TWI354910B - Storage device or enterprise computer and equipmen - Google Patents

Storage device or enterprise computer and equipmen Download PDF

Info

Publication number
TWI354910B
TWI354910B TW97103013A TW97103013A TWI354910B TW I354910 B TWI354910 B TW I354910B TW 97103013 A TW97103013 A TW 97103013A TW 97103013 A TW97103013 A TW 97103013A TW I354910 B TWI354910 B TW I354910B
Authority
TW
Taiwan
Prior art keywords
storage device
computer system
resident
boot record
program
Prior art date
Application number
TW97103013A
Other languages
Chinese (zh)
Other versions
TW200933429A (en
Inventor
Wen Chang Huang
Original Assignee
Fineart Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fineart Technology Co Ltd filed Critical Fineart Technology Co Ltd
Priority to TW97103013A priority Critical patent/TWI354910B/en
Publication of TW200933429A publication Critical patent/TW200933429A/en
Application granted granted Critical
Publication of TWI354910B publication Critical patent/TWI354910B/en

Links

Description

^354910 九、發明說明: 【發明所屬之技術領域】 本發明是有關於一種儲存裝置管理方法'企業内邱 備㈣㈣及資爐存裝置,且制是有_—種以常駐 :哉程式解密預先加密主開機記錄以防止儲存裝置與企業内 $電腦系統設備遭到非法使用之儲存裝置管理方了法/企二内 電腦系統設備控管方法及資訊儲存裝置。 〃 【先月u技術】 隨著電腦化趨勢與資訊傳播設備不斷推陳出新,各種資訊 傳,安全相關問題與解決方案也相應提出,因為缺乏資訊安全 造成資料外$、#料被增刪竄改、因電财毒而造i 腦相關的服務停擺、企業與個人日常工作無法進行等諸多 ,企業或個人蒙受重大損失與不便的嚴重後果。前述各種問題 ,又以資料外洩與企業内部電腦系統設備使用缺乏控管所產 生的不利影響最為重大,因為企#的研發結果、營業秘密、財 2況或客戶資料等f訊流落在外,刻影響產品的研發上市 =成客戶流失,重則使企業失去技術發展上策略性的競 的重===財務危機,所以各種有效資安方案導入實施 然而」習知企業内機密資料外⑽防護與控管策略方面 ’…统官理者軸可以週紐地藉由電腦系統以 單進行權限設定與控制’但是缺乏自動化機: 將,系統㈣者因為必須人卫賴使綠態而無法有效降低 人配置與精神耗費’並且也無法克服刻意或過 資 料透過硬碟錢㈣等儲存裝置料雜與被串接 5 1354910 步舉例來看’資料存取控織體—祕儲存 料^於關時自純行’如此錢於㈣完錢立即執 的工作,糾機磁碟自原電腦系統實體移除而串1為= 制====磁碟’而且另—電腦系統未安裝資料存取控 ^軟體嘯使仔原開機磁碟便如同單純儲存資料的磁碟而不且 可防護,使用者將可自由傳輸'列印資料或將資料 、 參 吏資細。故,如何解決上述問題,使開機 碟荨儲存裝置即使被串接仍無資料_之虞,實為所冀。 【發明内容】 本發明提供儲存裝置管理方法及資訊儲存裝置,以防止 子裝置與企業内部電腦系統設備遭到非法使用而引發資 洩等資訊安全問題。 本發明的其他目的和優點可以從本發明所揭露的 徵中得到進一步的了解。 、 為達上述之一或部份或全部目的或是其他目的,本發明一 實施例提出-_存裝置f理方法,包含以下步驟:首先,當 儲,裝置連制用戶端電腦系鱗,以預設洲戶端電腦系ς 的常駐攔截程式自程序進入點擷取並檢視儲存裝置主開機記 錄L接著,主開機記錄係已加密,常駐攔截程式檢視主開機記 錄疋否有特定標記,並且若主開機記錄具有特定標記,常駐攔 截,式解密主開機記錄並且呼叫作業系統自程序進入點讀取 解後之主開機記錄’以啟動用戶端電腦系統與允許存取儲存裝 置。 為達上述之一或部份或全部目的或是其他目的,本發明一 實施例再提出一種企業内部電腦系統設備控管方法,其中企業 6 1354910 端電腦系統、,端電腦 先佈署於飼服端電腦系統。本:;端且預 統設備控管方法包含以下步驟施内部電腦系 記:接著以預設於用戶端電腦 機記錄,然後若常駐攔截程式檢得主開機 s己錄特疋標Κ解密主開機記錄並对叫作獅統自程序進 解密後主開機記錄,以啟動用戶端電腦系統並允許存 取储存裝置。 為達上述之-或部份或全部目的或是其他目的,本發明一 種資訊儲純置’此資訊儲存裝置具有記憶體 已加费主開機記錄及特定標記,已加密主開機記錄以預 ^用戶端電齡統的相對應t駐攔齡式解密,用戶端電腦 …统則電性連接且預先佈署於伺服端電腦系統。 ^發鴨存裝置管理方法、企業内部電H賊備控管方 訊儲存裝置因採用以常駐纖程式自浦取並檢視儲 ”開機記錄’並且作為已加密主開機記錄對應的解密機 制’因此可叹得儲純置即使被串接仍無㈣㈣之虞,並 =使得系統館體者與儲存裝置擁有者藉由自動化監控增進工 作效率與受益於有效資訊安全方案。 為讓本發明之上述和其他目的、特徵和優點能更明顯易 下文特舉較佳實施例,並配合所附圖式,作詳細說明如下。 【實施方式】 入有關本發明之前述及其他技術内容、特點與功效,在以下 配合參考圖叙—較佳實關的詳細朗巾將可清楚的呈 7 1354910 現。 ^ 一般而言,習知x86電腦系統開機時,系統的BIOS檢查 系統主記憶體、系統日期與時間、現有磁碟機與順位等參數並 決定開機媒體。BIOS通常優先檢查軟碟與光碟等磁碟機以尋 找開機程式,如果沒發現開機程式,之後才會檢查主要硬碟的 第一個磁區(sector)並至指定位址載入作業系統,因此,χ86電 腦系統的主開機記錄通常就是位於開機硬碟長度512位元 (bytes)的第一個分割磁區(partiti〇n sect〇r),用以啟動載入預選 鲁作業系統或GRUB選單或GRUB命令輸入介面的程序。此外, 每個分割磁區描述了磁區起始位址與型態等資訊且用以描述 一到多個分割,其格式包含分割位址偏移量(〇ffset)、大小(size) 以及型態(type/meaning)等欄位以分別描述各分割之起始位 置、大小與内容種類與意義等資訊,並且開機載入程式碼只存 在於主開機記錄。進一步來看,主開機記錄包含了一個小型的 主開機程式(MBP,Master Boot Program),當開機程式碼被開 機載入程式載入並執行時,相對應作業系統即被啟動。 承上’主開機記錄與各分割之程序進入點(entry point)格 式與内容依據各作業系統而有所不同,現舉例說明如下。請參 閱圖1A與1B,習知主開機記錄丨丨具有分割位址偏移量(〇 ffs e t) 欄位111、大小(size)攔位112與型態(type/meaning)攔位η] 以分別描述各分割之邏輯位址、大小與内容種類與意義,例如 在此實施例中’十六進制分割位址偏移量000h的446位元組 為開機載入程式碼,分割位址偏移量1BEh的16位元組為第 一分割之程序進入點,分割位址偏移量lCEh的16位元組為 第二分割程序之進入點等;單筆分割之程序進入點記錄也具有 位址偏移量欄位121、大小欄位122與型態欄位123以分別描 8 1354910 述各分割程序之邏輯位置起始位址、大小 因此以代表磁柱號碼/磁頭號碼/磁…:義,^354910 IX. Description of the invention: [Technical field of the invention] The present invention relates to a method for managing a storage device's enterprise Qiubei (4) (4) and a furnace storage device, and the system has a _-type resident: 哉 program decryption in advance Encrypting the main boot record to prevent storage devices and storage devices in the enterprise from being illegally used by the storage device management method and computer system device control method and information storage device. 〃 【First month u technology】 With the trend of computerization and information dissemination equipment constantly updated, various information transmission, security-related problems and solutions are also proposed accordingly, because the lack of information security caused the data outside the $, # material was added, deleted, tampering, due to electricity Poisoning and i-related service closures, business and personal daily work can not be carried out, and many serious losses and inconveniences suffered by enterprises or individuals. The above-mentioned various problems are most important because of the negative impact of data leakage and the lack of control over the use of internal computer system equipment, because the company’s research and development results, business secrets, financial situation or customer information are flowing out. Influencing the R&D and listing of products = the loss of customers, but the loss of the strategic development of the technical development of the company === financial crisis, so all kinds of effective security plans are introduced into the implementation. However, it is known that the confidential information outside the enterprise (10) protection and control In terms of management strategy, the official axis can be set and controlled by the computer system in a single way. However, the lack of an automated machine: The system (4) cannot effectively reduce the human configuration because it must be green. And the spirit of spending 'and can not overcome the deliberate or over the data through the hard disk money (four) and other storage devices mixed with the serial number of 5 1354910 steps to see 'data access control texture - secret storage material ^ at the time of the pure line 'So money in (4) the work immediately completed, the machine disk removed from the original computer system entity and string 1 = system ====disk 'and another - computer system is not installed Data access control ^Software whistle makes the original boot disk as a disk that simply stores data and is not protected. Users will be free to transfer 'printed data or data and data. Therefore, how to solve the above problems, so that the boot disk storage device has no data even if it is connected in series, it is really awkward. SUMMARY OF THE INVENTION The present invention provides a storage device management method and an information storage device to prevent information security problems such as credits from being illegally used by child devices and internal computer system devices. Other objects and advantages of the invention will be apparent from the teachings of the invention. In order to achieve one or a part or all of the above or other purposes, an embodiment of the present invention provides a method for storing a device, including the following steps: First, when the device is connected to the user computer scale, The resident interception program of the preset computer system is captured from the program entry point and the storage device main boot record is recorded. Then, the main boot record is encrypted, and the resident intercept program checks whether the main boot record has a specific mark, and if The master boot record has a specific flag, resident intercept, decrypts the master boot record and calls the operating system to read the master boot record from the program entry point to activate the client computer system and allow access to the storage device. In order to achieve one or a part or all of the above or other purposes, an embodiment of the present invention further provides a method for controlling the internal computer system equipment of an enterprise, wherein the enterprise 6 1354910 end computer system and the end computer are first deployed in the feeding service. End computer system. This: and the pre-master device control method includes the following steps to apply the internal computer system record: then preset to the user-side computer machine record, and then if the resident interception program checks the main boot s recorded special mark to decrypt the main boot record And the main boot record called the lion system after the program is decrypted, to start the client computer system and allow access to the storage device. In order to achieve the above-mentioned or some or all of the purposes or other purposes, the information storage device of the present invention has a memory-charged master boot record and a specific mark, and the encrypted master boot record is pre-compressed. The corresponding terminal age of the terminal system is decrypted, and the client computer is electrically connected and pre-arranged in the server computer system. ^ The management method of the duck storage device, the internal power storage device of the enterprise, and the storage device of the internal thief standby control device are adopted by the resident fiber program to view and store the "boot record" and serve as the decryption mechanism corresponding to the encrypted master boot record. The sigh of pure reserve is not even after (4) (4), and makes the system builder and storage device owner enhance the work efficiency and benefit from the effective information security program through automated monitoring. To make the above and other aspects of the present invention The above and other technical contents, features and effects related to the present invention are as follows, which will be described in detail below with reference to the accompanying drawings. In conjunction with the reference picture, the detailed cover of the better case will be clearly shown as 7 1354910. ^ Generally speaking, when the conventional x86 computer system is turned on, the system BIOS checks the system main memory, system date and time, and existing The disk drive and the order parameters determine the boot media. The BIOS usually checks the diskettes such as floppy disks and CDs to find the boot program. After that, the first sector of the main hard disk is checked and loaded into the operating system at the specified address. Therefore, the master boot record of the χ86 computer system is usually 512 bits (bytes) at the boot disk length. The first split magnetic region (partiti〇n sect〇r) is used to initiate the loading of the pre-selected Lu operating system or the GRUB menu or the GRUB command input interface. In addition, each split magnetic region describes the magnetic region start bit. Information such as address and type and used to describe one or more partitions. The format includes fields such as split address offset (〇ffset), size (type), and type/meaning to describe each partition separately. Information such as the starting position, size and content type and meaning, and the bootloader code only exists in the main boot record. Further, the master boot record contains a small master boot program (MBP). When the boot code is loaded and executed by the boot loader, the corresponding operating system is started. The main boot record and each split program entry point format and content are based on each operating system. The difference is as follows. Referring to Figures 1A and 1B, the conventional master boot record has a split address offset (〇ffs et) field 111, size 112 and type (type). /meaning) Block η] to describe the logical address, size, and content type and meaning of each partition, for example, in this embodiment, the 446-bit hexadecimal address offset 000h is the boot load. Into the code, the 16-bit group of the split address offset 1BEh is the program entry point of the first split, the 16-bit tuple of the split address offset lCEh is the entry point of the second split program, etc.; The program entry point record also has an address offset field 121, a size field 122 and a type field 123 to respectively describe the logical position start address and size of each segmentation program, thus representing the cylinder number. / head number / magnetic...: righteous,

Cyhnder/Head/S⑽。⑽CHS格式來界定以第5位元組記錄之 分割號碼所屬分·細訖位置時,分難序進人點記錄12 的苐2到4位元_以記錄磁柱、磁頭、磁轉碼以說明分巧 程序起始位置,第6到8位元組則用以另—組記錄磁柱、磁頭、 磁區號碼以分_序結束位置^因此可峰知,主開機記 錄的CHS參數值為o/0/i。Cyhnder/Head/S (10). (10) When the CHS format is used to define the sub-divisional location of the segmentation number recorded in the fifth byte, the 苐2 to 4-bit _ of the hard-to-order entry point record 12 is used to record the magnetic cylinder, the magnetic head, and the magnetic transcoding to illustrate The starting position of the programming program, the 6th to 8th byte is used to record the magnetic column, the magnetic head, and the magnetic area number in the other group to end the position. Therefore, it can be known that the CHS parameter value of the main power-on record is o. /0/i.

請參閱圖2,本發明-實施例之儲存裝置管理方細部流程 ^步驟如_示。於步驟S21G,讀存裝置連結至用戶端電 腦系統時,以預設於用戶端電腦系統之常駐攔截程 進入點擷取並檢視儲存裝置之主開機記錄,儲存裝置可以是外 接式磁碟、外接式硬碟或USB移動碟。於步驟幻2〇,若主開 機記錄係已加密,常駐攔截程式檢視主開機記錄是否有特定標 記,且於步驟S230,若主開機記錄不具有該特定標記,常駐 攔截程式返回程序進入點,並於步驟S24〇回傳一錯誤警示訊 息,然後於步驟S250禁止啟動用戶端電腦系統與存取儲存裝 置。 另一方面,再次承上步驟S220,於步驟S26〇若主開機記 錄具有特定標記,常駐攔截程式解密主開機記錄並且呼叫作業 系統自程序進入點讀取解密之主開機記錄,以啟動用戶端電腦 系統與允許存取儲存裝置。在此實施例中,儲存裝置連結至用 戶端電腦系統時觸發一自動加密機制而加密主開機記錄,並預 設以常駐攔截程式作為解密機制;在其他此實施例中,主開機 記錄可以在伺服端電腦系統預先登錄與加密,並以常駐攔截程 式作為解密機制,而且用戶端電腦系統可預先佈署於伺服端電 9 腦系統,並藉由有線或無線方式連接伺服端電腦系統。 在此說明,本發明之常駐攔截程式自動置換視窗作業系統 的動態連結函式庫(Dynamic Link Library)中原定程序進入點 為自疋解雄程序進入點而完成解密作業,然後執行自定解密程 序後呼叫系統原定程序進入點繼續執行,或直接略過而跳回呼 叫點,並且在使用者與作業系統結束對原定程序的操作時,自 動加密此原定程序。換言之,常駐攔截程式的概念是透過動態 载入程式dynamic Loader)將特定一小段程式附加到系統正在 運作,行程(process)或執行緒(thread)中,然後再於執行自定程 序後交回控制權。因此,在本發明實施例中,可以攔截欲監控 的主開機記錄及他應用程式的程序進人點,且若檢視岀主開機 記錄,已加密或未加密後’可以制斷是否具有特定標記而依 ,自疋私序執行解密或不解密而直接跳回呼叫點,所以能夠控 管儲存裝置_戶端電㈣統衫合法使用,從而達成機密^ 料不外 與系統自動監控的資安方案。 —睛參閱圖3,本發明另一實施例之企業内部電腦系統設備 控管方法細部流程各步驟如圖所示。在此實施例令,企業内部 電腦系統設備可以包含—到多部用戶端電腦系統、舰端電腦 系統與儲錢置,並且用戶端電㈣統預先料於舰端電腦 系統。首,,於步驟S310加密儲存裝置之主開機記錄,儲存 裝置可以是外接式輯、外接式硬碟或USB移動碟,並且當 儲存裝置連結ϋ用戶端電腦系統時觸發自動加密機制使得主 開機,錄被加密,並預設以常駐攔截程式作為解密機制;在其 他,實施彳种’主職記錄可以於概端電齡鋪先登錄與 加,’並財駐峨程式作為浦㈣,好端電腦系統以有 線或無線方式連接簡服端m統。在此_提,加密時機視 f?354910 =:=有多種實務彈性,例如於用戶端刪 戶端電腦裝置财者未經郝使用用 常駐攔截程式的程;過動態機密與 ===广署採用於·,腦二=:=鎖 ,:糊======恤 駐進於入步:二2=, I㈣曰檢得主開機記錄特定標記,解密主開機 ° 呼叫作業系統自程序進入點讀取解密之主開機呓 錄’以啟義戶端電腦系統並允許存取儲存裝置;否則,承^ ^ S32G,於步驟S34G若主開機記錄不具有特定標記,常駐 攔截程式返回程序進入點,於步驟S35〇常駐攔截程式回傳錯 誤s示訊息,並且於步驟S36〇禁止啟動用戶端電腦系統盥 取儲存裝置。 〃 ^請參閱圖4,本發明一實施例資訊儲存裝置與企業内電腦 系統配置如圖所示意。資訊儲存裝置41例如外接式磁碟、外 接式硬碟或USB移動碟,而在此實施例中,企業内電腦系統 具有用戶端電腦系統51、52與伺服端電腦系統53。資訊儲存 裝置41可連接到用戶端電腦系統51或52,而用戶端電腦系 統51與52可藉由有線或無線方式透過網路54連接且預先佈 署於伺服端電腦系統53。資訊儲存裝置41的記憶體41〇存有 已加密主開機記錄及特定標記,其中該已加密主開機記錄係於 伺服知電脱糸統53預先登錄與加密,並且預設藉由用戶端電 腦系統51或52中相對應常駐攔截程式來解密。所以,未預先 ^ ^的用戶端電腦系統就不會建置有相對應常駐攔截程式可 端^ 岔主開機記錄及特定標記的解密機制,而且未在伺服 在腦系統53預先登錄與加密的主開機記錄屬於未加密或是 也合接到用戶端電腦系統51或52時被動態加密而鎖住,所以 置Μ缺乏相對應常駐攔截程式作為解密機制,使得資訊儲存裝 置與隨t之無法被串接與存取,故任何未經授權的資訊儲存裝 將^ 系統資源操作將被禁制,而資訊安全與資源管理目的Referring to FIG. 2, the storage device management side details process of the present invention-embodiment is shown in FIG. In step S21G, when the storage device is connected to the client computer system, the main boot record of the storage device is captured and viewed by the resident interception entry point preset to the user computer system, and the storage device may be an external disk or an external device. Hard drive or USB removable disc. In step 2, if the master boot record is encrypted, the resident interceptor checks whether the master boot record has a specific flag, and in step S230, if the master boot record does not have the specific tag, the resident interceptor returns to the program entry point, and In step S24, an error warning message is sent back, and then the user computer system and the access storage device are prohibited from being activated in step S250. On the other hand, step S220 is again performed. In step S26, if the main boot record has a specific flag, the resident intercept program decrypts the master boot record and the call operating system reads the decrypted master boot record from the program entry point to start the client computer. System and access to the storage device. In this embodiment, when the storage device is connected to the client computer system, an automatic encryption mechanism is triggered to encrypt the master boot record, and the resident interceptor is preset as the decryption mechanism; in other embodiments, the master boot record can be in the servo. The computer system is pre-registered and encrypted, and the resident interception program is used as the decryption mechanism, and the client computer system can be pre-arranged in the server system and connected to the server computer system by wire or wirelessly. Herein, the resident intercepting program of the present invention automatically replaces the window in the dynamic link library of the window operating system, and the original program entry point is to complete the decryption operation from the entry point of the solution, and then perform the self-decryption. After the program, the calling system original program enters the point to continue execution, or jumps directly back to the call point, and automatically encrypts the original program when the user and the operating system end the operation of the original program. In other words, the concept of the resident interceptor is to attach a specific small program to the system in operation, process or thread, and then return the control after executing the custom program. right. Therefore, in the embodiment of the present invention, the main boot record to be monitored and the program entry point of the application may be intercepted, and if the master boot record is checked, the encrypted or unencrypted 'can be broken whether the specific mark is According to the private order, the decryption or non-decryption directly jumps back to the call point, so it can control the storage device _ the end of the electricity (four) unified use of the shirt, so as to achieve confidentiality and the system automatically monitors the security plan. - See Figure 3, the steps of the detailed process of the internal computer system equipment control method of the enterprise according to another embodiment of the present invention are as shown in the figure. In this embodiment, the internal computer system equipment of the enterprise may include - to a plurality of client computer systems, the ship computer system and the money storage device, and the customer terminal power (four) system is expected to be in the ship terminal computer system. First, in step S310, the main boot record of the storage device is encrypted. The storage device may be an external serial, an external hard disk or a USB mobile disk, and trigger an automatic encryption mechanism to enable the main boot when the storage device is connected to the client computer system. The recording is encrypted, and the resident interception program is preset as the decryption mechanism; in other cases, the implementation of the 'main job record can be registered and added to the front-end electric age shop,' and the financial program is used as Pu (four), good-end computer The system is connected to the simple device by wired or wireless. In this case, the encryption time is as follows: f?354910 =:= There are a variety of practical resilience, for example, the user of the user-side computer device is not used by Hao to use the resident interception program; the dynamic secret and the === Adopted in, brain 2 =:=lock,: paste ====== shirt in the step: 2 2 =, I (four) 曰 check the master boot record specific mark, decrypt the main boot ° call operating system from the program entry point Read the decrypted master boot record 'to enable the client computer system and allow access to the storage device; otherwise, ^ ^ S32G, in step S34G if the master boot record does not have a specific tag, the resident intercept program returns to the program entry point, In step S35, the resident interception program returns an error s message, and in step S36, prohibits the activation of the client computer system to retrieve the storage device. Referring to FIG. 4, an information storage device and an in-house computer system configuration according to an embodiment of the present invention are illustrated. The information storage device 41 is, for example, an external disk, an external hard disk or a USB mobile disk. In this embodiment, the in-house computer system has a client computer system 51, 52 and a server computer system 53. The information storage device 41 can be connected to the client computer system 51 or 52, and the client computer systems 51 and 52 can be connected via the network 54 by wire or wirelessly and pre-arranged to the server computer system 53. The memory 41 of the information storage device 41 stores an encrypted main boot record and a specific mark, wherein the encrypted main boot record is pre-registered and encrypted by the servo device, and is preset by the client computer system. 51 or 52 corresponds to the resident interception program to decrypt. Therefore, the client computer system that is not pre-committed will not have a corresponding resident interception program capable of decrypting the main boot record and the specific mark, and is not pre-registered and encrypted in the brain system 53. The boot record is unencrypted or is also dynamically encrypted when it is connected to the client computer system 51 or 52. Therefore, there is a lack of a corresponding resident interceptor as a decryption mechanism, so that the information storage device cannot be serialized with the t Access and access, so any unauthorized information storage will be banned from system resource operations, and information security and resource management purposes

本雖二本發明已以較佳實施例揭露如上’然其並非用以限定 内,Γ。’任何熟習此技藝者,在不脫離本發明之精神和範圍 附之!I 作些?之更動與潤飾’因此本發明之保護範圍當視後 用决:ΐ概贿界定者鮮。此外,摘要部姊標題僅是 圍。辅助專觀件搜尋之用,並非用來關本發明之權利範 【圖式簡單說明】 • 圖1Α為習知一實施例之主開機記錄格式示意圖。 示意^。⑴為習知一實施例之磁碟分割程序進入點記錄格式 ^2發明—實施例之儲存褒置管理方法流程圖。 =3為本翻另-實_謂存裝置管理方法流程圖。 二為本發明—實施例#訊錯存裝置與企業内電腦系統 【主要元件符號說明】 11 .主開機記錄 12 1354910 111 :分割位址偏移量攔位 112 .大小搁位 113 :型態欄位 12 :分割程序進入點記錄 121 :位址偏移量欄位 122 :大小欄位 123 :型態攔位 S210~ S260 :本發明一實施例之儲存裝置管理方The present invention has been described above by way of a preferred embodiment, which is not intended to be limiting. Anyone skilled in the art will be able to make changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention is determined by the following: In addition, the title of the summary section is only a circle. The use of the auxiliary booty search is not intended to be used in the present invention. [Fig. 1] is a schematic diagram of a main boot record format of a conventional embodiment. Indicates ^. (1) A disk division program entry point recording format of a conventional embodiment ^2 Invention - A flowchart of a storage device management method of an embodiment. = 3 is a flow chart of the method of managing the device. The second embodiment of the present invention - the embodiment of the # error storage device and the enterprise computer system [main component symbol description] 11. The main boot record 12 1354910 111: split address offset block 112. Size shelf 113: type bar Bit 12: Split Program Entry Point Record 121: Address Offset Field 122: Size Field 123: Type Block S210~S260: Storage Device Manager of an Embodiment of the Present Invention

S310〜S360 .本發明另一實施例之儲存裝置管理方=驟。 41 :資訊儲存裝置 法各步驟 410 :記憶體 51、52 :用戶端電腦系統 53 :伺服端電腦系統S310~S360. The storage device management side of another embodiment of the present invention is a step. 41: Information storage device Method step 410: Memory 51, 52: User computer system 53: Servo computer system

1313

Claims (1)

1 、申請專利範圍: 一種儲存裝置管理方法,包含: 用戶:電:ΐϊ置連結至一用戶端電腦系統時,以預設於該 用戶知電猫系統之一常駐攔截程式 檢視該儲雜置之—主開機記錄;科秋點願取並 齡機記錄係已加密,該常駐攔戴程式檢視該主開 機。己錄疋否有一特定標記;以及 W 3主職記錄具㈣較標記,該常駐織程式解密 ===並且呼叫一作業系統自該程序進入點讀取解 =開機記錄以啟動該用戶端電腦系統與允許存取該 2、 如申請專利範圍第丨項所述之儲存裝置管理方法,更 回』=記錄不具有該特定標記,該常駐搁截程式返 3、 如申請專利範圍第2項所述之儲錢置管理方法更 該常駐攔截程式回傳一錯誤警示訊氣。 4、 如申請專利範圍第3項所述之儲存裝置^理方法人: 禁止啟動戶端電腦线與存取該儲存裝置。3 5、 如申請專利範圍第i項所述之儲存裝置管理方'法, 主開機記錄係於該用戶端電腦系統觸發 ^ = 加密,並預設以該常駐攔截程式作為解密機制。在機制時 6、 如申請專利範圍第5項所述之儲存t置管理方法, 儲存裝置連結至該用戶端電腦系統時觸發密機〜 7、 如申請專利範圍第i項所述之儲存裝置f理方 機制; 主開機記錄係於i服端電腦系統預先登錄與 亦= 常駐攔截程式作為解密機制’該用戶端電腦系統係電性連= ^54910 且預先佈署於該伺服端電腦系統。 8、如申請專利範圍第1項所述之儲存裝置管理方法,其中該 儲存裝置係選自-外接式磁碟、一外接式硬碟及一 USB 動碟所成群纽。 9種止業内部電腦系統設備控管方法,其中該企業内部電 腦系統設傷包含至少-用戶端電腦系統、—健端電腦系統 與至少-儲存裝置,刻戶端電腦系統係電性連接且預先佈 署於該伺服端電腦系統,包含: 加密該儲存裝置之一主開機記錄; 以預设於該用戶端電腦系統之一常駐攔截程式自一程 序進入點擷取並檢視該主開機記錄;以及 若該常駐攔截程式檢得該主開機記錄一特定標記,解密 該主開機記錄並且呼叫一作業系統自該程序進入點 讀取解 密之該主開機記錄以啟動該用戶端電腦系統 儲存裝置。 10、 如申請專利範圍第9項所述之儲存裝置管理方法,更包含: 右该主開機記錄不具有該特定標記,該常駐攔截程式返 回該程序進入點。 11、 如申請專利範圍第10項所述之儲存裝置管理方法,更包 含: 該常駐攔截程式回傳一錯誤警示訊息。 12、 如申請專利範圍第11項所述之儲存裝置管理方法,更包 含: 7R止啟動§亥用戶端電腦系統與存取該儲存裝置。 13、 如申請專利範圍第9項所述之儲存裝置管理方法,其中當 該儲存裝置連結至該用戶端電腦系統時加密該主開機記錄。 15 比 4910 4、 如申請專利範圍第9項所述之儲存裝置管理方法,1 主開機記錄係於該伺服端電腦系統預先登錄與加密 5、 如申請專利顧第9項所述之儲存裝置f理方法, 自一外接式磁碟、-外接式硬碟及-心 16、一種資訊儲存裝置,至少包含: :記憶體’其中儲存一已加密主開機記錄及一特定伊 已加密主開機記錄係藉由-預設於至少-用戶端電: 性遠^一相對應常駐铜戴程式解密,該用戶端電腦系統传電 /^且預先佈署於—伺服端電«統。 係電 存= 青專利範圍第16項所述之資訊儲存裝 外接式磁碟、-外接式硬碟及- 加密!=5=_^^之資訊儲存裝置’其中該已 柯服端電腦系統預先登錄與加密。1. Patent application scope: A storage device management method, comprising: user: electricity: when the device is connected to a client computer system, the storage device is preset by a resident intercepting program preset to the user's knowledgeable cat system. - The main boot record; Ke Qiu points the willingness to take the record of the ageing machine is encrypted, the resident blocker checks the main boot. Have recorded a specific mark; and W 3 main record (4) is more marked, the resident program decrypts === and calls a job system to read the solution from the program entry point = boot record to start the client computer system And allowing access to the storage device management method as described in item 2 of the scope of the patent application, and returning that the record does not have the specific tag, the resident intercept program returns to 3, as described in item 2 of the patent application scope. The storage method of the money storage method is more reliable. The resident interception program returns an error warning message. 4. If the storage device described in item 3 of the patent application is used, it is forbidden to activate the terminal computer line and access the storage device. 3 5. As claimed in the storage device management method described in item i of the patent scope, the main boot record is triggered by the client computer system ^ = encryption, and the resident interception program is preset as the decryption mechanism. In the case of the mechanism 6, as in the storage method of claim 5, the storage device is connected to the client computer system to trigger the secret machine~7, as described in the patent application scope i The main booting system is pre-registered with the i-server computer system and also the resident interceptor as the decryption mechanism. The client computer system is electrically connected = ^54910 and pre-deployed on the server computer system. 8. The storage device management method according to claim 1, wherein the storage device is selected from the group consisting of: an external disk, an external hard disk, and a USB flash drive. 9 kinds of internal computer system equipment control methods, wherein the internal computer system damage includes at least a client computer system, a health computer system and at least a storage device, and the computer system is electrically connected and pre- Deployed in the server computer system, comprising: encrypting a master boot record of the storage device; capturing and viewing the master boot record from a program entry point by a resident interceptor preset to the client computer system; If the resident interceptor detects the master boot record with a particular flag, decrypts the master boot record and calls a job system to read the decrypted master boot record from the program entry point to activate the client computer system storage device. 10. The storage device management method of claim 9, further comprising: rightly the main boot record does not have the specific tag, and the resident interceptor returns the program entry point. 11. The storage device management method according to claim 10, further comprising: the resident intercepting program returns an error warning message. 12. The storage device management method according to claim 11 of the patent application scope, further comprising: 7R stopping the computer system and accessing the storage device. 13. The storage device management method of claim 9, wherein the primary boot record is encrypted when the storage device is coupled to the client computer system. 15 to 4910 4. According to the storage device management method described in claim 9 of the patent application, 1 the main boot record is pre-registered and encrypted in the server computer system. 5. The storage device f as described in claim 9 Method, from an external disk, an external hard disk and a heart 16, an information storage device, comprising at least: a memory 'which stores an encrypted master boot record and a specific encrypted host boot record system By - preset to at least - the user's end of the electricity: the sex is a corresponding resident copper program decryption, the client computer system transmits electricity / ^ and pre-arranged in the - servo terminal system. The information storage device described in item 16 of the patent scope is the external storage disk, the external hard disk and the encryption device ======^^^^^^^^^^^^^^^^^^^^^^ Login and encryption.
TW97103013A 2008-01-25 2008-01-25 Storage device or enterprise computer and equipmen TWI354910B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
TW97103013A TWI354910B (en) 2008-01-25 2008-01-25 Storage device or enterprise computer and equipmen

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
TW97103013A TWI354910B (en) 2008-01-25 2008-01-25 Storage device or enterprise computer and equipmen

Publications (2)

Publication Number Publication Date
TW200933429A TW200933429A (en) 2009-08-01
TWI354910B true TWI354910B (en) 2011-12-21

Family

ID=44865920

Family Applications (1)

Application Number Title Priority Date Filing Date
TW97103013A TWI354910B (en) 2008-01-25 2008-01-25 Storage device or enterprise computer and equipmen

Country Status (1)

Country Link
TW (1) TWI354910B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9575885B2 (en) * 2013-06-11 2017-02-21 Silicon Motion, Inc. Data storage apparatus for scrambled data and management method thereof
US9117086B2 (en) * 2013-08-28 2015-08-25 Seagate Technology Llc Virtual bands concentration for self encrypting drives

Also Published As

Publication number Publication date
TW200933429A (en) 2009-08-01

Similar Documents

Publication Publication Date Title
JP4089171B2 (en) Computer system
US7111005B1 (en) Method and apparatus for automatic database encryption
US7434069B2 (en) Method and device for encryption/decryption of data on mass storage device
CN102222049B (en) Manage from the easily extensible of encrypted memory device
JP6382196B2 (en) System and method for providing a secure computing environment
EP2510442B1 (en) System and method for secured backup of data
CN100555298C (en) The method and apparatus of virtulizing personal office environment
US8281388B1 (en) Hardware secured portable storage
US8811619B2 (en) Encryption key management system and methods thereof
US8060751B2 (en) Access-control method for software module and programmable electronic device therefor
US20070022285A1 (en) Administration of data encryption in enterprise computer systems
WO2021164166A1 (en) Service data protection method, apparatus and device, and readable storage medium
CN101853363A (en) File protection method and system
CN100367248C (en) A encryption U disk system with journal and audits
US20100064144A1 (en) Data security
CN105612715A (en) Security processing unit with configurable access control
KR20190018869A (en) System and method for providing storage service based on block chain
CN105975867B (en) A kind of data processing method
CN106682521B (en) File transparent encryption and decryption system and method based on driver layer
US20100185873A1 (en) System and method for file processing and file processing program
JP2010213104A (en) Device, system and program for processing content
CN109684866B (en) Safe USB flash disk system supporting multi-user data protection
CN102207914A (en) Hardware encrypted trans-flash (TF) card loaded with application programs
KR100975133B1 (en) Security management system for portable memory devices and security management method using the same
CN109657490B (en) Transparent encryption and decryption method and system for office files