Storage device and method for generating token
A storage device includes: a nonvolatile memory storing data of a first user; and a storage controller configured to receive an access request from a second user to access the data of the first user, obtain access approval for accessing the data from the first user in response to the access request, generate a token granting access authority to the second user for accessing the data using an Embedded Certificate Authority (ECA) upon obtaining the access approval, and send the token to the second user.
1 . A storage device comprising:
a nonvolatile memory storing data of a first user; and
a storage controller configured to receive an access request from a second user to access the data of the first user, obtain access approval for accessing the data from the first user in response to the access request, generate a token granting access authority to the second user for accessing the data using an Embedded Certificate Authority (ECA) upon obtaining the access approval, and send the token to the second user.
2 . The storage device of claim 1 , wherein the storage controller is configured to receive user information including a public key of the second user from the second user, and generate a user certificate including the user information and information of the ECA using a device private key of the storage device.
3 . The storage device of claim 2 , wherein the storage controller is configured to transmit a nonce and a device certificate to the second user, receive a value obtained by encrypting the nonce and the user certificate from the second user, verify the user certificate with a device public key paired with the device private key, decrypt the value with the public key of the second user included in the user certificate to generate a decrypted key, and compare the decrypted value with the nonce.
4 . The storage device of claim 1 , wherein the access request includes a data request format including identification information of the second user, information on the data, and a signature of the second user.
5 . The storage device of claim 4 , wherein the storage controller is configured to receive a data search request from the second user, and transmit a search result according to the data search request to the second user, and the information on the data of the data request format includes the search result.
6 . The storage device of claim 5 , wherein the data search request includes at least one of data tag information, file information, and folder information of the data.
7 . The storage device of claim 5 , wherein the search result includes at least one of the presence or absence of the data, the number of the data, a size of the data, a file name of the data, an address of the data, and information on an owner of the data.
8 . The storage device of claim 5 , wherein the access approval of the first user includes a semi-token including the data request format, identification information of the first user, a condition of the access approval, and a signature of the first user.
9 . The storage device of claim 8 , wherein the storage controller is configured to generate the token including a signature of the ECA generated by signing the semi-token and information of the ECA with a device private key of the storage device, the semi-token, and the information of the ECA.
10 . The storage device of claim 9 , wherein the storage controller is configured to receive the token from the second user, check whether the data is valid, and send the data to the second user when check indicates the data is valid.
11 . The storage device of claim 9 , wherein the storage controller is configured to receive the token from the second user, check whether the condition of the access approval is satisfied, and send the data to the second user when the check indicates the condition is satisfied.
12 . The storage device of claim 9 , wherein the storage controller is configured to receive the token from the second user, verify the signature of the ECA, and send the data to the second user when the signature is verified.
13 . The storage device of claim 12 , wherein the storage controller is configured to verify the signature of the ECA with a device public key paired with the device private key.
14 . A method for generating a token, comprising:
receiving a data request format requesting access to data of a first user stored in a storage device from a second user;
transmitting the data request format to the first user;
receiving an access approval of the first user approving the access to the data;
generating the token having access authority for the data based on the data request format using an Embedded Certificate Authority (ECA); and
sending the token to the second user.
15 . The method of claim 14 , further comprising:
receiving a data search request from the second user; and
transmitting a search result according to the data search request to the second user,
wherein the data request format includes the search result.
16 . The method of claim 14 , wherein the receiving of the access approval includes receiving a semi-token including the data request format, identification information of the first user, a condition of the access approval, and a signature of the first user, and the generating of the token includes generating the token including a signature of the ECA generated by signing the semi-token and information of the ECA with a device private key of the storage device, the semi-token, and the information of the ECA.
17 . The method of claim 16 , further comprising:
receiving the token from the second user;
verifying the signature of the ECA with a device public key paired with the device private key;
checking whether the data is valid;
checking whether the condition of the access approval is satisfied; and
sending the data to the second user when the checking indicates the data is valid and the condition is satisfied.
18 . The method of claim 14 , further comprising:
receiving user information including a public key of the second user from the second user; and
generating a user certificate including the user information and information of the ECA using a device private key of the storage device.
19 . The method of claim 18 , further comprising:
transmitting a nonce and a device certificate to the second user before the receiving of the data request format from the second user;
receiving a value obtained by encrypting the nonce and the user certificate from the second user;
verifying the user certificate with a device public key paired with the device private key; and
decrypting the value with the public key of the second user included in the user certificate to compare the decrypted value with the nonce.
20 . A storage controller comprising:
a certification module configured to issue certificates of a plurality of users using an Embedded Certificate Authority (ECA), verify a certificate among the certificates of a first user among the plurality of users, generate a token that grants access authority to data of a second user among the plurality of users using the ECA, and verify the token; and
a processor configured to provide the data of the second user to the first user when the token is verified.