TWM540327U - Smart hardware safety carrier - Google Patents

Description

Smart hardware safety carrier

The present invention relates to a portable device, and more particularly to a smart hardware safety carrier.

The existing portable device of the connector, such as a USB flash drive, allows the user to electrically connect with an electronic device through the connector, so that the electronic device can read the data stored therein or store the data written by the electronic device and carry it with them. It is quite convenient. However, the portable device itself usually does not have the use permission control function, and is susceptible to the intentional person to steal or modify the stored data. Therefore, if the ability to control the authority of the portable device itself can be given, it will be possible to prevent the portable device from being improperly accessed without passing the verification procedure.

Therefore, the purpose of the present invention is to provide a smart hardware safety carrier capable of authenticating and controlling the user.

The smart hardware security device can be electrically coupled to an electronic device and includes a communication unit, a storage module and a control module, the control module and the communication unit and the storage module Electrical connection, and has a privilege control a permission table and a password table, the permission control data table records a user identification code and a usage right of using the storage module, the password table records the user identification code and a corresponding user password; The electronic device can transmit an authentication information to the control module through the communication unit, and after the control module determines that the authentication information is legal, the electronic device allows the electronic device to establish a connection with the electronic device through the connector, and accepts the electronic device. a user identification code and a user password, the control module queries a usage right of the user identification code according to the permission control data table, and determines the user password and the user password recorded in the password table. In the case of matching, the electronic device is allowed to use the storage module within the scope of the usage authority.

In some implementations of the present invention, the electronic device executes an application and transmits the authentication information of the application to the control module through the application, and the control module records an identification of the application. The code and a password, and the control module determines that an identification code and a password included in the authentication information match the identification code and password recorded by the control module, and determines that the application is legal.

In some implementations of the present invention, the storage module has a hidden data area, and the control module determines that the usage right allows access to the hidden data area, allowing the electronic device to access the hidden data Area.

In some implementations of the present invention, the control module determines that the usage permission allows the privacy data area to be planned, and the electronic device can plan a plurality of private spaces for the hidden data area through the control module, and the The control module determines that the usage permission is allowed to be saved. When at least one of the private spaces is taken, the electronic device is allowed to access the private space, and the data transmitted by the electronic device is encrypted and then stored in the private space, or the information required by the electronic device is from the private The space is read out and decrypted, and then transmitted to the electronic device.

In some implementations of the present invention, the control module determines that the usage permission allows setting and updating the rights control data table and/or the password table, allowing the electronic device to control the data table and/or The password table is set and updated.

In some implementations of the present invention, the control module further includes a financial chip, wherein a key and a code program are stored, and the control module determines that the usage right allows the electronic device to access the financial chip. Transmitting, by the electronic device, a data to be hacked by the communication unit to the financial chip, causing the execution of the escrow program, and vouching the data to be hacked by the key to generate a transaction The code is sent, and the transaction code is returned to the electronic device through the communication unit.

In some implementations of the present invention, the secret data area stores a key, the control module has a code execution program, and the control module determines that the usage right allows access to the hidden data area, and reads Taking the key stored in the hidden data area, and accepting a data of the code to be spoofed transmitted by the electronic device through the communication unit, and executing the pledge code, and the code is to be ridden by the key The data is encoded and a transaction code is generated, and the transaction code is returned to the electronic device through the communication unit.

In some implementations of the present invention, the control module further includes a storage a financial chip of the code program, wherein the secret data area stores a key, and the control module determines that the usage right allows the electronic device to access the financial chip and the hidden data area, the control module reads Storing the key in the hidden data area, and providing the key and the data to be debited by the electronic device through the communication unit to the financial chip, so that the code execution program is executed. The key generates a transaction code for the data to be hacked, and returns the transaction code to the electronic device through the communication unit.

In some implementations of the present invention, the communication unit is a connector; or the communication unit includes a connector and a short-range wireless communication interface, and the connector is electrically connected to the electronic device Communicating with the control module through the connector, when the connector is not electrically connected to the electronic device, the electronic device communicates with the control module through the short-range wireless communication interface; or the communication unit includes a connector And a short-range wireless communication interface electrically connected to the connector, and when the connector is electrically connected to the electronic device, the electronic device communicates with the control module through the connector, and transmits the short distance through the connector The wireless communication interface is electrically connected to transmit and receive a wireless signal through the short-range wireless communication interface, and the electronic device communicates with the control module through the short-range wireless communication interface when the connector is not electrically connected to the electronic device.

In some implementations of the present invention, the portable device further includes a circuit board, the connector is disposed on the circuit board, and the storage module and the control module are integrated And being disposed in a chip and disposed on the circuit board; or, the control module is a first chip disposed on the circuit board, and the storage module is a second chip disposed on the circuit board.

The utility model has the advantages that the invention is realized by controlling the access authority of the electronic device of the storage module (especially the hidden data area) of the portable device to be accessed by the control module disposed in the portable device. Authenticate and control the user of the portable device.

1‧‧‧ portable device

2‧‧‧Electronic devices

10, 10'‧‧‧ boards

11‧‧‧Communication unit

111‧‧‧Connector

112‧‧‧Short-range wireless communication interface

120‧‧‧Financial Chip

121‧‧‧ Controller chip

12‧‧‧Control Module

13‧‧‧ Storage Module

14‧‧‧Permission Control Data Sheet

15‧‧‧ Password Table

122‧‧‧Control firmware

123‧‧‧Application Interface

131‧‧‧System data area

132‧‧‧Hidden Information Area

Other features and effects of the present invention will be apparent from the following description of the drawings. FIG. 1 is a circuit block diagram illustrating a circuit block mainly included in an embodiment of the present portable device; FIG. FIG. 3 is a circuit block diagram showing another embodiment of the communication unit of the embodiment; FIG. 4 is a circuit block diagram illustrating the present embodiment; The control module and the storage module of the embodiment mainly include a circuit block; FIG. 5 is a schematic view showing that the control module and the storage module of the embodiment are disposed on the circuit board in a manner integrated in a chip; FIG. 6 is a schematic diagram showing the control module and the storage module of the embodiment are disposed on the circuit board in separate wafer types.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are denoted by the same reference numerals.

Referring to FIG. 1 , it is an embodiment of the smart hardware security carrier of the present invention. The portable device 1 of the present embodiment can be carried by a portable disk (or a mobile disk), but is not limited thereto. It mainly includes a communication unit 11 for communicating with an electronic device 2, a control module 12 electrically connected to the communication unit 11, and a storage module 13 electrically connected to the control module 12. The electronic device 2 can be an active electronic device such as a smart phone, a tablet computer, a notebook computer, or a personal computer. The communication unit 11 can be an existing connector 111, such as a general USB connector plug, a mini USB connector plug, a micro USB connector plug, or a combination thereof, and is not limited thereto, and is currently used for connecting an external connection. The connector specifications of the peripheral device or the portable device to an active electronic device are applicable to the present embodiment.

In addition, as shown in FIG. 2, the communication unit 11 may include a short-range wireless communication interface 112, such as an NFC (Near Field Communication) interface, in addition to the connector 111, whereby the connector 111 and the electronic device 2 are When electrically connected, the electronic device 2 can communicate with the control module 12 through the connector 111. When the connector 111 is not electrically connected to the electronic device 2, the electronic device 2 has a short-range wireless communication function (for example) For example, the NFC function can communicate with the control module 12 of the portable device 1 through the short-range wireless communication interface 112 by being in close proximity to the portable device 1.

Alternatively, as shown in FIG. 3, the communication unit 11 includes, in addition to the connector 111, a short-range wireless communication interface 112 electrically connected to the connector 111, such as an NFC interface; thereby, when the connector 111 is When the electronic device 2 is electrically connected, the electronic device 2 can communicate with the control module 12 through the connector 111, and if the electronic device 2 does not have a short-range wireless communication function (for example, an NFC function), the electronic device 2 can The short-range wireless communication interface 112 is electrically connected to the short-range wireless communication interface 112 to perform short-range wireless communication with another electronic device (not shown) through the short-range wireless communication interface 112; and when the connector 111 does not When the electronic device 2 is electrically connected, if the electronic device 2 has a short-range wireless communication function (for example, an NFC function), the electronic device 2 can communicate with the control module 12 through the short-range wireless communication interface 112 of the portable device 1 .

As shown in FIG. 1 , the control module 12 has an authority control data table 14 and a password table 15 . The permission control data table 14 records at least one user identification code of the user and a usage right of the storage module 13 , and the password table 15 records the user identification code and a corresponding user password. When the electronic device 2 executes an application for accessing the data in the storage module 13 after the electronic device 2 is electrically connected to the electronic device 2, the application first transmits the application through the communication unit 11. Authentication information to the control module 12, by the control module 12 When the application is legal according to the authentication information, the application (ie, the electronic device 2) is allowed to establish a connection with the application, and then the electronic device 2 transmits a user identifier and a user password to the control through the application. The module 12, the control module 12 queries a usage right of the user identification code according to the rights control data table 14, and determines whether the user password matches the user password recorded in the password table 15, if The application of the electronic device 2 is allowed to use the storage module 13 within the scope of the usage rights. Thereby, the user who wants to use the portable device 1 is authenticated and the authority is controlled, so as to prevent the portable device 1 from being improperly accessed arbitrarily.

Specifically, as shown in FIG. 4, the control module 12 of the present embodiment mainly includes a controller chip 121 and a control firmware 122 programmed in the controller chip 121 and an application program interface; API) 123, and the rights control data table 14 and the password table 15 are burned and stored in the control firmware 122. As shown in Table 1 below, the password table 15 stores the user identification code (such as ID1, ID2, ID3, etc.) of the user of the portable device 1 and the user password (for example, CODE1, CODE2, CODE3, etc.) for verifying the user. identity of. And the password actually stored in the password table 15 is a password that is encrypted and stored in a garbled manner to ensure that the password is not illegally stolen. In addition, the password table 15 also stores an identification code of each application that is recognized and legal by the control module 12 and a corresponding password.

The storage module 13 mainly includes a system data area 131 and a hidden data area 132. The system data area 131 mainly stores basic operation information of the portable device 1. The hidden data area 132 cannot be accessed by the electronic device 2, that is, the electronic device 2 cannot read or write the file or data stored in the hidden data area 132 without the authorization of the control module 12. Or modify. Conversely, the electronic device 2 can access the hidden data area 132 of the storage module 13 through the control firmware 122 in the controller chip 121 of the control module 12 only after completing the verification and authorization process specified by the control module 12. . Therefore, after the electronic device 2 is electrically connected to the portable device 1, the hidden data area 132 of the portable device 1 cannot be displayed to the user, and only after the user passes the verification and authorization program by the electronic device 2, the user The hidden material area 132 can be accessed through the electronic device 2.

Therefore, as shown in Table 2 below, the privilege control data table 14 mainly stores the user identification code (for example, ID1, ID2, ID3, etc.) of the user and a corresponding usage right thereof, for example, the authority of the user identification code ID1 is The hidden data area 132 is read and written. The user identification code ID2 has the right to read the hidden data area 132, and the user identification code ID3 has the right to read and write the hidden data area 132. Enter And deletion, etc., the permission control data table 14 is mainly used to verify whether the user has the right to read, update and/or delete the hidden data area 132.

For example, if the secret data area 132 stores a key and the key is used for a mobile payment operation, when the electronic device 2 wants to use the key to perform a mobile payment, the electronic device 2 performs An application (such as a mobile payment software) and requiring the user to enter their user ID and/or user password (or the application can also use the previously recorded user ID and user password without the need User input). Then, the application of the electronic device 2 transmits the authentication information including an identification code and a password, the user password, and a data to be debited related to the mobile payment to the control module 12, and the control module The application interface 123 of 12 first performs a connection establishment function, and according to the password table 15, it is judged whether the identification code and password provided by the application are recorded in the password table 15, and if so, it is determined that the application is legal. Then, the application interface 123 performs an privilege management function, and according to the record of the privilege control data table 14, confirms the user identification code provided by the application, for example, the usage right of the ID2 is read, and determines that the application provides User password, such as CODE2 and a user record recorded in password table 16. The code matches, the application is allowed to read the key stored in the secret data area 132 through the control firmware 122, and the control firmware 122 generates a transaction code based on the key and the data to be hacked. And transmitted back to the electronic device 2 through the communication unit 11, so that the electronic device 2 can perform subsequent action payment operations.

In addition, as shown in FIG. 4, the control module 12 of the present embodiment may further include a financial chip 120 in which a key of a financial institution that issues the financial chip 120 and a code program are stored. Therefore, when the electronic device 2 wants to perform a mobile payment using the key and the identity and authority of the control module 12 is verified, the application interface 123 of the control module 12 transmits the electronic device 2 through the application through the communication. A data to be debited from the unit 11 is transmitted to the financial chip 120, so that the code execution program is executed, and the transaction code is generated by using the key for the data to be debited, and the application interface 123 is generated through the application interface 123. The electronic unit 2 is returned to the electronic device 2 via the communication unit 11, so that the electronic device 2 can perform subsequent action payment operations. For details on the application of the above financial chip 120 to mobile payment, see Taiwan Patent No. I537851.

Therefore, when the control module 12 includes the financial chip 120, if the key to be used for the mobile payment by the electronic device 2 is stored in the hidden data area 132 of the storage module 13, the storage is read by the control firmware 122. The key in the secret data area 132, and executing the code program pre-stored in the control controller chip 121, so that a transaction code is generated according to the key and the data to be coded provided by the electronic device 2. . Details of the payment for this action can be found in Taiwan's I509542 patent.

Alternatively, when the control module 12 includes the financial chip 120, but the key to be used for the mobile payment by the mobile device 1 (provided by the financial institution of the non-issued financial chip 120) is stored in the secret data area 132, The control firmware 122 reads the key stored in the secret data area 132, and transmits the key and the data to be hacked to the financial chip 120, and the financial chip 120 executes the code program to use the key. A transaction code is generated for the code of the code to be debited.

Or, if the key to be used for the mobile payment by the electronic device 2 is stored in the financial chip 120, the control firmware 122 of the control module 12 transmits the data to be hacked to the financial chip 120 by the financial The wafer 120 executes the code-up program, and generates a transaction code by using the key to code the data to be coded. Therefore, the financial wafer 120 can be included in the control module 12 or omitted as needed for practical applications.

Furthermore, the embodiment has at least four functions of identity recognition, rights control, private space, and personal protection. For the identity recognition function, the secret data area 132 of the storage module 13 can record an identification data of a user, thereby automatically providing or when the electronic device 2 executes an application to read the identification data. When the user inputting a user identification code and its user password to the control module 12, the application interface 123 determines that the user identification code has been stored according to the permission control data table 14 after verifying that the application is legal as described above. The permission of the hidden data area 132 is taken, and the user password is determined to be consistent with the user password recorded in the password table 15. The electronic device 2 is allowed to read the identification data stored in the secret data area 132 through the control firmware 122 for the electronic device 2 to perform subsequent identification applications.

For the privilege control function, the pre-established privilege control data table 14 and password table 15 are burned in the control firmware 122 through the application interface 123, wherein the password table 15 is used before the user obtains the portable device 1. The main record uses the user identification code of each user of the portable device 1 and its corresponding user password. The permission control data table 14 mainly records each user identification code and its hidden data area to the storage module 13. The permissions of the data in 132 are read, updated, and deleted, so different users may have different access rights to the secret data area 132.

In addition to the above-mentioned connection connection function and the rights management management function, the application interface 123 also has an online personalization (Preso) management function, which enables the electronic device 2 to execute an application and the application interface 123 to establish a connection. And through the above-mentioned authority control management function verification and authorization, the user can set and update the authority control data table 14 and the password table 15 according to the actual application requirements.

For the private space function, when an application executed by the electronic device 2 and the application interface 123 of the control module 12 are connected, and the verification and authorization of the permission management function is performed, the application of the control module 12 is controlled. The interface 123 can use the online personalization (Preso) management function to cut the hidden data area 132 into a plurality of private spaces according to the instructions issued by the application of the electronic device 2, so as to store different kinds of private information, such as mobile payment. Related materials, personal medical care (for medical treatment) Information, various identities or membership vouchers, etc. And the control module 12 can set the access rights of the private space to the different user identifiers (ie different users) in the rights control data table 14.

The application interface 123 of the control module 12 is configured to perform an encryption and decryption function, and can use an algorithm such as 3DES (Triple Data Encryption Algorithm symmetric-key block cipher), AES (Advanced Encryption Standard), or RSA. Encrypt or decrypt the data. For example, when an application executed by the electronic device 2 is connected to the application interface 123 of the control module 12, and the verification of the function is managed by the above-mentioned authority, the application must write a piece of information to the secret. In the data protection area of the data area 132 (a private space planned by the online personalization operation (Preso) management function, not shown), the application interface 123 encrypts the information data by using the encryption and decryption function. And encrypting the encrypted information into the protected area of the hidden data area 132 through the control firmware 122. If the application of the electronic device 2 is to read the data of the protected area stored in the hidden data area 132, the control firmware 122 reads the data from the protected area and transmits the data to the application. The program interface 123 is configured to decrypt the data by applying the encryption and decryption function, and then transmit the decrypted data to the electronic device 2 through the control firmware 122.

In addition, in this embodiment, as shown in FIG. 5, the portable device 1 has a circuit board 10, and the communication unit 11, the control module 12, and the storage module 13 are disposed. On the circuit board 10, the storage module 13 and the control module 12 are integrated into a chip, and then electrically connected to the communication unit 11 through the circuit board 10.

Alternatively, in this embodiment, as shown in FIG. 6, the control module 12 and the storage module 13 may also be independently disposed on the circuit board 10' of the portable device 1, and the control module 12 is first. The implementation of the wafer, the memory module 13 is implemented in the form of a second wafer.

In summary, the present invention accesses the electronic device 2 of the storage module 13 (especially the hidden data area 132) of the portable device 1 by the control module 12 disposed in the portable device 1. The control and the purpose and purpose of the present invention for the identity verification and authority control of the user of the portable device 1.

However, the above is only the embodiment of the present invention. When the scope of the novel implementation cannot be limited thereto, all simple equivalent changes and modifications according to the scope of the patent application and the contents of the patent specification are still Within the scope covered by this new patent

1‧‧‧ portable device

2‧‧‧Electronic devices

11‧‧‧Communication unit

12‧‧‧Control Module

13‧‧‧ Storage Module

14‧‧‧Permission Control Data Sheet

15‧‧‧ Password Table

Claims (13)

An intelligent hardware security device, which can be electrically coupled to an electronic device, and includes: a communication unit; a storage module; and a control module electrically connected to the communication unit and the storage module, and Having a rights control data table and a password table, the rights control data table records a user identification code and a usage right of using the storage module, the password table records the user identification code and a corresponding one thereof a user password; the electronic device can transmit an authentication information to the control module through the communication unit, and the control module determines that the authentication information is legal, and allows the electronic device to establish a connection with the electronic device through the connector. And accepting a user identifier and a user password sent by the electronic device, the control module queries a usage right of the user identifier according to the rights control data table, and determines that the user password and the record are When the user password of the password table matches, the electronic device is allowed to use the storage module within the scope of the usage right. The smart hardware security vehicle of claim 1, wherein the electronic device executes an application and transmits the authentication information of the application to the control module through the application, and the control module records the An application identifier and a password, and the control module determines that an identification code and a password included in the authentication information match the identification code and password recorded by the control module, and determines that the application is legal. The smart hardware security carrier of claim 1, wherein the storage module has a hidden data area, and the control module determines that the usage right allows access to the hidden data area, allowing the electronic device to save Take the hidden data area. The intelligent hardware security vehicle of claim 3, wherein the control module determines that the usage permission allows the hidden data area to be planned, and the electronic device can plan the hidden data area through the control module. a private space, and the control module determines that the usage right allows access to at least one of the private spaces, allows the electronic device to access the private space, encrypts the data transmitted by the electronic device, and then deposits the data into the private device. The private space, or the data required by the electronic device is read out from the private space and decrypted, and then transmitted to the electronic device. The intelligent hardware security vehicle of claim 1, wherein the control module determines that the usage permission allows setting and updating the permission control data table and/or the password table, and allows the electronic device to control the authority. The data sheet and/or the password table are set and updated. The smart hardware security carrier of claim 1, wherein the control module further comprises a financial chip, wherein a key and a code program are stored, and the control module determines that the usage permission allows the electronic device to save When the financial chip is taken, the data to be debited transmitted by the electronic device through the communication unit is transmitted to the financial chip, so that the code execution program is executed, and the data to be debited is pressed by the key. The code generates a transaction code, and returns the transaction code to the electronic device through the communication unit. The smart hardware security carrier of claim 3, wherein the secret data area has a key, the control module has a code execution program, and the control module Determining that the usage right allows access to the hidden data area, reading the key stored in the hidden data area, and accepting a data to be hacked by the electronic device through the communication unit, and executing The charge code program generates a transaction code by using the key to code the data to be coded, and returns the transaction code to the electronic device through the communication unit. The smart hardware security carrier of claim 3, wherein the control module further comprises a financial chip storing a code program, the secret data area storing a key, and the control module determining the usage right When the electronic device is allowed to access the financial chip and the hidden data area, the control module reads the key stored in the hidden data area, and transmits the key and the electronic device through the communication unit. The information to be escorted is provided to the financial chip, so that the escrow code program is executed, and the data of the code to be hacked is coded by the key to generate a transaction code, and the code is returned through the communication unit. The transaction is escorted to the electronic device. The smart hardware security carrier of claim 1, wherein the communication unit is a connector. The smart hardware security carrier of claim 1, wherein the communication unit comprises a connector and a short-range wireless communication interface, and when the connector is electrically connected to the electronic device, the electronic device transmits through the connector The control module communicates, and when the connector is not electrically connected to the electronic device, the electronic device communicates with the control module through the short-range wireless communication interface. The smart hardware security carrier of claim 1, wherein the communication unit comprises a connector and a short-range wireless communication interface electrically connected to the connector, and when the connector is electrically connected to the electronic device, Electronic device transmission The connector is in communication with the control module, and is electrically connected to the short-range wireless communication interface through the connector to transmit and receive a wireless signal through the short-range wireless communication interface; when the connector is not electrically connected to the electronic device, The electronic device communicates with the control module through the short-range wireless communication interface. The smart hardware security carrier of any one of claims 1 to 11, further comprising a circuit board, the communication unit is disposed on the circuit board, and the storage module and the control module are integrated into one The chip is placed on the circuit board. The smart hardware security carrier of any one of claims 1 to 11, further comprising a circuit board, the communication unit is disposed on the circuit board, and the control module is disposed on the circuit board The first chip, the storage module is a second chip disposed on the circuit board.