CN103049703A

CN103049703A - Near field communication instrument and data safety management method thereof

Info

Publication number: CN103049703A
Application number: CN2012103880184A
Authority: CN
Inventors: 巩盖瑞; 陈翔昱
Original assignee: IO INTERCONNECTION CO Ltd
Current assignee: IO INTERCONNECTION CO Ltd
Priority date: 2011-10-12
Filing date: 2012-10-12
Publication date: 2013-04-17
Also published as: CN103198245A

Abstract

The invention provides a near field communication instrument and a data safety management method thereof. The near field communication instrument is connected between a computer and an external data storage device and comprises a connecting interface, a near communication device, a safety switch and a controller. The connection interface is in connection with the external data storage device. The near communication device is coupled to the controller and detects storage information form a mobile device. The safety switch is coupled to the connecting interface. The controller is coupled to the safety switch, receives stored information representing a user possesses an access right of a computer and controls the safety switch to cut down the external data storage device from the near communication device when the access right information representing the user does not possess the access right of the computer.

Description

Near-field communication instrument and its data security management method

Technical field

The present invention relates to a kind of multi-media player function, relate in particular to a kind of energy and be used for the device taken of multi-media player function and expand seat.

Background technology

Computer industry faces the significant challenge about data security now, and described data security is the data in the accessing computer system so that undelegated individuality is under an embargo, so that data can not destroyed purposely.

Near-field communication (Near Field Communication is hereinafter referred to as NFC) instrument is a kind of data input device, its can be from card type Storage Media access data, described card type Storage Media comprises smart card or memory card.Comprising in each application of government, enterprise, commerce and individual level more and more important when data security, will need a kind of NFC instrument with security functions, only the user with access right be provided the data access of data system via described NFC instrument.

Summary of the invention

A kind of NFC instrument of the embodiment of the invention is connected between a computing machine and the external data storage device, comprises a connecting interface, a NFC device, a safety switch and a controller.Described connecting interface is connected to described external data storage device.Described NFC device is coupled to described controller, detects an access right information from a mobile device.Described safety switch is coupled to described connecting interface.Described controller, be coupled to described safety switch, receive the access right that described access right information represents whether the user has described computing machine, and when described access right information represents that described user does not have the access right of described computing machine, control described safety switch and cut off described external data storage device from described NFC device.

The another kind of data security management method of the embodiment of the invention is come the management data security by the NFC device between a computing machine and the external data storage device, comprising: provide to the data access of described external data storage device; Receive an access right information, wherein said access right information represents the access right whether user has described computing machine; And when described access right information represents that described user does not have the access right of described computing machine, control described safety switch and cut off described external data storage device from described NFC device.

For described purpose of the present invention, feature and advantage can be become apparent, embodiment cited below particularly, and cooperation accompanying drawing are described in detail as follows.

Description of drawings

Fig. 1 is for showing the block scheme of a kind of data security system 3 in the embodiment of the invention.

Fig. 2 is for showing the block scheme of a kind of radio frequency (RF) built-in self-test system 2 in the embodiment of the invention.

Fig. 3 is for showing the process flow diagram of a kind of data security method 7 in the embodiment of the invention.

Fig. 4 is for showing the block scheme of another kind of RF built-in self-test system 8 in the embodiment of the invention.

Reference numeral:

30: computing machine;

100: processor;

102: data storage element;

The 32:NFC device;

The 320:NFC module;

120: controller;

122: safety switch;

124: connecting interface;

126: data storage element;

The 34:NFC mobile device;

14: USB (universal serial bus) (USB) device;

16: other input and output (IO) device;

The 18:USB hub;

S600, S602 ..., S614: step;

S700, S702 ..., S712: step;

820: controller;

8200: the access right judge module;

8202: link block;

The 822:NFC module;

8220: forwarder;

8222: receiver;

The 84:NFC mobile device;

840: processor;

842: the processor fetch medium.

Embodiment

For allow purpose of the present invention, feature, and advantage can become apparent preferred embodiment cited below particularly, and cooperate appended diagram to be described in detail.Instructions of the present invention provides different embodiment that the technical characterictic of the different embodiments of the present invention is described.Wherein, the usefulness that is configured to explanation of each assembly among the embodiment is not to limit the present invention.And the part of Reference numeral repeats among the embodiment, for the purpose of simplifying the description, is not the relevance that means between the different embodiment.

Fig. 1 comprises computing machine 30, NFC device 32, NFC mobile device 34, other USB device 14 and other IO device 16 for showing the block scheme of a kind of data security system 3 in the embodiment of the invention.

Computing machine 30 comprises processor 100 and data storage element 304, and data storage element 304 comprises security software (not icon) and comprises the BIOS chip (not icon) of Basic Input or Output System (BIOS) (BIOS) firmware.In certain embodiments, processor 100 is written into the BIOS firmware, is applicable to the data security inspection after computing machine 30 is started shooting.After the load operation system, just carry out security software at processor 100 in other the embodiment.The user can have the login security input information BIOS firmware of data security audit function, uses executing data security inspection program.In addition, processor 100 can increase via security software, changes or remove user's safety information newly.The necessary first login security information of user is with the data in the accessing computer 30.Processor 100 can come comparison user safety information and log-on message by safety in utilization software, uses the data access power of judging the user.In certain embodiments, the BIOS firmware can be compared login security information with user's safety information, and is only just allowing when described both safety informations meet mutually computing machine 30 interior data access.In other embodiment, system operator can increase, change or remove user's safety information newly for the user by authentication by security procedures.User's safety information can be stored in data storage element 304 in the computing machine 30 or the data storage element 126 in BIOS chip or the NFC device 32.In certain embodiments, user's safety information comprises user's title or user's password.In other embodiment, user's safety information comprises manufacturer ID (VendorIdentification, VID), product ID (Product Identifi cation, PID) but or the sequence number of the device of representative by accessing computer 30 interior data authentications.

NFC is a kind of wireless technology, it is in conjunction with passive radio frequency identification (Radio FrequencyIdentification, RFID) and the active wireless communication, allow simplification transmission, exchanges data and wireless online between two NFC devices, described two NFC devices are very short apart, no more than several centimeters usually.When two communication devices that comprise NFC device 32 and NFC mobile device 34 put together be no more than 10 centimeters apart from the time will to set up NFC online, described two communication devices utilize the online data that transmit of described NFC in air interface.On the implementation, two communication devices produce the field (field) that is used for data transmission.Article one, NFC is online is based upon between initial installation (initiator) and the destination apparatus (target) forever.NFC also and smart card (smart card) operating such.Compare with other wireless communication technique for the design of wide distance communication, NFC is by being placed on two devices near mode or that touch mutually, with to the user very the mode of intuition carry out short distance communication between electronic installation.The physical security of NFC can be by the reaching than the short operation scope of communication device, and wherein the communication between communication device only has near the read-write scope within 10 centimeters of the readers and just can carry out.

NFC device 32 comprises controller 120, safety switch 122, connecting interface 124, data storage element 126 and NFC module 320.Controller 120 is coupled to data storage element 126 and NFC module 320.In addition, NFC module 320 is coupled to controller 120 and directly receives control from the processor of computing machine 30.A kind of NFC label of fixed position (not icon) can use passive type or active power supply, and whether near the proof of NFC mobile device 34 NFC module 320 can be provided.The NFC label that NFC mobile device 34 can read on the NFC module 320 is used the acquisition safety information.On the contrary, NFC module 320 also can obtain safety information by reading the NFC label on the NFC mobile device 34.The NFC device can exchange small amount of data, comprises file name tabulation, photo, song, application program or video data.If data volume is less than several kilobits (kilobytes), just can use the online data transmission of carrying out of NFC.For the data transmission that exceeds several kilobits, online can be used in of NFC set up other wireless connections to carry out the mass data communication, described other wireless connections can for example be bluetooth (Bluetooth) or high-facsimile wireless (Wireless fidelity is hereinafter referred to as WiFi).

After NFC mobile device 34 and NFC module 320 exchanging safety information (access right information), two NFC devices all can carry out security inspection.In certain embodiments, NFC mobile device 34 and NFC module 320 all can be used the security gold key that the Application Software Program generation can be identified mutually.In other embodiment, NFC mobile device 34 can be equipped with nonvolatil safety chip as security component.For example, NFC mobile device 34 can an embedded smart card microcontroller (not shown), described smart card microcontroller by NFC module 320 by authentication and be used for data access.In other embodiment, NFC mobile device 34 inserts external security memory element (not icon) as security component, described external security memory element can for example be the little SD card of safety, so that NFC module 320 can be judged the access right of NFC mobile device 34.The embedded safety chip of memory card is used for providing safety information.In other embodiments, NFC mobile device 34 uses and comprises SIM or the usim card of safety information, the SIM microcontroller that safety information is provided or auxiliary security chip.All after the success, just set up NFC between the two online at the security inspection of NFC mobile device 34 and NFC module 320.NFC module 320 can make NFC mobile device 34 as a telepilot, be used for the data access action between control computing machine 30 and

external storage device

14 and 16 via the various information of the online transmission of NFC to NFC mobile device 34.For example, processor 100 can honor be opened or closed safe switch 122 from the instruction of NFC mobile device 34, and data access control is provided by this.In other example, NFC module 320 transmits tabulating to NFC mobile device 34 of safety informations, makes NFC mobile device 34 can control newly-increased, change or deletion safety information.

In certain embodiments, NFC mobile device 34 can comprise the application software (not icon) for NFC proving program and data access control.NFC mobile device 34 also comprises NFC module (not icon), processor (not shown) and transmitter and receiver (not shown).Processor is coupled to NFC module and transmitter and receiver.NFC mobile device 34 is by its processor running application software, receive a NFC identifying information in order to identify NFC device 320, verify a NFC identifying information, and the move instruction signal is used the data access of controlling computing machine 30 to NFC module 320 when the proving program of a NFC identifying information is successful.The one NFC identifying information can the formula earlier paragraphs safety information of exchange of explanation.Proving program can comprise with NFC mobile device 34 and NFC module 320 shared known golden keys generation algorithms verifies a NFC identifying information.In case proving program success, NFC mobile device 34 can the move instruction signal to the NFC module 320 by checking to cut off or to set up computing machine 30 to the connection between USB device and other IO device (external data storage device), control by this data access of computing machine 30.

Fig. 2 uses the NFC device 32 of Fig. 1 for showing the process flow diagram of a kind of data security method 6 in the embodiment of the invention.

After 6 beginnings of data security method, NFC device 32 is primary data security inspection (S600).A gold key produces can pack into NFC device 32 or computing machine 30 of software (not icon) and produces the first security gold key (safety information) (S602) to produce algorithm by golden key.Similarly, NFC mobile device 34 also can produce software by the golden key of installing and produce the second security gold key (safety information) according to golden key generation algorithm.When near NFC mobile device 34 is placed to NFC module 320, making NFC module 320 can detect NFC mobile device 34 to exist, two NFC devices, comprise NFC module 320 and NFC mobile device 34, can intercourse the first and second securities gold key (S604), allow two NFC devices can verify that the security gold key of exchange meets aforementioned golden key and produces algorithm (S606).If meet, NFC module 320 can judge that NFC mobile device 34 is by authentication NFC device (S608).Similarly when the first security gold key that receives met the golden key generation algorithm of loading onto, NFC mobile device 34 can judge that NFC modules 320 be by authentication.In certain embodiments, NFC device 32 internal controller 120 can be carried out the proving program of the second gold medal key of exchange.In other embodiment, the proving program of the second gold medal key of exchange can be processed by the processor 100 of computing machine 30.After two NFC devices judge that all another NFC device is by authentication, just set up NFC therebetween online.In certain embodiments, NFC module 320 can be sent the proving program result of the second gold medal key to NFC mobile device 34, and receives the proving program result of the first gold medal key from NFC mobile device 34.By two proving program results, NFC module 320 can judge that two NFC devices are all by setting up the online authentication of NFC.Can be used in a small amount or online exchange of NFC of narrow data transmission by the communication between the authentication NFC device.In certain embodiments, can set up other for example bluetooth or the online communication of WiFi connect to carry out the data transmission of a large amount of or long distance via NFC is online.NFC module 320 is accepted from (S610) data access (S612) to allow corresponding computing machine 30 of NFC mobile device 34 data access control signals (not icon).For example, NFC module 320 can be sent to processor 100 with the data access control signal from NFC mobile device 34, processor 100 is then opened safety switch 122 according to the data access control signal, the data routing that connects by this computing machine 30 and

external storage device

14 and 16 allows the data access of computing machine 30.In other example, NFC module 320 can be sent to processor 100 from the NFC mobile device with data access control signal 34 by deliver, processor 100 is closed safe switch 122 then, cut off by this computing machine 30 and external storage device 14 and 16 s' data routing, the data access of forbidding computing machine 30.If NFC module 320 is judged NFC mobile device 34 with no authorizeds, NFC module 320 can be rejected the data access control signal from NFC mobile device 34, and method 6 finishes (S614) at this point.In certain embodiments, the security gold key that replaces described generation, NFC device 32 and computing machine 30 are with safety information, unique security discre value or safe sequence number for example, it can be identified by other NFC device, and the security discre value of described uniqueness or safe sequence number can be used in step S604 in the security inspection program of S608.

Fig. 3 uses the NFC mobile device 34 of Fig. 1 for showing the process flow diagram of a kind of data security method 7 in the embodiment of the invention.

Data security method 7 and the 6 similar and execution on NFC mobile device 34 of data security method.Step S700 is to the similar step S600 of S708 to S608, except NFC mobile device 34 execution in step S700 to S708 to produce the safety information of safety information and checking exchange.If proving program result success, NFC mobile device 34 are sent data access and are controlled signal to NFC module 320 with the data access (S710) of control computing machine 30.If the proving program failure, data security method 7 will withdraw from (S712).

NFC device 32 can be a kind of USB device that meets any USB standard, a kind of OTG (on-the-go) USB device or a kind of Wireless USB device, and can body circuit (IC) or discrete circuit in the USB device realize.

Fig. 4 is used for providing data security for showing the block scheme of a kind of data security system 8 in the embodiment of the invention, comprises computing machine 30, NFC device 82, NFC mobile device 84, other USB device 14 and other IO device 16.The circuit setting of data security system 8 and the connection data security ststem of Fig. 1 are similar, and relevant explanation can be found in aforementioned paragraphs, does not repeat them here.

NFC device 82 comprises NFC module 822, controller 820, safety switch 122, connecting interface 124 and data storage element 126, modules be connected with device connection and operation and Fig. 3 NFC device 32 corresponding module and the device relevant explanation can in aforementioned paragraphs, find, do not repeat them here.Connecting interface 124 is connected to external data storage device 14 and 16.Safety switch 122 is coupled to connecting interface 124.Processor 100 is coupled to safety switch 122, receive the access right information whether this user of expression has access right, and the control safety switch with when representing that when access right information this user does not have the access right of computing machine 30 from NFC device 82 cut-out external data storage devices 14 and 16.Data storage element 126 is coupled to controller, is used for storing user's safety information, and described user's safety information is used for the user that identification has computing machine 30 access rights.

Controller 820 can also comprise access right judge module 8200 and link block 8202.When access right information met user's safety information, access right judge module 8200 judged that the user has the access right of computing machine 30.When access right information represented that the user has the access right of computing machine 30, link block 8202 control safety switches connected external

data storage device

14 and 16.

NFC module 822 detects the access right information of self-moving device 84.NFC module 822 can also comprise forwarder 8220 and receiver 8222.Forwarder 8220 transmits the NFC safety information of identification NFC device to mobile device.When access right information represented that the user has access right, receiver 8222 received command signal with the access of control computer data from remote-control device.

NFC mobile device 84 comprises processor 840 and processor readable medium 842, but described processor readable medium 842 comprises the programmed instruction of processor 840 accesses and execution.The data security method 7 of described programmed instruction in can execution graph 3.

NFC device 82 can be calculating punch, usb hub or other USB device.

The application's case is corresponding to U.S.'s priority application case 61/546,522, and sending the part date is on October 12nd, 2010.Its complete content has been integrated in this.

" judgement " word that instructions is used comprises calculating, estimates, processes, obtains, investigates, searches (for example searching) in a form, a database or other data configuration, determines and similar meaning." judgement " also comprises solution, detection, selection, obtains and similar meaning.

Various logic blocks, module and the circuit that the present invention describes can use general processor, digital signal processor (DSP), ASIC(Application Specific Integrated Circuit) (ASIC) or other program-controlled logic module, discrete type logical circuit or transistor logic lock, discrete type nextport hardware component NextPort or be used for carrying out its combination in any of the function of execution described in the invention.General processor can be microprocessor, and perhaps, this processor can be any commercial processor, controller, microprocessor or state machine.

Operation and the function of various logic blocks, module and circuit that the present invention describes can utilize circuit hardware or embedded software code to be realized, this embedded software code can be by a processor access and execution.

Although the present invention discloses as above with preferred embodiment, so it is not to limit the present invention, and any those of ordinary skill in the field when can doing a little change and retouching, and do not break away from the spirit and scope of the present invention.

Claims

1. a near-field communication instrument is connected between a computing machine and the external data storage device, comprising:

One connecting interface is connected to described external data storage device;

One near-field communication device is coupled to a controller, detects an access right information from a mobile device;

One safety switch is coupled to described connecting interface; And

Described controller, be coupled to described safety switch, receive the access right that described access right information represents whether the user has described computing machine, and when described access right information represents that described user does not have the access right of described computing machine, control described safety switch and cut off described external data storage device from described near-field communication device.

2. near-field communication instrument according to claim 1 also comprises a data storage element, is coupled to described controller, stores user's safety information, and described user's safety information can be identified the user of the access right with described computing machine.

3. near-field communication instrument according to claim 2, wherein, described controller also comprises an access right judge module, when described access right information meets described user's safety information, judges that described user has the described access right of described computing machine.

4. near-field communication instrument according to claim 1, wherein, described controller also comprises a link block, when described access right information represents that described user has the described access right of described computing machine, controls described safety switch and is connected to described external data storage device.

5. near-field communication instrument according to claim 1, wherein, described near-field communication device also comprises a forwarder, transmits the near-field communication safety information of the described near-field communication device of identification to described mobile device.

6. near-field communication instrument according to claim 1, wherein, described near-field communication device also comprises a receiver, when described access right information represents that described user has the described access right of described computing machine, receive a command signal to control the data access of described computing machine from described remote-control device.

7. near-field communication instrument according to claim 1, wherein, described access right information comprises user's title and user's password.

8. a data security management method is come the management data security by the near-field communication device between a computing machine and the external data storage device, comprising:

Provide to the data access of described external data storage device;

Receive an access right information, wherein said access right information represents the access right whether user has described computing machine; And

When described access right information represents that described user does not have the access right of described computing machine, control described safety switch and cut off described external data storage device from described near-field communication device.

9. data security management method according to claim 8 also comprises storing user's safety information, and described user's safety information can be identified the user of the access right with described computing machine.

10. data security management method according to claim 9 also comprises when described access right information meets described user's safety information, judges that described user has the described access right of described computing machine.

11. data security management method according to claim 8 also comprises when described access right information represents that described user has the described access right of described computing machine, controls described safety switch and is connected to described external data storage device.

12. data security management method according to claim 8, wherein, described receiving step comprises from described computing machine and receives described access right information.

13. data security management method according to claim 8 also comprises by the near-field communication device in the described near-field communication device and detects described access right information from a mobile device.

14. data security management method according to claim 13 comprises that also the near-field communication safety information that transmits the described near-field communication device of identification is to described mobile device.

15. data security management method according to claim 13, also comprise when described access right information represents that described user has the described access right of described computing machine, receive a command signal to control the data access of described computing machine by described near-field communication device from described remote-control device.