TW201441866A - File protection method for integrating new encrypted virtual disk and hardware verification mechanism - Google Patents

Abstract

The invention relates to a file protection method for integrating a new encrypted virtual disk and a hardware verification mechanism. Primarily, catalogs which exist in a file system are mounted and encrypted into a new encrypted virtual hard disk by means of a driver of the file system, and it can be accessed by a file management mechanism of an operating system itself to enhance the operational efficiency of the file system efficiently. Also, no original alert files exist in the file system, and the program list of the encrypted virtual disk is managed and accessed by a built-in whitelist. Furthermore, it is combined with a hardware and software verification and protection mechanism such that the drive of the verification mechanism of the encrypted virtual disk can be operated but not completely through the software. Thereby the situation that the alert files are broken caused form the leakage of the software program after the loss of the hardware equipment can be avoided efficiently so that the security mechanism for the protection of the alert files can be more efficient and various.

Description

File protection method integrating new encrypted virtual disk and hardware verification mechanism

The invention relates to a file protection method for integrating a new encrypted virtual disk and a hardware verification mechanism, in particular to a file system driver capable of directly mounting and encrypting an existing directory in a file system into a new type. Encrypted virtual hard disk, the encrypted virtual hard disk can be directly accessed by the file management mechanism of the original operating system itself, which can effectively improve the efficiency of the file system operation, and no original confidential and sensitive (smart) files exist in the file system. And manage the list of programs accessing the encrypted virtual disk with a white list built into the driver in advance, combined with various software and hardware verification and protection mechanisms to make the protection of the sensitive file more efficient and diverse file protection. method.

With the rapid development of science and technology, the life of modern people is almost inseparable from the influence of information products. In the office full of information and even in the home life, any form of homework has been closely related to information products and the Internet. In particular, in terms of the storage and use of data, users can save data to a computer, and it is also a very convenient way to transfer or back up data using a mobile device such as a flash drive. Therefore, the sensitive file is stored in the computer. Or the security concerns of mobile devices are increasingly valued by users; smart file encryption is one of the most common methods used to protect sensitive files in current information products, and the most commonly used smart file encryption method is directly The file is compressed, and the system sets a set of decompressable passwords, limiting that only users authorized to own the set of decompressed passwords have the right to decrypt the encrypted file for access.

In the current information system industry, there are two methods for protecting sensitive files, such as traditional file encryption programs and traditional encrypted virtual disks. The traditional file encryption program works by using an encryption program to exist in the file system. The original smart file is encrypted to generate a new encrypted file stored in the original system. The disadvantage of the operating mode of the encrypted program is that the original smart file and the encrypted file are simultaneously present in the file system, and if the hardware device is lost or When the operating system is attacked by hackers, etc., it may seriously cause the leakage of the original smart file.

The traditional encrypted virtual disk uses the driver in the file system to mount the independent virtual disk file as a virtual disk, and then encrypts and decrypts the process while accessing the virtual disk. However, the mode actually accesses the mode. The target is the file, not the file system. Therefore, it is necessary to implement the file management mechanism in the driver to access the virtual disk. The file management mechanism of the original operating system itself cannot be used. This mode of operation easily leads to the execution of file access. Efficiency and stability are degraded, especially when accessing a large number of files. At the same time, most traditional encrypted virtual disks use only the passwords required during installation as a protection mechanism, but provide the function of remembering user passwords. If the operating system is attacked by a hacker or the hardware device is lost, the encrypted virtual disk will be automatically mounted, causing the original smart data to be leaked, or the sensitive file may be cracked due to insufficient strength of the password protection. Serious consequences, therefore, to achieve lower equipment costs, easy assembly, can also increase the file Operational efficiency of the system, thereby enabling the smart file protection within the system allows users worry-free, the industry is still currently need to continue efforts to overcome the problem and the solution.

Nowadays, the inventor is in the light of the insatiable spirit of the above-mentioned existing smart file protection mechanism due to the hacking of the operating system or the loss of hardware equipment, which is easy to cause the leakage of the smart file, and is rich in it. The expertise and years of practical experience have been used to improve and to develop the present invention.

The main purpose of the present invention is to provide a novel encrypted virtual disk whose operation mode is to directly mount and encrypt an existing directory of the file system into an encrypted virtual disk by using a driver in the file system, which can be used by the original operating system. Its own file management mechanism to access, in order to effectively improve the efficiency and stability of the file system operation, and there will be no original sensitive files in the file system, because it operates in the way of encrypting virtual disks, so if users have When editing the file, there is no need to use another program to decrypt the file and then access it. The user can directly operate in the encrypted virtual disk. At the same time, the present invention also has a whitelist in the driver to manage access to the file. The program limitation function of the virtual disk is to prevent a malicious program from accessing after the encrypted virtual disk is mounted; the invention also adds a software and hardware verification and protection mechanism to enable the activation verification mechanism of the encrypted virtual disk and The decryption logic does not operate completely through the software, which can effectively prevent the hardware device from being lost due to the leakage of the software program. The case was cracked situation occurs, thus protecting the security of smart file can be more diverse and efficient.

In order to achieve the above-mentioned implementation purposes, the inventors have developed the following implementation techniques. First, the file directory specified in the system is directly mounted and encrypted into an encrypted virtual disk according to a system loading driver; then, the driver is loaded. A built-in whitelist to verify the access rights of the program to access the encrypted virtual disk. For example, the system only authorizes the Office Word installed in the operating system to access the file located in the encrypted virtual disk. A file named DOC/DOCX, if there are other programs other than the word processing software Office Word, try to access the file with the file name DOC/DOCX, the white list can be automatically prohibited from accessing the program or popping up the warning window. It is up to the user to decide whether to allow access to the program. This method prevents the malicious program from infecting the operating system, and then completes all the verification programs by the encrypted virtual disk and successfully mounts the encrypted virtual disk, waiting for the computer to steal. The original alert file after decryption; finally, in making When accessing the encrypted virtual disk, the program authenticated by the software and hardware authentication and protection mechanism, after the user who wants to access the encrypted virtual disk is authenticated, the driver provides the decryption key. The user is decrypted by the encrypted virtual disk for access, and then the driver is removed to complete the process of protecting the sensitive file.

In an embodiment of the present invention, wherein the encrypted virtual disk is directly mounted and encrypted by a directory existing in the file system, the file management mechanism provided by the original operating system itself can be directly used on the encrypted virtual disk. Internal access can effectively improve the efficiency and stability of the file system operation, and there is no original sensitive file in the file system, because the present invention operates in the manner of encrypting a virtual disk, so if the user has to edit the file When the request is needed, the file can be accessed without decrypting the file, and the user can directly operate on the encrypted virtual disk.

In an embodiment of the invention, the software and hardware verification and protection mechanism for protecting the sensitive file is a mechanism for selectively combining several verification mechanisms, including using a password required during installation. The operating system or the domain limits the user's authority, the built-in hardware verification chip, and the external hardware verification chip, wherein the built-in hardware verification chip can be used in the notebook computer to start The verified fingerprint verification chip, and the external hardware verification chip may be a device such as a conventional Arduino firmware, a Bluetooth device or an RFID module.

(1). . . Driver

(11). . . whitelist

(2). . . Encrypted virtual disk

(3). . . Software and hardware verification and protection mechanism

(4). . . Decryption key

(S1). . . step one

(S2). . . Step two

(S3). . . Step three

The first figure: the flow chart of the steps of the invention for integrating the file protection method of the new encrypted virtual disk and the hardware verification mechanism

The second figure: a schematic diagram of the relationship between the configuration of the new encrypted virtual disk and the file protection method of the hardware verification mechanism

The object of the present invention and its structural design and advantages will be explained in the light of the preferred embodiments shown in the following drawings, so that the reviewing committee can have a more in-depth and specific understanding of the present invention.

First, referring to the first to second embodiments, a block diagram and a relationship configuration block diagram of a file protection method for integrating a new encrypted virtual disk and a hardware verification mechanism according to a preferred embodiment of the present invention include the following steps:

Step 1 (S1): using the system loading driver (1), directly mounting and encrypting the specified file directory in the file system into an encrypted virtual disk (2);

Step 2 (S2): based on the whitelist (11) built into the driver (1), the access to the encrypted virtual disk (2) is verified to access the whitelist (11). When verifying different program accesses, it can be set to automatically prohibit the program from accessing or popping up the warning window. The administrator can decide whether to allow access to the program. This method can prevent the malicious program from infecting the operating system. Encrypting the virtual disk (2) to complete all the procedures for verifying program access rights and successfully mounting the encrypted virtual disk (2), and then waiting to steal the decrypted original smart file;

Step 3 (S3): while the user wants to access the encrypted virtual disk (2), the user authentication process is performed by the software and hardware verification and protection mechanism (3), after the user is authenticated, The driver will provide a decryption key (4) to the user to decrypt the encrypted virtual disk (2) for access. Finally, the system will remove the driver and complete the operation process of protecting the sensitive file. .

Furthermore, the encrypted virtual disk (2) of the embodiment directly mounts the existing directory in the file system, and performs encryption operation while accessing the encrypted virtual disk (2), so that it can be directly used. The file management mechanism provided by the original operating system itself performs data access in the encrypted virtual disk (2) without self-implementation, which can effectively improve the efficiency and stability of program execution, and there is no such original The smart file exists in the file system and is easily read by the interceptor. At the same time, because the embodiment operates in the encrypted virtual disk (2) mode, if the user needs to edit the file, there is no need to use it separately. After the program decrypts the file and edits it, it can be directly operated in the encrypted virtual disk (2). Since the method directly performs encryption and decryption in the background, this method can effectively lower the threshold for the user to learn.

In addition, in combination with the hardware and software verification and protection mechanism (3), the system also selectively combines the following various mechanisms to perform an authentication procedure of a user who wants to access the encrypted virtual disk (2) to achieve startup verification. And the process of protecting subsequent use:
1. Use the password required during installation to initiate verification.
2. Start verification by the operating system or domain user rights.

3. Use built-in hardware verification chip, such as the built-in user fingerprint identification chip of the notebook computer for boot verification.

4. Boot verification using an external hardware verification chip, which can be one of three formats:
A. Enter the password to a known Arduino via the USB device. The Arduino firmware will provide the decryption key after the password is correct (4) for the user who wants to read the encrypted virtual disk (2) to decrypt. If the password is incorrect, the system will automatically disable the function of providing the decryption key (4), so that the encrypted virtual disk (2) cannot be normally used for system mounting.
B. Connect the Arduino with a USB device, install the Bluetooth communication board on the Arduino, and then bind it to the Bluetooth device that the legitimate user carries with it, such as Bluetooth headset, etc. If the Bluetooth communication board cannot detect Detecting the bound Bluetooth device, indicating that the legitimate user does not exist in the range of the Bluetooth device monitorable device, so the encrypted virtual disk (2) is automatically uninstalled immediately, and the decryption key is automatically closed (4) The function, until the detected Bluetooth device is re-detected and the user completes the relevant authentication procedure, the system only provides the function of providing the decryption key (4), which can avoid the intention of using social engineering and other means. The legitimate user is transferred from the range of the monitorable device and is waiting to access the smart file in the encrypted virtual disk (2) that has completed the verification.
C. Connect the Arduino with a USB device, install the RFID communication board module on the Arduino firmware, and then distribute the authenticated related RFID card or verify the RFID card to the legal user to which it is bound. The system must be After successfully reading the allotted RFID card and performing related user authentication procedures, the function of providing the decryption key (4) is turned on for the user to decrypt.

It can be seen from the above-mentioned file protection method and implementation description of the new encrypted virtual disk and hardware verification mechanism that the present invention has the following advantages:
1. The file protection method with integrated encryption virtual disk and hardware verification mechanism of the present invention directly mounts and encrypts the existing directory of the file system into an encrypted virtual disk by the driver in the file system, which can be the original job. The file management mechanism of the system itself is accessed to effectively improve the efficiency and stability of the file system operation.
2. The file protection method with integrated encryption virtual disk and hardware verification mechanism of the present invention will not have the original smart file in the file system, because it operates by encrypting the virtual disk, so if the user has When editing the file, you do not need to use the program to decrypt the file and access it. The user can directly operate in the encrypted virtual disk. This technology can directly perform encryption and decryption in the background. This method can also effectively reduce the use. The threshold for first time learning.
3. The file protection method with integrated encrypted virtual disk and hardware verification mechanism of the present invention is a whitelist added to the driver of the file system to manage the function of the program to access the encrypted virtual disk, and the system can be set to automatic It is forbidden for the program to access or pop up the warning window. The administrator decides whether to allow access to the program. This method can prevent the program from being accessed by the encrypted virtual disk after the malicious program infects the operating system. After successfully mounting the encrypted virtual disk, it waits for an opportunity to steal the decrypted original smart file.
4. The file protection method with integrated encryption virtual disk and hardware verification mechanism of the invention uses a software and hardware verification and protection mechanism, so that the startup verification mechanism and encryption and decryption logic of the encrypted virtual disk are not completely operated by software. In this way, it can effectively avoid the situation that the smart file is cracked due to the software program leakage after the hardware device is lost, so that the security mechanism of the smart file protection can be more efficient and diverse.

In summary, the file protection method of the present invention integrating the new encrypted virtual disk and the hardware verification mechanism can achieve the intended use efficiency by the above disclosed embodiments, and the present invention has not been disclosed in the application. Before, Cheng has fully complied with the requirements and requirements of the Patent Law.爰Issuing an application for a patent for invention in accordance with the law, and asking for a review, and granting a patent, is truly sensible.

The illustrations and descriptions of the present invention are merely preferred embodiments of the present invention, and are not intended to limit the scope of the present invention; those skilled in the art, which are characterized by the scope of the present invention, Equivalent variations or modifications are considered to be within the scope of the design of the invention.

(S1). . . step one

(S2). . . Step two

(S3). . . Step three

Claims (5)

The file protection method for integrating the new encrypted virtual disk and hardware verification mechanism includes the following steps:
Step 1: Use the file system driver to mount the existing directory of the file system directly as an encrypted virtual disk;
Step 2: establish a whitelist in the driver, manage the list of programs accessing the encrypted virtual disk; and step 3: in the process of the user accessing the encrypted virtual disk, perform the software and hardware verification and protection mechanism The relevant identity verification program, after passing the verification, provides the decryption key to the user to decrypt the encrypted virtual disk. The file protection method for integrating the new encrypted virtual disk and the hardware verification mechanism, as described in claim 1, wherein the encrypted virtual disk file system already exists in a directory, and the file management mechanism provided by the operating system can be directly used. Access is made within the encrypted virtual disk. The file protection method for integrating a new encrypted virtual disk and a hardware verification mechanism according to the first aspect of the patent application, wherein the software and hardware verification and protection mechanism selectively combines several verification mechanisms, and the plurality of verification mechanisms are This includes using the password required for installation, restricting the user's authority with the operating system or domain, built-in hardware verification chip, and one of the external hardware verification chips. The file protection method for integrating a new encrypted virtual disk and a hardware verification mechanism as described in claim 3, wherein the built-in hardware verification chip is a fingerprint verification chip. The file protection method for integrating the new encrypted virtual disk and the hardware verification mechanism, as described in claim 3, wherein the external hardware verification chip is one of an Arduino firmware, a Bluetooth device or an RFID module. .