TWI393007B - Information access controllable storage device, information access control method and information protection method - Google Patents

Description

Information storage device, information access control method and information protection method capable of controlling access

The present invention relates to an information storage device and an access method, and more particularly to an information storage device, an information access control method, and an information protection method for controlling access by a virtual disk technology.

In response to the growing trend of various software and firmware programs and the growth of data volume, such as hard disk and flash drive, various information storage devices have become an indispensable device for information processing devices. Although portable information storage devices are easy to carry and can be installed and used at any time, users and information system administrators continue to seek internal information and data protection mechanisms. It is obvious that the related technologies currently available are still insufficient. For example, a user who is engaged in business or external interpretation may only want to display the contents of the information storage device that he or she carries with him on a specific information processing device. Once the display process is over, he hopes that the data will not be easily distributed or not. Authorized to save, and when it loses information storage devices or information processing equipment, or if it is outside the line of sight of the specific information processing equipment, it is hoped that the information storage device content will not be transferred, forwarded, altered or stolen. However, the conventional file security system has many drawbacks, such as using only a single password mechanism or a single technology such as software to protect users, so that users often fall into the dilemma of portability and data confidentiality, and effectively or use dual The preservation mode to protect the user's important information is still in the doldrums. Therefore, if the personal information is leaked and the information storage device is lost, others can still use it in other information processing devices without being able to keep confidential and prevent arbitrary distribution. Therefore, it is necessary to develop information storage devices, information access control and information protection methods that can control access.

The invention provides a controllable access information storage device, an information access control and an information protection method, which adopts a virtual disk, identity verification and information encryption and decryption technology to ensure that access to the information to be protected complies with data confidentiality preservation and management requirements. .

Other objects and advantages of the present invention will become apparent from the technical features disclosed herein.

In order to achieve one or a part or all of the above or other purposes, an embodiment of the present invention provides an information storage device that can control information access. The information storage device of the present invention has a program area and a hidden area, wherein a file of the hidden area and the ciphertext area corresponds to the virtual disk path by the virtual disk technology. When the information storage device is connected to the information processing system and the identification program and the mounting program are executed, the information processing system mounts the clear/ciphertext area path and the virtual disk path according to a correct verification and execution result, and the plaintext to be protected information is written. When the virtual disk path is entered, it is automatically encrypted into the ciphertext to be protected and then transferred to the aforementioned file, so the information to be protected from the ciphertext protection will not be deleted arbitrarily.

In order to achieve one or a part or all of the above or other purposes, an embodiment of the present invention further provides an information access control method, which includes the following steps: First, when the information storage device is connected to the information processing system and performs identity recognition. The program and the mount program, the information processing system mounts the clear/ciphertext area path and the virtual disk path according to the correct verification and execution result, wherein one of the information storage device and the ciphertext area corresponds to the virtual disk technology. Disk path. Then, when the user writes the plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into the ciphertext to be protected and then transferred to the file.

In order to achieve one or a part or all of the above or other purposes, an embodiment of the present invention further provides an information protection method, which includes the following steps: first, a virtual disk technology corresponding to an information storage device, a hidden area, a ciphertext area A file to virtual disk path, when the information storage device is connected to the information processing system and executes the identity recognition program and the mount program, the information processing system mounts the clear/ciphertext area path and the virtual disk path according to the correct verification and execution result. Then, when the user writes the plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into the ciphertext to be protected and then transferred to the file.

The invention adopts the structure of the identity recognition and the virtual disk path and the virtual area of the hidden area/cryptographic area, so that the protection mechanism and effective access control of the information to be protected can be realized.

The above and other objects, features and advantages of the present invention will become more <RTIgt;

The above and other technical contents, features and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments.

Referring to FIGS. 1A and 1B, the information storage device capable of controlling information access according to the present invention can be described in conjunction with display terminal changes. The information storage device of the present invention may be a fixed disk (such as a hard disk) or an external disk (such as a flash disk with a USB connection interface), and the information processing system may be a computer device of various specifications, so it is implemented here. For example, the information processing system 1 is a notebook computer having a liquid crystal display screen as the display terminal 11 and a hard disk (the disk path is C, shown in FIG. 1B), and the information storage device 2 has a program. Zone 21 and a hidden area 22 of the flash drive. In this embodiment, the program area 21 is planned to have an area for simulating the optical disk drive, allowing the optical disk drive to execute via the operating system, and automatically executing the stored agent execution program, identity recognition program and mount program (in other manually executed embodiments) The storage area of the agent execution program, the identity recognition program and the mount program may be other configuration manners, so when the information storage device 2 is connected to the USB port 12 of the notebook computer 1, the operating system automatically executes the agent execution program for indirect execution. The call identification program requires the user to input only the user identification code, the user password and the user fingerprint, or only the user fingerprint. After the correctness verification and mounting are completed, the display terminal 11 displays the disk path C and the information storage device 2 disk path D, and the clear/ciphertext area path E of the hidden/closed area 22 ambiguous area 221 is accessible. The display terminal 11 corresponds to the E disk and the virtual disk path F corresponding to the file 222 (shown as the F disk in the display terminal 11). In this embodiment, the display terminal 11 displays disk icons such as C, D, E, and F in this embodiment to illustrate the disk path, but is merely an example and makes the drawing easy to read, and the other information processing system 1 The disc player or the network drive icon, etc. are not listed here.

As mentioned here, the virtual disk technology is a structure for simulating a general information storage device (for example, a hard disk having a hard disk file configuration table), and essentially uses an archive in an explicit/ciphertext area to store an automatically encrypted virtual disk. Path data, so the operating system and driver can obtain the address through the hard disk file configuration table, and the user accesses the plaintext to be protected information in the virtual disk path, in fact, accesses the file; The protection information is written to the virtual disk path. In essence, the encrypted plaintext to be protected information is written to the file after the ciphertext is to be protected. In practice, the deletion of the ciphertext to be protected information can be prohibited by a monitoring program.

Referring to FIG. 2, the detailed flow of the information access control method of the present invention is shown in the figure. In step S211, when an information storage device (such as a flash drive or a hard disk) is connected to an information processing system (such as a computer host), the information processing system executes an identification program and a mount program to mount the clear/ciphertext area path and The virtual disk path, wherein the information storage device Ming/Mintext area file is mapped to the virtual disk path by using the virtual disk technology. The identity recognition program and the mount program perform single verification or multiple verification on the user password and the user fingerprint. In step S212, when the user writes the plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into the ciphertext to be protected after the virtual disk path and the file in the plain/ciphertext area are correspondingly encrypted. Transfer to the file. Therefore, the user and the information storage device they hold must first obtain a virtual disk path for accessing the plaintext to be protected information through a process such as identity recognition, and then perform a specific storage that does not include a delete command for the ciphertext to be protected information. Take orders and achieve control over information dissemination. Herein, the data entering and leaving the virtual disk path and the plain/ciphertext area file are subjected to encryption and decryption procedures to increase protection and readability. Therefore, in this embodiment, the plaintext to be protected information may be written into the file by using encryption technology. The information to be protected by the ciphertext and the ciphertext to be protected from the archive can be decrypted into the plaintext to be protected by the decryption technology.

Referring to FIG. 3, the detailed process of the information protection method of the present invention is shown in the figure. In step S311, the virtual disk technology corresponding information storage device hides the area of the Ming/Mintext area from a file to the virtual disk path, and then, in step S312, when the information storage device is connected to the information processing system and performs the identity recognition program and The mount program, the information processing system mounts the clear/ciphertext area path and the virtual disk path based on the correct verification and execution results. Next, in step S313, when the user writes the plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into the ciphertext to be protected information and then transferred to the file. Wherein, when an information storage device (such as a flash drive or a hard disk) is connected or installed in an information processing system (such as a computer host), the clear/ciphertext path and the virtual disk path of the information storage device will be linked according to the identity recognition program. The program is mounted for single or multiple verification of the user's password and the user's fingerprint, and the information processing system displays the aforementioned path for the user to access. In addition, as described above, when the program area of the information storage device is planned to have an area of the analog optical disk drive and the optical disk drive is allowed to be executed via the operating system, the stored agent execution program, the identity recognition program, and the mount program can be automatically executed, but In other manually executed embodiments, the storage area of the agent execution program, the identification program, and the mount program may be other configurations.

While the present invention has been described in its preferred embodiments, the present invention is not intended to limit the invention, and the present invention may be modified and modified without departing from the spirit and scope of the invention. The scope of protection is subject to the definition of the scope of the patent application. In addition, any of the objects or advantages or features of the present invention are not required to be achieved by any embodiment or application of the invention. In addition, the abstract sections and headings are only used to assist in the search of patent documents and are not intended to limit the scope of the invention.

1. . . Information processing system

11. . . Display terminal

12. . . USB埠

2. . . Information storage device

twenty one. . . Program area

twenty two. . . Hidden area

221. . . Ming / ciphertext area

222. . . file

C, D, E, F. . . Disk path

S211, S212. . . Each step of the information access control method according to an embodiment of the present invention

S311, S312, S313. . . Each step of the information protection method according to an embodiment of the present invention

FIG. 1A is a schematic diagram showing the appearance of an information storage device and an information processing system capable of controlling information access according to the present invention.

FIG. 1B is a schematic diagram showing changes in operation of an information storage device capable of controlling information access and a display terminal of an information processing system according to the present invention.

2 is a flow chart of an information access control method according to an embodiment of the present invention.

FIG. 3 is a flowchart of an information protection method according to an embodiment of the present invention.

S211, S212. . . Each step of the information access control method according to an embodiment of the present invention

S211. . . When the information storage device is connected to the information processing system, the identity recognition program and the mount program are executed to mount the clear/ciphertext area path and the virtual disk path, wherein the information storage device Ming/Mintext area uses a virtual disk. Technology corresponds to the virtual disk path

S212. . . When the user writes the plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into the ciphertext to be protected and then transferred to the file.

Claims (20)

An information storage device capable of controlling information access, comprising: a program area; and a hidden area, wherein one of the hidden/ambient areas of the hidden area corresponds to a virtual disk path by a virtual disk technology, When the information storage device is connected to an information processing system and an identification program and a mounting program are executed in the program area, the information processing system mounts a clear/ciphertext area path according to a correct verification and execution result. The virtual disk path is automatically encrypted into a ciphertext to be protected and then transferred to the file when the plaintext to be protected information is written into the virtual disk path. The information storage device of the controllable information access as described in claim 1, wherein the identification program and the mounting program are stored in the program area of the program processing system to call and execute. The information storage device for controllable information access as described in claim 2, wherein the program area is planned to be an area of the analog optical disk drive for storing an agent execution program, which is automatically executed by the operating system. With the mounter. The information storage device for controllable information access as described in claim 1 wherein the information storage device is selected from the group consisting of a fixed disk and an external disk. The information storage device for controllable information access as described in claim 1 wherein the ciphertext to be protected information is prohibited from being deleted and copied by a monitoring program. The information storage device of the controllable information access as described in claim 1, wherein the identification program and the mounting program at least verify a user password to generate the correct verification and execution result. Information storage for controllable information access as described in item 6 of the patent application The device, wherein the identity recognition program and the mounting program validate the user password and a user fingerprint to generate the correct verification and execution result. The information storage device of the controllable information access as described in claim 1, wherein the identification program and the mounting program at least verify a user fingerprint to generate the correct verification and execution result. An information access control method includes: when an information storage device is connected to an information processing system and executes an identification program and a mounting program in a program area of the information storage device, the information processing system is correct according to a The verification and execution result mounts a clear/ciphertext area path and a virtual disk path, wherein one of the information storage devices, one of the Ming/Mintext areas, corresponds to the virtual disk path by a virtual disk technology; And when the user writes a plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into a ciphertext to be protected and then transferred to the file. The information access control method of claim 9, wherein the identification program and the mounting program are stored in the program area of the information storage device for an operation system call and execution of the information processing system. The information access control method of claim 10, wherein the program area plans an area of the analog optical disc drive to store an agent execution program, and the identification program is automatically executed by the operating system and the mount Program. The information access control method of claim 9, wherein the identification program and the mounting program validate at least one user password to generate the correct verification and execution result. The information access control method of claim 12, wherein the identification program and the mounting program verify the user password and The user fingerprint is used to generate the correct verification and execution results. The information access control method of claim 9, wherein the identification program and the mounting program verify at least one user fingerprint to generate the correct verification and execution result. An information protection method includes: a virtual disk technology corresponding to one of the hidden/ambient areas of a hidden area of the information storage device to a virtual disk path; when the information storage device is connected to an information processing system And executing an identity recognition program and a mount program in a program area of the information storage device, wherein the information processing system mounts a clear/ciphertext area path and the virtual disk path according to a correct verification and execution result; When the user writes a plaintext to be protected information to the virtual disk path, the plaintext to be protected information is automatically encrypted into a ciphertext to be protected and then transferred to the file. The information protection method of claim 15, wherein the identification program and the mounting program are stored in the program area of the information storage device for call and execution by an operating system of the information processing system. The information protection method described in claim 16 wherein the program area is an area for simulating an optical disk drive to store an agent execution program, and the identity recognition program and the mount program are automatically executed according to the operating system. The information protection method of claim 15, wherein the identification program and the mounting program validate at least one user password to generate the correct verification and execution result. The information protection method of claim 18, wherein the identification program and the mounting program validate the user password and a user fingerprint to generate the correct verification and execution result. The information protection method of claim 15, wherein the identification program and the mounting program verify at least one user fingerprint to generate the correct verification and execution result.