，可借助于主机内安装的后台服务及存储设备内的中台服务，将主机和存储设备进行连接，并对存储设备进行配置，初次配置成功后用户输入登录用户和密码进行登录，并生成授权密匙，对设备进行加密认证，登录过程中若输入的登录用户或密码三次错误，***会自动锁定一定时间，并向用户发送登录失败的邮件或以其他方式提醒用户，***锁定的时间为3～5min。上述过程中获 得的授权密匙用于在需要对存储文件进行编辑和修改、存储设备与主机重新连接或更换主机后对设备进行访问及对文档进行修改。例如，若存储设备脱离主机，被微动开关监听到后，在主机启动后便可向用户发送推送消息，用户在收到推送消息后，可重新输入授权密匙，重新获得对设备进行访问的权限，即可继续设备的访问和文件的修改。
为了确保存储设备的数据安全，存储设备默认无法对数据进行访问、读取和修改，若用户需对存储设备的数据进行恢复，需要再次进入web配置界面进行授权，输入授权密匙，打开设备共享服务，该过程中还对配置的打开时间进行了限制，超出设定时长共享服务自动关闭，此时主机通过smb协议对独立数据存储设备的数据或回收站的数据进行访问，默认只有读取权限，如此设置，可确保独立数据存储设备数据的隐蔽；通过上述设置，使得存储设备无法被其它主机和用户发现，确保了存储设备的安全性和独立数据存储设备的数据独立性。
另外，本发明还提供了上述可内置独立数据的存储设备的使用方法，具体的操作过程如下：
先利用存储设备的接口和主机内主板上与之相匹配的接口连接，使存储设备和主机进行连接，主机在开机状态下时，主机内安装的后台服务启动，自动发现存储设备并进行配置，首次配置成功后，用户输入登录用户和密码进行登录，若输入的登录信息准确无误，则可以生成授权密匙，若输入的登录信息有误，可再次输入，当输入错误的次数达到三次，***会自动锁定一定时间，生成的授权密匙可在对设备内的文件进行修改时输入，获得对文件进行修改的权限。
然后，对存储设备进行访问，通过前端UI和展示层内部的各个部分之间的相互配合，实现存储设备与用户之间的人机互动，该过程中利用业务层对设备权限进行相应的配置和记录，利用数据层对用户数据进行安全存储，数据的传输和交互过程通过网络层进行，数据传输过程中可利用主机服务监测数据传输的稳定性，并及时推送设备运行异常的提醒消息；存储设备与主 机的连接过程中，若出现设备脱离主机的情况，在微动开关的监听下，主机启动后会向用户发送推送消息，此时可通过重新输入授权密匙获得授权，然后即可对设备进行访问。
综上所述，本发明提供了一种可内置独立数据的存储设备，由硬件和软件组成。其中，软件包括底层***、权限控制层、应用层及前端UI；权限控制层包括展示层、业务层、数据层及网络层；应用层为***提供中台服务，用于将软件的***与主机之间进行连接，以便对软件的***进行访问，包括私有Sync、后台进程服务、感知服务、认证服务。该存储设备上设有与主机主板上的内置接口相匹配的接口，在存储设备的尾部设置有供电模块，在存储设备上还设有微动开关。通过上述方式，本发明提供的可内置独立数据的存储设备能够同时实现数据安全、集成供电及集中存储，呈一体式结构，能够置于主机内部与主板连接。
以上实施例仅用以说明本发明的技术方案而非限制，尽管参照较佳实施例对本发明进行了详细说明，本领域的普通技术人员应当理解，可以对本发明的技术方案进行修改或等同替换，而不脱离本发明技术方案的精神和范围。

Claims (10)

  1. 一种可内置独立数据的存储设备，其特征在于，所述存储设备由硬件和软件组成；所述软件包括底层***、权限控制层、应用层及前端UI；
    所述权限控制层包括展示层、业务层、数据层及网络层；所述网络层能够以数据流为导向，通过虚拟网络进行数据的传输和交互；所述数据层用于对用户数据进行安全存储和数据灾难备份；
    所述网络层包括虚拟网络、SMB、防火墙及登录日志，所述数据层包括存储过程、回收站、快照及操作日志，所述虚拟网络能够对所述存储设备进行配置，主要配置为将主机文件夹添加到所述存储设备中，文件夹及文件夹内的数据实时通过私有协议自动上传到所述存储设备中，中台服务监听文件夹自主决定是否需要进行快照，所述回收站中的文件默认存储一定时间；
    所述前端UI包括Html、CSS、jQuery及多平台应用，所述展示层包括模块引擎渲染、POST请求及Get请求，所述展示层和所述前端UI通过相应的web手段，实现***与用户之间的人机互动；
    所述业务层用于对权限进行对应的配置及记录，包括内容管理、用户管理、***设置、触发管理及***日志；
    所述应用层为***提供中台服务，包括私有Sync、虚拟网络、感知服务、认证服务，所述中台服务用于将所述软件的***与主机之间进行连接，并能利用所述中台服务对所述软件的***进行访问；所述底层***为所述软件的***提供运行环境，所述运行环境为轻量Linux。
  2. 根据权利要求1所述的可内置独立数据的存储设备，其特征在于：所述硬件包括主控芯片、存储芯片及NAND闪存，所述存储设备采用nvme协议；所述存储设备上设置有与主机主板上的内置接口相匹配的接口，所述接口类型为pcie接口、内置USB及m.2 nvme接口中的一种。
  3. 根据权利要求1所述的可内置独立数据的存储设备，其特征在于：所述存储设备的正面集成设置中台服务控制器、存储控制器，用于为所述存储设备 提供通讯和监听所述存储设备的运行状况。
  4. 根据权利要求2所述的可内置独立数据的存储设备，其特征在于：所述存储芯片设置于所述存储设备的背面，所述存储设备的正面的尾部设有供电模块，用于在所述主机未对所述存储设备供电时为所述存储设备进行供电；所述存储设备上还设有微动开关，所述微动开关能监听所述存储设备的异动和所述存储设备与所述主机之间的连接状况。
  5. 根据权利要求4所述的可内置独立数据的存储设备，其特征在于：所述存储设备的访问通过如下步骤进行：
    先使所述主机与所述存储设备进行连接，利用所述主机内安装的后台服务和所述存储设备内的所述中台服务对所述存储设备进行配置，初次配置成功后用户输入登录用户和密码，所述登录用户和所述密码均正确输入后，生成授权密匙，对所述存储设备进行加密认证，利用所述授权密匙能够对所述存储设备内的存储文件进行编辑和修改；登录过程中，若输入的所述登录用户和所述密码有误，还能够再次输入，当输入错误次数超过3次，***会自动锁定3～5min，并向用户发送登录失败的邮件或以其他方式提醒用户。
  6. 根据权利要求4所述的可内置独立数据的存储设备，其特征在于：所述供电模块上设有四针供电接口，通过转换线能够使所述四针供电接口与所述主机上的相应接口进行连接，实现供电。
  7. 根据权利要求5所述的可内置独立数据的存储设备，其特征在于：所述存储设备上还设有微动开关，用于监听所述存储设备是否脱离所述主机，当所述存储设备脱离所述主机，所述主机启动后进行消息推送，并需要再次输入所述授权密钥进行解密，认证通过后才能够启动服务和访问所述存储设备。
  8. 根据权利要求7所述的可内置独立数据的存储设备，其特征在于，所述存储设备默认无法对数据进行访问、读取和修改，若用户需对所述存储设备内的数据进行恢复，需要再次进入web配置界面进行授权，输入所述授权密匙，打开所述存储设备的共享服务。
  9. 根据权利要求5所述的可内置独立数据的存储设备，其特征在于：所述 主机与所述存储设备之间进行数据传输的过程中，所述主机通过Windows弹幕推送所述存储设备通讯异常和运行异常的消息，用于确保所述主机与所述存储设备之间通讯稳定，数据传输及时。
  10. 根据权利要求8所述的可内置独立数据的存储设备，其特征在于：所述数据恢复过程中还对配置的打开时间进行了限制，超出设定时长后，所述共享服务自动关闭。
PCT/CN2023/106778 2022-08-30 2023-07-11 可内置独立数据的存储设备 WO2024045909A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211052306.2 2022-08-30
CN202211052306.2A CN115390765A (zh) 2022-08-30 2022-08-30 可内置独立数据的存储设备

Publications (1)

Publication Number Publication Date
WO2024045909A1 true WO2024045909A1 (zh) 2024-03-07

Family

ID=84123849

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/106778 WO2024045909A1 (zh) 2022-08-30 2023-07-11 可内置独立数据的存储设备

Country Status (2)

Country Link
CN (1) CN115390765A (zh)
WO (1) WO2024045909A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115390765A (zh) * 2022-08-30 2022-11-25 武汉攀升鼎承科技有限公司 可内置独立数据的存储设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105025084A (zh) * 2015-06-10 2015-11-04 国网智能电网研究院 一种基于同步代理和混合存储的云存储***
CN105302575A (zh) * 2015-11-19 2016-02-03 ***通信集团广东有限公司汕头分公司 一种基础开发框架
CN106603284A (zh) * 2016-12-14 2017-04-26 国网天津市电力公司 基于Docker虚拟容器微应用平台***及运行方法
CN109684866A (zh) * 2018-11-19 2019-04-26 北京计算机技术及应用研究所 一种支持多用户数据保护的安全优盘***
US20210390120A1 (en) * 2020-06-10 2021-12-16 Business Objects Software Ltd. Nested group hierarchies for analytics applications
CN115390765A (zh) * 2022-08-30 2022-11-25 武汉攀升鼎承科技有限公司 可内置独立数据的存储设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105025084A (zh) * 2015-06-10 2015-11-04 国网智能电网研究院 一种基于同步代理和混合存储的云存储***
CN105302575A (zh) * 2015-11-19 2016-02-03 ***通信集团广东有限公司汕头分公司 一种基础开发框架
CN106603284A (zh) * 2016-12-14 2017-04-26 国网天津市电力公司 基于Docker虚拟容器微应用平台***及运行方法
CN109684866A (zh) * 2018-11-19 2019-04-26 北京计算机技术及应用研究所 一种支持多用户数据保护的安全优盘***
US20210390120A1 (en) * 2020-06-10 2021-12-16 Business Objects Software Ltd. Nested group hierarchies for analytics applications
CN115390765A (zh) * 2022-08-30 2022-11-25 武汉攀升鼎承科技有限公司 可内置独立数据的存储设备

Also Published As

Publication number Publication date
CN115390765A (zh) 2022-11-25

Similar Documents

Publication Publication Date Title
US10754957B2 (en) Non-transitory computer readable medium for creating a virtual machine manager
TWI635399B (zh) 用於遠端地管理計算裝置的安全性和組態之系統和方法
US8862803B2 (en) Mediating communciation of a univeral serial bus device
US20090046858A1 (en) System and Method of Data Encryption and Data Access of a Set of Storage Devices via a Hardware Key
EP2135186B1 (en) System and method for providing a secure computing environment
US10015015B1 (en) Method and apparatus for verifying system log integrity
KR20100087336A (ko) 판독전용 영역과 판독/기록 영역, 분리형 매체 구성부품, 시스템 관리 인터페이스, 네트워크 인터페이스를 가진 컴퓨터 기억장치
WO2024045909A1 (zh) 可内置独立数据的存储设备
EP1953668A2 (en) System and method of data encryption and data access of a set of storage devices via a hardware key
US11341230B1 (en) Maintaining dual-party authentication requirements for data retention compliance
US20220147634A1 (en) Client authentication and data management system
CN111753340B (zh) 一种usb接口信息安全防控方法及***
CN115604315A (zh) 服务器的远程处理装置及方法、电子设备
RU2444057C1 (ru) Система защиты информации от несанкционированного доступа к конфиденциальной информации и информации, содержащей персональные данные
RU2504835C1 (ru) Система защиты информации от несанкционированного доступа к информации, содержащей сведения, составляющие государственную тайну
WO2024137892A2 (en) Data backup device
RU2504834C1 (ru) Система защиты информации от несанкционированного доступа к информации, содержащей сведения, составляющие государственную тайну
JP2003099307A (ja) データバンクセキュリティシステム
Goktepe Windows XP Operating System Security Analysis

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23858947

Country of ref document: EP

Kind code of ref document: A1