CN103198263B

CN103198263B - By the method that the peripheral hardware key of personal computer sets up enciphering/deciphering memory space

Info

Publication number: CN103198263B
Application number: CN201210416261.2A
Authority: CN
Inventors: 马国强
Original assignee: Gaorong Technology Shenzhen Co Ltd
Current assignee: Shenzhen sidit Technology Co.,Ltd.
Priority date: 2012-10-26
Filing date: 2012-10-26
Publication date: 2016-07-06
Anticipated expiration: 2032-10-26
Also published as: CN103198263A

Abstract

A kind of method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer, based on personal computer, and storage has the external hardware devices of key.Described method is the enciphering/deciphering driving function of bottom installation data filter net type on described personal computer internal operating system；Encryption data storage partition is set up in the available data storage space that operating system may detect that；Make after external hardware devices electrically connects with the foundation of described personal computer, described operating system carry encryption data storage partition, after external hardware devices removes from described personal computer, described operating system unloading encryption data storage partition, and enciphering/deciphering is implemented in encryption data storage partition data interaction.The present invention realizes key and the isolation adding ciphertext data, general data and the isolation adding ciphertext data, adds the disguise adding ciphertext data, it is ensured that add the safety of ciphertext data.

Description

By the method that the peripheral hardware key of personal computer sets up enciphering/deciphering memory space

Technical field

The present invention relates to the data enciphering/deciphering in electronic data storage, particularly relate to and need to complete the data enciphering/deciphering in the electronic data storage that data store by personal computer.

Background technology

In increasing occasion, it is necessary to implement enciphering/deciphering for the data in the data storage relevant with personal computer and process.Described personal computer includes minicomputer, portable computer and palmtop computer, and described minicomputer includes main frame, input equipment and outut device.It is provided with mainboard in described main frame, described mainboard is electrically connected with central processor CPU, for storing the hard disk of operating system and data, and interface.Common input equipment adopts keyboard and mouse, and common outut device adopts display.Host display, keyboard and mouse are synthesized portable equipment integrating by described portable computer.Described palmtop computer is with comparing portable computer, and by display, keyboard and mouse, namely input equipment and outut device synthesize touching-type monitor, and this touch display and main frame are combined into more microminiaturized computer.The described data storage relevant with personal computer includes the hard disk in personal computer for data storage, can facilitate, by interface, the external data memory releasably electrically connected on a personal computer independent of personal computer.Described external data memory is to be equipped with USB (universal serial bus) UniversalSerialBus interface, and namely the pocket memory of USB interface is major embodiment form.

A kind of method that described data storage is implemented enciphering/deciphering of prior art is to arrange a special enciphering/deciphering chip or board at hardware aspect, the data of turnover data storage are implemented enciphering/deciphering, but the method realizes cost height, it is applicable to height encryption requirements unit, such as army, government bodies, and it is unsuitable for universalness.

The another kind of method that described data storage is implemented enciphering/deciphering of prior art is installation enciphering/deciphering software in operating system, when needing to add ciphertext data, first run this enciphering/deciphering software, preserve after input password in data to data memorizer, but key is stored in same data storage with adding ciphertext data by this kind of method, obtain the encryption file in this data storage to mean that and obtain key, it is easy to by other people deciphering.Therefore the data encryption of the method dangerous, it does not have accomplish substantial data encryption.It is also due to key and does not isolate with adding ciphertext data, add the ability that ciphertext data is invaded almost without anti-computer virus and anti-Trojan program.

Prior art enciphering/deciphering software engineering is generally only implements above-mentioned enciphering/deciphering with document form, interface is operated without providing the user the enciphering/deciphering for specific function demand, such as user often directly to preserve user name, account number, password, web site collection information, individual note information etc..It addition, for how backing up and recover the core datas such as the data message of user, password and enciphering/deciphering key, prior art is all without the method providing better safety and ease for use to take into account.

Summary of the invention

The technical problem to be solved in the present invention is in that to avoid the deficiencies in the prior art part to propose the data method for encryption/decryption of a kind of software and hardware combining, key and the isolation of enciphering/deciphering software is realized by individual's adding machine peripheral hardware hardware, and add the isolation of ciphertext data and general data, guarantee data encryption high reliability, and provide and simple data is directly encrypted, and the method that core datas such as adding ciphertext data, password, key is backed-up and recovers.

This invention address that described technical problem can by realizing by the following technical solutions:

Implement a kind of method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer, based on personal computer, and independent of outside this personal computer, there is the external hardware devices of storage capacity；Described personal computer includes main frame, input equipment and outut device, is provided with central processor CPU, and is stored with the hard disk of operating system and data in described main frame；Described external hardware devices can electrically connect on the personal computer by the interface of personal computer, it is also possible to powering on from described personal computer removes；Especially described method comprises the steps:

A., enciphering/deciphering software is installed in the operating system of described personal computer；It is stored in key in described external hardware devices；

B., driver based on described external hardware devices is installed in the operating system of described personal computer, thus setting up the enciphering/deciphering driving function of a data filter net type between the physical equipment and incoming/outgoing management device of operating system bottom；

C. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, in the available data storage space that operating system may detect that, set up at least one encryption data storage partition；Each encryption data storage partition is made to implement data interaction by following condition,

K1. when external hardware devices does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；

K2. after external hardware devices electrically connects with the foundation of described personal computer, described operating system by according in this external hardware devices storage key set up encryption data storage partition carry in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when reading data from described encryption data storage partition, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；During to described encryption data storage partition write data, described enciphering/deciphering driving function implements encryption by double secret key write data；

K3. when external hardware devices is from after removing the operating system of described personal computer, the encryption data storage partition set up according to the key of storage in this external hardware devices is unloaded by described enciphering/deciphering software from incoming/outgoing management device, even operating system can not detect described encryption data storage partition.

Preventing key from repeating to cause giving away secrets, the external hardware devices one_to_one corresponding of key described in step A and this key of storage, namely in each external hardware devices, the key of storage is unique.

Specifically, for storing that the operating system that the memory space of key is personal computer cannot correctly read and write wherein data and the memory space of wherein data can correctly be read and write by enciphering/deciphering software in described external hardware devices.

Especially, described external hardware devices is the external data storage device for completing data storage outside personal computer.

Specifically, described operating system from incoming/outgoing management device to physical equipment between be disposed with installable file system layer InstallableFileSystem, file system driver layer, device driver layer and hardware abstraction layer HardwareAbstractionLayer；The enciphering/deciphering driving function of described data filter net type is based upon between described installable file system layer IFS and described file system driver layer.

The enciphering/deciphering driving function of described data filter net type refers to only implements enciphering/deciphering to the data exchange process between described encryption data storage partition and incoming/outgoing management device according to key, and can be done directly data interaction between other hardware device and incoming/outgoing management device.

The free memory that described operating system may detect that not only includes the idle storage space in the hard disk of operating system place computer, the free memory that operating system described in step C may detect that includes the free memory from personal computer hard disk, from the free memory of the external data storage device electrically connected on a personal computer, and the free memory from described external hardware devices.Described external data storage device is independently of the external data storage device of described personal computer, and the interface by this personal computer can be connected electrically on described personal computer, it is also possible to powering on from described personal computer removes.

The interface of described personal computer is USB (universal serial bus) UniversalSerialBus interface.

In order to further ensure that the safety of encryption data storage partition, step C also includes as follows step by step,

C1. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, in the available data storage space that operating system may detect that, set up at least one encryption data storage partition, be respectively configured a connection password inputted by user for each encryption data storage partition；Each encryption data storage partition is made to implement data interaction by following condition,

K11. when external hardware devices does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；

K21. after external hardware devices electrically connects with the foundation of described personal computer, only according to storing the encryption data storage partition existence that key is set up in this external hardware devices, simultaneously user is when to input password consistent with the connection password set for this encryption data storage partition, described enciphering/deciphering software just by described encryption data storage partition carry in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when reading data from described encryption data storage partition, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；During to described encryption data storage partition write data, described enciphering/deciphering driving function implements encryption by double secret key write data；

K31. when external hardware devices is from after removing the operating system of described personal computer, the encryption data storage partition set up according to the key of storage in this external hardware devices is unloaded by described enciphering/deciphering software from incoming/outgoing management device, even operating system can not detect described encryption data storage partition.

The other method of safety further ensuring that encryption data storage partition is, step C also include following step by step,

C2. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, setting up at least one encryption data storage partition in the available data storage space that operating system may detect that, all encryption data storage partition for setting up based on same key configure one and are connected password by what user inputted based on key；Each encryption data storage partition is made to implement data interaction by following condition,

K12. when external hardware devices does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；

K22. after external hardware devices electrically connects with the foundation of described personal computer, only according to storing the encryption data storage partition existence that key is set up in this external hardware devices, simultaneously, user input password with for set up based on same key encryption data storage partition set based on key connect password consistent when, described enciphering/deciphering software just by all encryption data storage partition carries set up based on same key in incoming/outgoing management device, even operating system can detect all encryption data storage partition based on same key；Further, when reading data from described encryption data storage partition, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；During to described encryption data storage partition write data, described enciphering/deciphering driving function implements encryption by double secret key write data；

K32. when external hardware devices is from after removing the operating system of described personal computer, the encryption data storage partition set up according to the key of storage in this external hardware devices is unloaded by described enciphering/deciphering software from incoming/outgoing management device, even operating system can not detect described encryption data storage partition.

The yet another method of safety further ensuring that encryption data storage partition is, step C also include following step by step,

C3. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, in the available data storage space that operating system may detect that, set up at least one encryption data storage partition；Each encryption data storage partition is made to implement data interaction by following condition,

K13. when external hardware devices does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；

K23. after external hardware devices electrically connects with the foundation of described personal computer, described enciphering/deciphering software by according in this external hardware devices storage key set up encryption data storage partition carry in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when writing file data to described encryption data storage partition, described enciphering/deciphering driving function implements encryption by double secret key write data, and sets a data file password inputted by user for this write data；From described encryption data storage partition read file data time, only when user input password consistent with the data file password set for this reading file data, described enciphering/deciphering driving function ability execute deciphering factually by double secret key read number；

K33. when external hardware devices is from after removing the operating system of described personal computer, the encryption data storage partition set up according to the key of storage in this external hardware devices is unloaded by described enciphering/deciphering software from incoming/outgoing management device, even operating system can not detect described encryption data storage partition.

Can also above-mentioned two of which method being combined, step C also includes as follows step by step,

C4. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, in the available data storage space that operating system may detect that, set up at least one encryption data storage partition, be respectively configured a connection password inputted by user for each encryption data storage partition；Each encryption data storage partition is made to implement data interaction by following condition,

K14. when external hardware devices does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；

K24. after external hardware devices electrically connects with the foundation of described personal computer, the encryption data storage partition only set up according to the key of storage in this external hardware devices exists, simultaneously, user input password with set for this encryption data storage partition connect password consistent when, described enciphering/deciphering software just by described encryption data storage partition carry in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when writing file data to described encryption data storage partition, described enciphering/deciphering driving function implements encryption by double secret key write data, and sets a data file password inputted by user for this write data；From described encryption data storage partition read file data time, only when user input password consistent with the data file password set for this reading file data, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；

K34. when external hardware devices is from after removing the operating system of described personal computer, the encryption data storage partition set up according to the key of storage in this external hardware devices is unloaded by described enciphering/deciphering software from incoming/outgoing management device, even operating system can not detect described encryption data storage partition.

Furthermore it is also possible to above-mentioned two of which method combined, step C also includes as follows step by step,

C5. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, setting up at least one encryption data storage partition in the available data storage space that operating system may detect that, all encryption data storage partition for setting up based on same key configure one and are connected password by what user inputted based on key；Each encryption data storage partition is made to implement data interaction by following condition,

K15. when external hardware devices does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；

K25. after external hardware devices electrically connects with the foundation of described personal computer, the encryption data storage partition only set up according to the key of storage in this external hardware devices exists, simultaneously, user input password with for set up based on same key encryption data storage partition set based on key connect password consistent when, described enciphering/deciphering software just by all encryption data storage partition carries set up based on same key in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when writing file data to described encryption data storage partition, described enciphering/deciphering driving function implements encryption by double secret key write data, and sets a data file password inputted by user for this write data；From described encryption data storage partition read file data time, only when user input password consistent with the data file password set for this reading file data, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；

K35. when external hardware devices is from after removing the operating system of described personal computer, the encryption data storage partition set up according to the key of storage in this external hardware devices is unloaded by described enciphering/deciphering software from incoming/outgoing management device, even operating system can not detect described encryption data storage partition.

In order to realize the enciphering/deciphering of simple data form, for instance to encryption and decryption such as user name, account number, password, web site collection information, individual note information, described method also comprises the steps,

D1., when described external hardware devices electrically connects described personal computer, the information of the need for confidentiality that user is inputted by described enciphering/deciphering software is stored directly in the available data storage space that operating system may detect that.

Specifically, the free memory that operating system described in step D1 may detect that includes the free memory from personal computer hard disk, from the free memory of the external data storage device electrically connected on a personal computer, and the free memory from described external hardware devices.

More specifically, the free memory that operating system described in step D1 may detect that includes the encryption data storage partition from personal computer hard disk, from the encryption data storage partition of the external data storage device electrically connected on a personal computer, and the encryption data storage partition from described external hardware devices.

Another kind of realization is to user name, account number, password, the method for the enciphering/deciphering of the simple data forms such as web site collection information, individual note information, and described method also comprises the steps,

D2. when described external hardware devices electrically connects described personal computer, the information of the need for confidentiality that user is inputted by described enciphering/deciphering software is stored directly in external hardware devices, thus making the information of the need for confidentiality of key and user's input be stored in same memory space.

The memory space of information of the need for confidentiality for storing key and user's input of described external hardware devices is that the operating system of personal computer cannot correctly read and write wherein data and the memory space of wherein data can correctly be read and write by enciphering/deciphering software.

In order to realize the backup to key and recovery, described method also comprises the steps E1,

E1., when described external hardware devices electrically connects described personal computer, key is cryptographically backed up and stores to user in the data space specified by described enciphering/deciphering software, forms encrypted backup data；When needs recover described encrypted backup data, described external hardware devices is electrically connected described personal computer, by described enciphering/deciphering software, encrypted backup data are recovered to the memory space being used for storing key of external hardware devices.

Based on information backup and the recovery of the need for confidentiality performed after above-mentioned steps D1 key and user input, described method also comprises the steps E2 after step D1,

E2. when described external hardware devices electrically connects described personal computer, the information of need for confidentiality of user's input described in key and step D1 is cryptographically backed up and stores to user in the data space specified by described enciphering/deciphering software, forms encrypted backup data；When needs recover described encrypted backup data, described external hardware devices is electrically connected described personal computer, by described enciphering/deciphering software, encrypted backup data are recovered to the memory space being used for storing key of external hardware devices.

Based on information backup and the recovery of the need for confidentiality performed after above-mentioned steps D2 key and user input, described method also comprises the steps E3 after step D2,

E3. when described external hardware devices electrically connects described personal computer, the information of the need for confidentiality that key described in step D2 and user are inputted by described enciphering/deciphering software cryptographically backs up and stores to user in the data space specified, and forms encrypted backup data；When needs recover described encrypted backup data, described external hardware devices is electrically connected described personal computer, by described enciphering/deciphering software, encrypted backup data are recovered to the memory space being used for storing key of external hardware devices.

Specifically, in above-mentioned steps E1, E2 and E3, the memory space of wherein data can correctly be read and write by cannot correctly the reading and writing wherein data for the operating system that the memory space storing key is personal computer of external hardware devices and enciphering/deciphering software.

Additionally, in above-mentioned steps E1, E2 and E3, the backup that described user specifies stores the memory space of described encrypted backup data and includes the memory space from personal computer hard disk, memory space from the external data storage device electrically connected on a personal computer, from the memory space of described external hardware devices, and the network storage space from the Internet or LAN.

Compared with the existing technology relatively, the having the technical effect that of the present invention " by the method that the peripheral hardware key of personal computer sets up enciphering/deciphering memory space "

1. the present invention has the external hardware devices of key by storage, it is achieved key and the isolation adding ciphertext data, even if the data obtained in described encryption data storage partition, can not obtain corresponding secret key, and adding ciphertext data cannot decipher, it is ensured that Information Security；

2. the present invention has the external hardware devices of key by storage, the isolation realizing general data and add ciphertext data, add the disguise adding ciphertext data, when there is no key, other people there is no tellings the existence encrypting data storage partition, also would not there is the motivation deciphering encrypted data, further strengthen the safety of ciphertext data；

3. enciphering/deciphering driving function of the present invention is arranged on the bottom of operating system, logarithm is executed filter net type factually and is processed, and on operating system running not impact, applies close, deciphering factually at data gateway logarithm, prevent from data to be robbed before encryption to take, it is ensured that the reliability of data enciphering/deciphering process；

4. enciphering/deciphering software of the present invention can provide to user's particular demands, the data that directly inputted by user implement direct enciphering/deciphering, need not by user-specific information, the account number of such as user name, password, website information, note information etc. are first stored in file, again this document being carried out enciphering/deciphering operation, the specific function demand for user provides better safety and convenience；

5. enciphering/deciphering software of the present invention can to the specific functional requirement of user, the data message that directly inputted by user, the data such as the account number such as surfed the Net, password, note, and the core such as the key preserved in described external hardware device adds confidential information and is backed-up and recovers, prevent from causing user encryption data to recover again because external hardware devices is lost, further ensure that the safety adding ciphertext data.

Accompanying drawing explanation

Fig. 1 is that the present invention " by the method that the peripheral hardware key of personal computer sets up enciphering/deciphering memory space " first embodiment is based on the structural representation of hardware；

Fig. 2 is described first embodiment operating system layering schematic diagram；

Fig. 3 is the schematic flow sheet of the user of described first embodiment, personal computer and external hardware devices；

Fig. 4 is the schematic flow sheet of the user of described second embodiment, personal computer and external hardware devices.

Detailed description of the invention

It is described in further detail below in conjunction with embodiment each shown in accompanying drawing.

The present invention proposes a kind of method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer, as it is shown in figure 1, described method is based on personal computer, and independent of outside this personal computer, there is the external hardware devices 4 of storage capacity；Described personal computer includes main frame 1, input equipment and outut device, is provided with central processor CPU 11, and is stored with the hard disk 12 of operating system and data in described main frame 1.In first embodiment of the invention, described input equipment adopts keyboard 31 and mouse 32, and they are connected electrically on main frame 1 by interface 14.Described outut device adopts display 2, and this display electrically connects the video card 13 in main frame 1 by interface, and described video card 13 completes data interaction with central processor CPU 11.Mainboard can also be passed through in certain described main frame 1 coordinate to connect each hardware unit in main frame 1.

Described external hardware devices 4 can electrically connect on the personal computer by the interface 14 of personal computer, it is also possible to powering on from described personal computer removes.Described electromigration is except referring to that external hardware devices 4 thoroughly disconnects hardware and is connected with personal computer, be relatively following condition K3 mentions remove mode from operating system and propose, described removing from operating system refers to and removes external hardware devices 4 software, now likely described external hardware devices 4 also keeps hardware to electrically connect on a personal computer, being external hardware devices being unloaded of operating system bottom, operating system can not detect described external hardware devices 4.Therefore described electromigration is except referring to that hardware disconnects, and described removing from operating system refers to that software disconnects.

Described external hardware devices 4 has storage capacity and covers the personal computer external device (ED) that next part of normal conditions itself possesses data space, completes the specific function of non-memory function, such as described external hardware devices adopts video card, video card just includes the video memory possessing data space, but the major function of video card is to provide interface to graphic processing data and for display；Described external hardware devices 4 have storage capacity also include one itself do not possess data space, complete non-memory function specific function, the personal computer external device (ED) that is additionally arranged data storage capacities in order to realize the object of the invention specially, such as network interface card does not have data storage function under normal conditions, but in order to realize the present invention, exclusive data memory space can be set in network interface card, thus supporting the external hardware devices with storage capacity of the present invention；Certainly be easy to most application be exactly one itself possess data space, self function is also applied for the personal computer external device (ED) of data storage, namely described external hardware devices is the external data storage device for completing data storage outside personal computer, for instance portable hard disk.

In order to improve the disguise of key, for storing that the operating system that the memory space of key is personal computer cannot correctly read and write wherein data and the memory space of wherein data can correctly be read and write by enciphering/deciphering software in described external hardware devices 4.Although namely the data in the memory space of described storage key can be read and write by the operating system of personal computer, but operating system can not be correct identify described storage key memory space in data, namely the operating system of personal computer cannot determine data type, cannot judge what software is data be used for, and then the true content of data cannot be judged, and the data in the memory space of storage key only just can be correctly identified with described enciphering/deciphering software, namely determine data type, Identification Data content.The simplest implementation of the memory space of described storage key; it is exactly implemented enciphering/deciphering protection by the data in the enciphering/deciphering software memory space to this storage key; thus making the data in the memory space of storage key correctly can only be read and write by enciphering/deciphering software, and correctly can not be read and write by the operating system of personal computer.Described external hardware devices 4 should be can electrically connect personal computer easily, can also powering on from personal computer easily and remove, namely described external hardware devices 4 should be personal computer need not be implemented dismounting just can complete the electrical connection of external hardware devices 4 and electromigration removes.First embodiment of the invention, the described interface for electrically connecting described external hardware devices 4 is USB (universal serial bus) UniversalSerialBus interface, i.e. USB interface, thus consider most applicable cases, the external hardware devices 4 of first embodiment of the invention adopts the low capacity data storage device possessing USB interface, namely possesses the portable hard disk of USB interface, the USB flash disk being namely commonly called as.Described method comprises the steps:

A., enciphering/deciphering software is installed on described personal computer internal operating system；It is stored in key in described external hardware devices 4；In first embodiment of the invention, external hardware devices 4 one_to_one corresponding of described key and this key of storage, namely in each external hardware devices 4, the key of storage is unique.Described key is stored in external hardware devices 4 and can carry out before external hardware devices manufacture completes to dispatch from the factory.

B. on described personal computer internal operating system, the driver based on described external hardware devices is installed, thus setting up the enciphering/deciphering driving function of a data filter net type between the physical equipment and incoming/outgoing management device of operating system bottom.

First embodiment of the invention, as in figure 2 it is shown, described operating system is disposed with installable file system layer InstallableFileSystem64, file system driver layer 65, device driver layer 66 and hardware abstraction layer HardwareAbstractionLayer67 between incoming/outgoing management device 63 to physical equipment.Described installable file system layer InstallableFileSystem64 is called for short IFS layer 64, and described hardware abstraction layer HardwareAbstractionLayer67 is called for short HAL layer 67.The enciphering/deciphering driving function 61 of described data filter net type is based upon between described installable file system layer IFS64 and described file system driver layer 65.Described I/O management device 63 and operating system kernel 62 interaction data.Described enciphering/deciphering driving function is arranged on the bottom of operating system, and logarithm is executed filter net type factually and processed, and on operating system running not impact, applies close, deciphering factually at data gateway logarithm, it is ensured that the reliability of data enciphering/deciphering process.In first embodiment of the invention, as in figure 2 it is shown, described physical equipment includes the hard disk 12 of personal computer, external data storage device 5 and external hardware devices 4.

C. when described external hardware devices electrically connects described personal computer, described enciphering/deciphering software sets according to user, by the key being stored in described external hardware devices, in the available data storage space that operating system may detect that, set up at least one encryption data storage partition.

As depicted in figs. 1 and 2, the free memory that described operating system may detect that not only includes the idle storage space in the hard disk 12 of operating system place computer, the free memory that described operating system may detect that includes the free memory from personal computer hard disk 12, from the free memory of the external data storage device 5 electrically connected on a personal computer, from the free memory of described external hardware devices 4.First embodiment of the invention, described encryption data storage partition is based upon the free memory of the hard disk 12 of personal computer.

Described external data storage device 5 is independently of the external data storage device of described personal computer, and the interface by this personal computer can be connected electrically on described personal computer, it is also possible to powering on from described personal computer removes.

Through above-mentioned steps C so that data interaction is implemented by following condition in each encryption data storage partition,

K1. when external hardware devices 4 does not electrically connect with described personal computer, described enciphering/deciphering software is not loaded with described encryption data storage partition, and namely operating system can not detect described encryption data storage partition；Now encryption data storage partition is in hidden state；

K2. after external hardware devices 4 electrically connects with the foundation of described personal computer, described enciphering/deciphering software by the encryption data storage partition carry set up according to the key of storage in this external hardware devices 4 in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when reading data from described encryption data storage partition, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；During to described encryption data storage partition write data, described enciphering/deciphering driving function implements encryption by double secret key write data；

The present invention allows there is the situation each setting up encryption data storage partition in a personal computer with the different keys from different external hardware devices 4 respectively, in such cases, electrically connecting an external hardware devices 4 can only make the encryption data storage partition carry with the key foundation of storage in this external hardware devices 4 in incoming/outgoing management device, and the encryption data storage partition set up with the key of storage in other external hardware devices 4 is in hidden state.Namely encryption data storage partition is corresponding with the key setting up this encryption data storage partition institute foundation.

Above-mentioned condition achieves key and the isolation adding ciphertext data, key storage is in external hardware devices 4, add ciphertext data and be stored in encryption data storage partition, except the user of external hardware devices 4, other people are difficult to obtain key simultaneously and add ciphertext data, giving away secrets, probability is minimized, and order safer add ciphertext data.Above-mentioned condition achieves general data and the isolation adding ciphertext data simultaneously, under normal circumstances, except the user of external hardware devices 4, other people can't see encryption data storage partition the operating system of personal computer, just do not know to have and add ciphertext data existence, it is to avoid other people produce the motivation stolen secret information yet.Further enhancing the safety adding ciphertext data.General data and the isolation adding ciphertext data also make virus and trojan horse program be difficult to invade encryption data storage partition, and order adds ciphertext data and possesses anti-virus and the ability of opposing trojan horse program.

First embodiment of the invention, as it is shown on figure 3, the idiographic flow embodied between user thread 710, PC operating system thread 720 and external hardware devices thread 730 in implementing enciphering/deciphering process.

By flow process 711 user, external hardware devices 4 is electrically connected to personal computer；Flow process 731, external hardware devices 4 and personal computer carry out device authentication, and through verification process, flow process 732 has passed through device authentication, and personal computer reads the key in external hardware devices；When there is the encryption data storage partition set up according to this key in the available data storage space that operating system may detect that, flow process 721 turns on described encryption data storage partition, operating system can detect described encryption data storage partition, namely will encrypt data storage partition carry on an operating system.As it has been described above, encryption data storage partition is based upon in the hard disk of personal computer by first embodiment of the invention.Said process completes to load encryption data storage partition process with the key in external hardware devices 4.

When user needs to open the file in encryption data storage partition, i.e. flow process 712, when reading data from described encryption data storage partition, by flow process 722, operating system reads ciphertext data from the encryption data storage partition in hard disk, and when data are by described enciphering/deciphering driving function, the ciphertext data that this function reads by double secret key implement deciphering, subsequently in flow process 723, the plaintext document in encryption data storage partition is shown to user by operating system.Said process completes the reading process to encryption data storage partition.

When user needs to be preserved by file to encryption data storage partition, i.e. flow process 713, during to described encryption data storage partition write data, by flow process 724, the encryption data storage partition that operating system will be stored in after file encryption in this hard disk, when data are by described enciphering/deciphering driving function, the file data that described enciphering/deciphering driving function writes by double secret key implements encryption, subsequently in flow process 725, to user, operating system shows that preservation completes, namely encryption data storage partition it can be seen that described in be saved file.Said process completes the ablation process to encryption data storage partition.

When external hardware devices 4 is powered on from personal computer and to remove by user, namely flow process 714 pulls up external hardware devices 4 from personal computer, operating system obtains the information that external hardware devices 4 is unplugged, just unload described encryption data storage partition, complete flow process 726, i.e. unloading encryption data storage partition, subsequently flow process 727 on I/O management device, operating system reflects the unloading of encryption data storage partition to user, and namely operating system can not detect encryption data storage partition.

Little owing to taking up room, portable, information and file that individual demand is maintained secrecy by a lot of users are saved in external data storage device 5, namely set up encryption data storage partition in external data storage device 5, and described external data storage device 5 adopts USB flash disk mostly.But carry with external hardware devices 4 and 5 two hardware of external data storage device easily make user feel inconvenience, thus external hardware devices 4 and external data storage device 5 are united two into one by second embodiment of the invention, namely setting up encryption data storage partition in external hardware devices 4, described external hardware devices 4 exactly for completing the external data storage device of data storage outside personal computer.As shown in Figure 4, set up in the situation of encryption data storage partition in external hardware devices 4, the idiographic flow in implementing enciphering/deciphering process between user thread 810, PC operating system thread 820 and external hardware devices thread 830.

By flow process 811 user, external hardware devices 4 is electrically connected to personal computer；Flow process 831, external hardware devices 4 and personal computer carry out device authentication, and through verification process, flow process 832 has passed through device authentication, and personal computer reads the key in external hardware devices；When there is the encryption data storage partition set up according to this key in the available data storage space that operating system may detect that, flow process 821 turns on described encryption data storage partition, operating system can detect described encryption data storage partition, namely will encrypt data storage partition carry on an operating system.As it has been described above, encryption data storage partition is based upon in external hardware devices 4 by second embodiment of the invention.Said process completes to load encryption data storage partition process in this external hardware devices 4 with the key in external hardware devices 4.

When user needs to open the file in encryption data storage partition, i.e. flow process 812, when reading data from described encryption data storage partition, by flow process 833, operating system reads ciphertext data from the encryption data storage partition in external hardware devices, and when data are by described enciphering/deciphering driving function, the ciphertext data that this function reads by double secret key implement deciphering, subsequently in flow process 823, the plaintext document in encryption data storage partition is shown to user by operating system.Said process completes the reading process to encryption data storage partition.

When user needs to be preserved by file to encryption data storage partition, i.e. flow process 813, during to described encryption data storage partition write data, by flow process 824, the encryption data storage partition that operating system will be stored in after file encryption in external hardware devices, when data are by described enciphering/deciphering driving function, the file data that described enciphering/deciphering driving function writes by double secret key implements encryption, subsequently in flow process 825, to user, operating system shows that preservation completes, namely encryption data storage partition it can be seen that described in be saved file.Said process completes the ablation process to encryption data storage partition.

When external hardware devices 4 is powered on from personal computer and to remove by user, namely flow process 814 pulls up external hardware devices 4 from personal computer, described enciphering/deciphering software obtains the information that external hardware devices 4 is unplugged, just unload described encryption data storage partition, complete flow process 826, i.e. unloading encryption data storage partition, subsequently flow process 827 on I/O management device, operating system reflects the unloading of encryption data storage partition to user, and namely operating system can not detect encryption data storage partition.

As mentioned above, described external hardware devices 4 of pulling up is that the hardware that electromigration removes disconnects process, and remove the software of external hardware devices 4 from operating system and disconnect process and can replace described hardware completely and disconnect process, namely replace and pull up external hardware devices 4 and can replace with removing external hardware devices 4 from operating system.

The present invention also proposes by connecting the method that password further ensures that data safety on key basis, and described step C also includes as follows step by step,

Said method is set up in encryption data storage partition in connection procedure and is differentiated except key also add password except differentiating, both must all be verified and could load encryption data storage partition in operating system.

Above-mentioned connection password is to arrange connection password for each encryption partition holding, and namely described connection password is corresponding with each encryption partition holding, is used for screening encryption partition holding.By above-mentioned steps C of the present invention, obviously multiple encryption data storage partition can be set up based on a key, the operation to the encryption data storage partition set up based on this key can be completed by the external hardware devices 4 having a key, the operation to the encryption data storage partition set up based on another key can be completed by the external hardware devices 4 having another key.Namely all encryption data storage partition can not be operated by external hardware devices 4, the encryption data storage partition set up based on a key can only be operated.Each encryption data storage partition based on same key can be carried out password examination by above-mentioned steps C1 more respectively.Be equivalent to add " the little lock " for encryption data storage partition and addition is representative with key together before all " little lock " " greatly lock " before unlatching encryption data storage partition.Also need to after opening " greatly lock " open " little lock " for different encryption data storage partition, could really open and encrypt data storage partition accordingly.

The present invention also proposes to screen the method further ensuring that data safety of user with connection password, and described step C also includes as follows step by step,

The connection code surface of above-mentioned steps C2 is based on key and connects password, and what be actually accomplished is the examination to user identity, and only key is correct, and user identity is correct, could operate and encrypt data storage partition accordingly.Being equivalent to, before loading encryption data storage partition, be provided with " door lock " with two " keyholes ", only the key in twice " keyhole " is correct, could open " door lock ".

The present invention also proposes the method further ensuring that data safety by data file password on key basis, and step C also includes as follows step by step,

Said method also implements cryptoguard for the encryption file in encryption data storage partition on the basis of encryption data storage partition, adds together " lock " for each file in encryption data storage partition, further ensures that enciphered data safety.

So, being combined with step C3 by above-mentioned steps C1, step C also includes as follows step by step,

K24. after external hardware devices electrically connects with the foundation of described personal computer, the encryption data storage partition only set up according to the key of storage in this external hardware devices exists, simultaneously, user input password with set for this encryption data storage partition connect password consistent when, described enciphering/deciphering software just by described encryption data storage partition carry in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when writing file data to described encryption data storage partition, described enciphering/deciphering driving function implements encryption by double secret key write data, and sets a data file password inputted by user for this write data；From described encryption data storage partition read file data time, when user immediately input password consistent with the data file password set for this reading file data, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；

Can also being combined with step C3 by above-mentioned steps C2, step C also includes as follows step by step,

Prior art is for the personal information of specific function demand; such as account number, password, the conventional information such as web site collection, note; in order to realize encipherment protection; needs are created a file; record described personal information in this document; then again file encryption is processed, operate inconvenient, and be not easy to user and browse.The present invention solves this problem, described method also comprises the steps,

D1., when described external hardware devices electrically connects described personal computer, the information of the need for confidentiality that user is inputted by described enciphering/deciphering software is stored directly in the available data storage space that operating system may detect that.The information of the need for confidentiality of described user input is exactly the personal information of specific function demand, for instance account number, password, the conventional information such as web site collection, note, they are the information that user directly inputs, but not preserve into the information of document form.

The free memory that operating system described in step D1 may detect that includes the free memory from personal computer hard disk, from the free memory of the external data storage device electrically connected on a personal computer, and the free memory from described external hardware devices.

Especially, owing to encryption data storage partition is that operating system may detect that when external hardware devices accesses personal computer, the free memory that so operating system described in step D1 may detect that includes the encryption data storage partition from personal computer hard disk, encryption data storage partition from the external data storage device electrically connected on a personal computer, and the encryption data storage partition from described external hardware devices, thereby further ensure that Information Security

Specifically, enciphering/deciphering software interface arranges simple information encryption memory area, just these information can be saved on encryption data storage partition as long as user operates on enciphering/deciphering software interface.Described enciphering/deciphering software interface can arrange account encrypted area, password encryption district and/or collection etc. and be easy to user and just can operate realization on enciphering/deciphering software interface directly to personal information encipherment protection.

From the angle that information save location is different, described method also includes the step D2 of the information encryption storage of the need for confidentiality to user's input implemented as described below,

The memory space of information of the need for confidentiality for storing key and user's input of described external hardware devices is that the operating system of personal computer cannot correctly read and write wherein data and the memory space of wherein data can correctly be read and write by enciphering/deciphering software.The operating system of personal computer cannot correctly read and write wherein data and enciphering/deciphering software can correctly be read and write the meaning of the wherein memory space of data and describe in detail above, repeat no more herein.The memory space of the information storage of need for confidentiality key and user inputted here makes operating system not detect, and will improve the disguise of the information of the need for confidentiality of key and user's input, and the safety making them is higher.

E1., when described external hardware devices electrically connects described personal computer, key is cryptographically backed up and stores to user in the data space specified by described enciphering/deciphering software, forms encrypted backup data；When needs recover described encrypted backup data, described external hardware devices is electrically connected described personal computer, by described enciphering/deciphering software encrypted backup data are recovered external hardware devices be used for store in the memory space of key.

The present invention also proposes the data backup and resume step E2 based on step D1,

In like manner, the present invention also proposes the data backup and resume step E3 based on step D2,

Above-mentioned steps E1, E2 and E3 are mainly used in preventing from causing because of the loss of external hardware devices losing key, thus described cryptographically backup should be simple encryption backup, and are preferably not the encryption based on backup keys, for instance only with simple password encryption.Due to, the recovery of encrypted backup data is the remedial measure losing external hardware devices, so under convention, the position recovered should be for storing the memory space of key in new external hardware devices, and encrypted backup data can also be recovered encryption data storage partition that available data storage space that specify to user, that operating system may detect that includes setting up according to the key of storage in described external hardware devices certainly.

Specifically, for step E2 and E3, the content of described backup is the information of the need for confidentiality of user's input that user is saved in external hardware devices, the i.e. information of described user's particular demands function, such as account number, password, conventional web site collection, note etc., and the information such as the password that sets of encryption key in this External memory equipment, user.

From improving the concealed angle of key, the memory space of wherein data can correctly be read and write by cannot correctly the reading and writing wherein data for the operating system that the memory space storing key is personal computer of external hardware devices and enciphering/deciphering software.The operating system of personal computer cannot correctly read and write wherein data and enciphering/deciphering software can correctly be read and write the meaning of the wherein memory space of data and describe in detail above, repeat no more herein.

The backup that described user specifies stores the memory space of described encrypted backup data and includes the memory space from personal computer hard disk, memory space from the external data storage device electrically connected on a personal computer, from the memory space of described external hardware devices, and the network storage space from the Internet or LAN.It is to say, user is possible not only to encrypted backup data be backuped on individual's Portable storing device, it is also possible to encrypted backup data are backuped on network memory space, for instance in E-mail address.

Claims

1. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer, based on personal computer, and independent of outside this personal computer, there is the external hardware devices of storage capacity；Described personal computer includes main frame, input equipment and outut device, is provided with central processor CPU, and is stored with the hard disk of operating system and data in described main frame；Described external hardware devices can electrically connect on the personal computer by the interface of personal computer, it is also possible to powering on from described personal computer removes；It is characterized in that described method comprises the steps:

K2. after external hardware devices electrically connects with the foundation of described personal computer, described enciphering/deciphering software by according in this external hardware devices storage key set up encryption data storage partition carry in incoming/outgoing management device, even operating system can detect described encryption data storage partition；Further, when reading data from described encryption data storage partition, described enciphering/deciphering driving function executes deciphering factually by double secret key read number；During to described encryption data storage partition write data, described enciphering/deciphering driving function implements encryption by double secret key write data；

2. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Key described in step A and the external hardware devices one_to_one corresponding storing this key, namely in each external hardware devices, the key of storage is unique.

3. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

For storing that the operating system that the memory space of key is personal computer cannot correctly read and write wherein data and the memory space of wherein data can correctly be read and write by enciphering/deciphering software in described external hardware devices.

4. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Described external hardware devices is the external data storage device for completing data storage outside personal computer.

5. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Described operating system from incoming/outgoing management device to physical equipment between be disposed with installable file system layer InstallableFileSystem, file system driver layer, device driver layer and hardware abstraction layer HardwareAbstractionLayer；

The enciphering/deciphering driving function of described data filter net type is based upon between described installable file system layer IFS and described file system driver layer.

6. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

7. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

The free memory that operating system described in step C may detect that includes the free memory from personal computer hard disk, from the free memory of the external data storage device electrically connected on a personal computer, and the free memory from described external hardware devices；

Described external data storage device is independently of the external data storage device of described personal computer, and the interface by this personal computer can be connected electrically on described personal computer, it is also possible to powering on from described personal computer removes.

8. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

9. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Step C also includes as follows step by step,

10. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Step C also includes as follows step by step,

11. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Step C also includes as follows step by step,

12. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Step C also includes as follows step by step,

13. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Step C also includes as follows step by step,

14. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Also comprise the steps,

15. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 14, it is characterised in that:

16. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 14, it is characterised in that:

The free memory that operating system described in step D1 may detect that includes the encryption data storage partition from personal computer hard disk, from the encryption data storage partition of the external data storage device electrically connected on a personal computer, and the encryption data storage partition from described external hardware devices.

17. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Also comprise the steps,

18. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 17, it is characterised in that:

19. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 1, it is characterised in that:

Also comprise the steps E1,

20. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 14, it is characterised in that:

Also comprise the steps E2,

21. the method setting up enciphering/deciphering memory space by the peripheral hardware key of personal computer according to claim 17, it is characterised in that:

Also comprise the steps E3,

22. according to the method that claim 19 to 21 sets up enciphering/deciphering memory space to arbitrary described peripheral hardware key by personal computer, it is characterised in that:

The memory space of wherein data can correctly be read and write by cannot correctly the reading and writing wherein data for the operating system that the memory space storing key is personal computer of external hardware devices and enciphering/deciphering software.

23. according to the method that claim 19 to 21 sets up enciphering/deciphering memory space to arbitrary described peripheral hardware key by personal computer, it is characterised in that:

The backup that described user specifies stores the memory space of described encrypted backup data and includes the memory space from personal computer hard disk, memory space from the external data storage device electrically connected on a personal computer, from the memory space of described external hardware devices, and the network storage space from the Internet or LAN.