CN206388181U - A kind of encrypted data transmission line for computer - Google Patents

Abstract

The utility model discloses a kind of encrypted data transmission line for computer, first interface and second interface are set respectively at its two ends, DEU data encryption unit is also set up in the data line, DEU data encryption unit is electrically connected with first interface and second interface respectively；Wherein, first interface is connected with main frame, second interface is connected with storage device, DEU data encryption unit sets up communication with main frame and storage device respectively and be connected and carry out data transmission according to the communications protocol of agreement, and the clear data that main frame writes is encrypted as ciphertext data storage in storage device or by the ciphertext data deciphering read from storage device to be transferred to main frame after clear data by DEU data encryption unit.Compared with prior art, the technical solution of the utility model provides a kind of cost low, easy for installation encrypted data transmission line, so as to easily solve the stolen security threat of storage device, while additionally providing quick, thoroughly data destroying function.

Description

A kind of encrypted data transmission line for computer

Technical field

The utility model belongs to data storage and data security arts, more particularly to a kind of encryption data for computer Transmission line.

Background technology

The problem of data safety of computer (hard disk and movable storage device) is always the focus of social concerns.Computer is hard Disk problem of data safety mainly has two important steps：One is the data safety of hard disk during use, such as hard disk be stolen and That causes divulges a secret；Another is the data destroying problem of hard disk, such as when hard disk is scrapped or switchs to weight under insecure environments Newly in use, needing to carry out data destroying processing to the former deposit data of hard disk.Movable storage device has that small volume, capacity are big, make With convenient and transmission speed it is fast the advantages of, but the safety problem of movable storage device is also following, when these equipment and meter Calculation machine is connected, and can not only make in virus and Malware intrusion computer, can also confidential data in downloading computer, cause Personal, the enterprise even loss of country.Therefore security threat is the problem of mobile device application is badly in need of solving and improved.

The current antitheft major measure of hard disk is to be bound computer and hard disk by special-purpose software, such as by computer MAC Sequence number binding of address and hard disk etc..This kind of solution is required for professional to carry out software development and maintenance, cost Height, and there is system compatible sex chromosome mosaicism, the shortcomings of applicability is narrow.It is main to use exclusive data pin in terms of hard disc data destruction Ruin software and hard disk is repeated erasable, such as can write 0 using whole disk, write 1 or write the modes such as random number.This data pin The major defect for ruining mode is that data destroying is not thorough, especially for solid state hard disc, it is difficult to accomplish 100% destruction data, Time-consuming in addition.Mechanical hard disk can also thoroughly destroy data using the mode of magnetization, but cost it is high, in-convenience in use.

Solving the mode of movable storage device security threat at present mainly has two kinds, and one kind is artificially to forbid computer peripheral equipment The use of interface, such as forbid the use of USB interface, and this method applies more in departments such as enterprise, governments, but so straight Connect and have rejected the convenience of movable storage device and reduce operating efficiency.Another method is moved using technological means control access The use of dynamic storage device, i.e., affix one's name to solution in computer-internal and equipment access monitored in real time, solution is main It is divided to two kinds of driving stage programming and windows application programs.But two kinds of solutions be required for professional develop and Safeguard, cost is at a relatively high.

Therefore, for drawbacks described above present in currently available technology, it is necessary to be studied in fact, to provide a kind of scheme, Solve defect present in prior art.

Utility model content

In view of this, it is necessory to provide a kind of encrypted data transmission line for computer, cost is low, easy for installation, The stolen security threat of storage device is can solve the problem that, while quick, thoroughly data destroying function is additionally provided, either individual People or the common market of enterprise, or in niche markets such as finance, government, public security, all with extensive market potential and hair Exhibition prospect.

In order to overcome the defect of prior art, the technical solution of the utility model is：

A kind of encrypted data transmission line for computer, first interface and second interface are set at its two ends respectively, should DEU data encryption unit is also set up in data line, the DEU data encryption unit connects with the first interface and described second respectively Mouth electrical connection, encryption and decryption computing is carried out for the data to transmission；Wherein, the first interface is connected with main frame, described Second interface is connected with storage device, and the DEU data encryption unit sets up communication with main frame and storage device respectively and is connected and presses Communications protocol as agreed carries out data transmission, and the clear data that main frame writes is encrypted as ciphertext number by the DEU data encryption unit According to be stored in storage device or by the ciphertext data deciphering read from storage device be clear data after be transferred to main frame.

Preferably, the DEU data encryption unit includes the 3rd interface, the 4th interface, the first protocol process module, main control Device, encryption/decryption module and second protocol processing module, wherein, the 3rd interface passes through the first cable and first interface electricity Gas is connected, and the 4th interface is electrically connected by the second cable and the second interface；First protocol process module is used Data communication is carried out in passing through first cable and main frame；The second protocol processing module is used to pass through second cable Data communication is carried out with storage device；The encryption/decryption module is used to perform enciphering and deciphering algorithm；The master controller and described the One protocol process module, encryption/decryption module and second protocol processing module, control first protocol process module, encryption and decryption mould Block and second protocol processing module carry out data processing.

Preferably, the first cable built-in power line, signal wire and ground wire, the second cable built-in power line, Signal wire and ground wire, first cable and second cable are arranged within gum cover together；The first interface and institute Stating second interface includes FPDP and power port.

Preferably, the DEU data encryption unit is realized using dedicated encrypted switching chip.

Preferably, the dedicated encrypted switching chip is set in first interface or second interface.

Preferably, when the storage device is hard disk, the first interface is connected with the hard disc data interface of host mainboard Connect, the second interface is connected with the data-interface of hard disk；The first interface and the second interface be SATA interface or SAS interfaces.

Preferably, when the storage device is mobile storage disc, the data-interface phase of the first interface and host mainboard Connection, the second interface is with setting Peripheral Interface seat on host machine casing to be connected；Mobile storage disc accesses the Peripheral Interface Communication is set up after seat by the DEU data encryption unit and main frame to be connected.

Preferably, the first interface and the second interface use USB interface or UFS interfaces.

Preferably, also set up for strengthening the signal regenerator of transmission signal strength, the signal regenerator is arranged on institute State the front end and/or rear end of DEU data encryption unit.

Preferably, the DEU data encryption unit also Receiving Host send control instruction and according to the control instruction carry out phase The information configuration answered.

Compared with prior art, using the technical solution of the utility model, enterprise can advantageously build a peace very much The inside use environment of full computer data storage：That is the storage device of enterprises is only capable of setting in the computer of enterprises It is standby above normally to be read and write, and will be identified that legacy data can not on blank panel, disk in other outside common computers It is identified, prevent because storage device is stolen or illegal divert and caused by information leakage；On the other hand, can be by the communication of agreement Protocol command updates or removed the mode of original cipher key, realizes that rapidly and thoroughly hard disc data destroys operation；Also can be by direct The mode of data wire is changed or destroyed, the data destroying operation of hard disk is completed.In addition, stating the same of technique effect in realization When do not influence the normal of user to use, all storage device data encryption and decryption operations are all automatic realize.

Brief description of the drawings

Fig. 1 is the theory diagram for the encrypted data transmission line that the utility model is used for computer.

Fig. 2 is the composition frame chart for the encrypted data transmission line that the utility model is used for computer.

Fig. 3 is the structured flowchart of DEU data encryption unit in the utility model.

Fig. 4 be the utility model in be used for hard disk data line structured flowchart.

Fig. 5 is the structured flowchart of the data line of SATA interface in the utility model.

Fig. 6 is the theory diagram of the another embodiment of the utility model encrypted data transmission line.

Specific examples below will further illustrate the utility model with reference to above-mentioned accompanying drawing.

Embodiment

Make below with reference to a kind of encrypted data transmission line for computer that accompanying drawing is provided the utility model into one Walk explanation.

In order to overcome the defect of prior art, applicant to conducting in-depth research in the prior art, it has been found that Data line stores a link of security protection system as computer and storage device, in the prior art scheme but only As the single electrical connection cable of function.Therefore, the data transfer of the present utility model with Data Encryption Transmission function Line, is built-in with encrypting module, by configuring this data line with Data Encryption Transmission function in computer-internal Mode, realizes that the automatic encryption and decryption of the storage device data to being accessed is operated, the internal security for foring storage dish uses ring Border：I.e. storage dish is only capable of normally being read and write in the computer equipment of this data wire particular arrangement, and it is outside other Will be identified that legacy data can not be identified on blank panel, disk in common computer, therefore, even if hard disk be stolen, also without Method causes leakage of data, it is ensured that computer hard disk data safety.

Referring to Fig. 1 and Fig. 2, show the utility model proposes encrypted data transmission line principle and composition frame chart, should The two ends of data line set first interface (10) and second interface (11) respectively, at the same also set up in data wire respectively with First interface (10) and the DEU data encryption unit (12) of second interface (11) electrical connection, are carried out plus solution for the data to transmission Close computing；First cable (13) and the second cable (14) are arranged within gum cover (15) together, the first cable (13) built-in power Line (131), signal wire (132) and ground wire (133), the second cable (14) built-in power line (141), signal wire (142) and connect Ground wire (143)；First interface (10) and second interface (11) include FPDP and power port, are respectively configured to provide power supply Power supply and data communication.Wherein, first interface (10) is connected with main frame, and second interface (11) is connected with storage device, number Communication is set up with main frame and storage device respectively according to ciphering unit (12) to be connected and according to the communications protocol progress data biography of agreement Defeated, the clear data that main frame writes is encrypted as ciphertext data storage in storage device or will be from by DEU data encryption unit (12) Storage device read ciphertext data deciphering be clear data after be transferred to main frame.

Further, it can not only realize that reading and writing data is same by the communications protocol of agreement between data line and main frame When can also realize the transmission of control command, DEU data encryption unit (12) goes back the control instruction of Receiving Host transmission and according to the control System instruction carries out corresponding information configuration.Such as, the management of key can be realized by the communications protocol of agreement, so that in data Transmission, distribution can be realized in transmission line, update and destroys key, and then can be real by way of updating or destroying key Now quick, thoroughly hard disc data destruction.

In a preferred embodiment, the first control instruction that DEU data encryption unit (12) Receiving Host is sent, and then DEU data encryption unit (12) obtains the key of host assignment and storage.By the way of host assignment key, for enterprises The data safety management of multiple stage computers is very convenient, such as, the storage device distribution identical key used enterprises, So, storage device is only capable of normally being read and write in each computer equipment internally；And other are common outside access When on computer, because outer computer can not correctly understand storage device MBR cipher-text informations, be identified as blank panel, on disk Legacy data file also can not be identified, so as to prevent information leakage.

In a preferred embodiment, the second control instruction that DEU data encryption unit (12) Receiving Host is sent, master control The key of storage in the nonvolatile memory is removed or updated to device (123) processed by control command.It is quick, thorough so as to realize The data destroying function at bottom.

In a preferred embodiment, the 3rd control instruction that DEU data encryption unit (12) Receiving Host is sent, and then Random number is as key and stores for DEU data encryption unit (12) generation.Due to generating key by the way of random number, so that greatly The big security for improving key.

Referring to Fig. 3, it show as the structured flowchart of DEU data encryption unit in the utility model (12), DEU data encryption unit (12) the 3rd interface (121), the 4th interface (126), the first protocol process module (122), master controller are further comprised (123), wherein, the 3rd interface (121) passes through the first cable for encryption/decryption module (124) and second protocol processing module (125) (13) it is electrically connected with first interface (10), the 4th interface (126) is electrically connected by the second cable (14) with second interface (11) Connect；First protocol process module (122) is used to carry out data communication with main frame by the first cable (13)；Second protocol handles mould Block (125) is used to carry out data communication with storage device by the second cable (14)；First protocol process module (122) and second Protocol process module (125) is used for the function of completing to arrange communications protocol physical layer and articulamentum parsing；Encryption/decryption module (124) it is used to perform enciphering and deciphering algorithm；Master controller (123) and the first protocol process module (122), encryption/decryption module (124) With second protocol processing module (125), control at the first protocol process module (122), encryption/decryption module (124) and second protocol Manage module (125) and carry out data processing, that is, master controller (123) can recognize the type of transmitted protocol package, if Packet, then the first protocol process module (122) or second protocol processing module (125) are parsed after the protocol package again by adding solution Close module (124) data is encrypted/decryption oprerations；If order bag or state bag, then directly parse the protocol package And perform corresponding command operating, such as it can transmit, distribute and more new key according to the communications protocol order of agreement, it is certainly close Key can also be generated at random.

Certainly, nonvolatile memory is also included in DEU data encryption unit (12), nonvolatile memory can individually be set Put or integrated master controller in, mainly for storing the key of enciphering and deciphering algorithm and the firmware of DEU data encryption unit (12).

Further, DEU data encryption unit (12) also includes randomizer, randomizer and master controller (123) it is connected, for producing random number, produced random number can be used as key.

In a kind of preferred embodiment, DEU data encryption unit (12) is realized using dedicated encrypted switching chip.For simplification The structure design of encrypted data transmission, dedicated encrypted switching integrated chip is set in first interface (10) or second interface (11), So as to save the first cable (13) or the second cable (14).Certainly different interface and agreement, encryption switching chip are used Can be the agreement switching chip of the forms such as SATA-SATA, USB-USB or SAS-SAS, it is right containing enciphering and deciphering algorithm module Data carry out encryption and decryption computing.The clear data of computer write-in hard disk is transferred to encryption switching chip through data from interface, plus Plaintext is changed into ciphertext by close switching chip, and is transferred to external hard disc through data main interface；The ciphertext that computer is read from hard disk Data are transferred to encryption switching chip through data main interface, and encryption switching chip changes into ciphertext in plain text, and through data from interface It is transferred to main frame.

When encryption switching chip transfers chip using the agreement of SATA-SATA forms, the first protocol process module (122) It is SATA data respectively from protocol module and SATA data master agreement modules with second protocol processing module (125)；When encryption turns Connect chip using USB-USB forms agreement switching chip when, the first protocol process module (122) and second protocol processing module (125) it is usb data respectively from protocol module and usb data master agreement module.

Further, enciphering and deciphering algorithm module, using the cryptographic symmetrical algorithm of high speed, can be but to be not limited to state close One of SM4, AES, GOST or DES scheduling algorithm.

In a preferred embodiment, encryption switching chip uses model X-Wall DX USB OTG or X-Wall MX+ special chip.

Using above-mentioned technical proposal, due to containing DEU data encryption unit (12) inside data line, to main frame and it can deposit The data transmitted between storage equipment carry out encryption and decryption computing automatically；Meanwhile, it can be transmitted, divided by the communications protocol order of agreement Match somebody with somebody, update and destroy key；Further, quick, thoroughly hard disk number can be realized by way of updating or destroying key According to destruction.

In actual use, storage device is hard disk or mobile storage disc.Referring to Fig. 4, the number for hard disk is shown According to the structured flowchart of transmission line, when storage device is hard disk, first interface (10) is connected with the hard disc data interface of host mainboard Connect, second interface (11) is connected with the data-interface of hard disk；First interface (10) includes data from interface and power interface one, Second interface (11) includes data main interface and power interface two, and power interface is output as data for the power supply of access host and added Close unit (12) and hard disk provide power supply, and described data are matched from the communications protocol formation of interface and data main interface.Need Point out, although first interface (10) and second interface (11) are shown including FPDP and power port in Fig. 4, but with The second interface (11) of hard disk connection can also only include FPDP, and the feeder ear of hard disk is directly provided by main frame.Ginseng See Fig. 5, show the structured flowchart of the data line of SATA interface in the utility model, first interface (10) includes SATA numbers According to from interface, it is connected for the hard disk SATA data-interfaces with main frame, second interface (11) includes SATA data main interfaces, is used for Be connected with the SATA data-interfaces in hard disk, Data Transport Protocol uses SATA protocol, namely formed respectively SATA from interface and SATA main interfaces are matched.Certainly, data line of the present utility model is not limited in SATA interface, it would however also be possible to employ SAS etc. Other interface shapes, during using SAS interfaces, SAS is matched from interface and SAS main interfaces.Specifically used and operation principle is as follows：

1) data of the hard disc data transmission line are connected from interface with the hard disk main interface of computer, data main interface and The data-interface of external hard disc is connected；Power interface one is connected with the output interface of computer power supply, by the He of power interface two The power interface of external hard disc is connected；

2) when initial, DEU data encryption unit (12) can be used as encryption and decryption key with any one random number；Also can be by about Fixed communications protocol order, by host assignment key；Produced key is preserved in the nonvolatile memory.

3) when computer carries out data write operation to external hard disc, the clear data of institute's write-in hard disk is through data from connecing Port transmission is to DEU data encryption unit (12), and plaintext is changed into ciphertext by DEU data encryption unit (12), and is transferred to through data main interface Hard disk；All data that hard disk is preserved are ciphertext, when hard disk is stolen or arrives other computers by illegal peculation, firmly The data of disk can not normally be read, so as to prevent information leakage.

4) when main frame reads hard disc data, the ciphertext data read from hard disk through data main interface are transferred to data encryption Unit (12), DEU data encryption unit (12) changes into ciphertext in plain text, and is transferred to main frame from interface through data.Computer The data read are clear data, do not influence the normal of user to use.

5), can be by the communications protocol order of agreement more when carrying out data dump or during data destroying to hard disc data New or removing original cipher key, by way of directly changing or destroying data wire, can also complete the data destroying behaviour of hard disk Make.

Similarly, when storage device is mobile storage disc, first interface (10) is connected with the data-interface of host mainboard, the Two interfaces (11) are with setting Peripheral Interface seat on host machine casing to be connected；Pass through data after mobile storage disc access Peripheral Interface seat Ciphering unit (12) is set up communication with main frame and is connected.Using different data communication protocols, first interface (10) and second interface (11) different types of Peripheral Interface can be used, USB interface or UFS interfaces are generally used in actual use.

Specifically used and operation principle is as follows：

1) USB/UFS of data line is connected from interface with the USB/UFS main interfaces of computer, by data line USB/UFS main interfaces be connected with outside USB/UFS mobile storage discs；

2) when initial, it is close that the random number that data line can be produced by internal randomizer is used as encryption and decryption Key；Also can be by the communications protocol order of agreement, by host assignment key；

3) when main frame reads and writes outside USB/UFS mobile storage discs, the information such as all data, order and state is logical Cross data line to be parsed and transmitted, wherein order bag and state bag are not processed and directly transmitted, packet then passes through Transmitted again after encryption and decryption computing.All data messages of external USB/UFS storage dishes, including MBR (MBR) and Data file is ciphertext.

4) by way of the device of same key is configured to the USB interface of multiple stage computers, computer USB/UFS is constituted The internal security use environment of interface：I.e. internal USB/UFS storage dishes are only capable of ability in each computer equipment internally Normally read and write；And when outside access in other common computers, because outer computer can not correctly understand the MBR of storage dish Cipher-text information and be identified as blank panel, legacy data file also can not be identified on disk, so as to prevent information leakage；It is another Aspect, when the USB/UFS storage dishes of outside access embedded computer system, the MBR of the disk be decrypted into mess code and by An original disc (RAW disks) is identified as, the disk legacy data is also decrypted into mess code and can not be identified, so as to avoid possible Virus infection or malicious data such as steal at the behavior.

Improved constantly with the access speed of storage device interface, 3Gbps even more highs are can reach, due to the utility model DEU data encryption unit (12) is provided with data line, makes high speed communications signals easily signal attenuation, so as to influence number According to the reliability of transmission.In order to improve the reliability of data transfer, the utility model proposes a kind of preferred embodiment, in encryption The signal regenerator (15,16) for strengthening transmission signal strength is also set up in data line, signal regenerator (15,16) is set Put in the front end and/or rear end of DEU data encryption unit (12).Referring to Fig. 6, the utility model encrypted data transmission line is shown The theory diagram of another embodiment, the first signal regenerator (15) is serially connected in first interface (10) and DEU data encryption unit (12) between；Secondary signal regenerator (16) is serially connected between second interface (11) and DEU data encryption unit (12).Ordinary circumstance Under, the first signal regenerator (15) and secondary signal regenerator (16) are positioned close to the place of DEU data encryption unit (12), main The high speed communications signals that machine is transmitted through first interface (10), the first cable (13) again to the first signal regenerator (15), through After one signal regenerator (15) strengthens and recovered, DEU data encryption unit (12) is transmitted directly to, vice versa.By setting first Signal regenerator (15) and secondary signal regenerator (16), so as to compensate due to setting DEU data encryption unit in data line (12) loss of signal caused by, substantially increases the reliability of data transfer.

Further, the first signal regenerator (15) and secondary signal regenerator (16) are real using integrated chip PS8513C It is existing.Certainly, the first signal regenerator (15) and secondary signal regenerator (16) can also be arranged in DEU data encryption unit (12).

The explanation of above example is only intended to help and understands method of the present utility model and its core concept.It should refer to Go out, for those skilled in the art, can also be to this on the premise of the utility model principle is not departed from Utility model carries out some improvement and modification, and these are improved and modification also falls into the utility model scope of the claims It is interior.

The foregoing description of the disclosed embodiments, enables professional and technical personnel in the field to realize or new using this practicality Type.A variety of modifications to these embodiments will be apparent for those skilled in the art, the utility model Defined in General Principle can be real in other embodiments in the case where not departing from spirit or scope of the present utility model It is existing.Therefore, the utility model is not intended to be limited to these embodiments shown in the utility model, and is to fit to and this practicality The new disclosed principle most wide scope consistent with features of novelty.

Claims (10)

1. a kind of encrypted data transmission line for computer, first interface (10) and second interface are set at its two ends respectively (11), it is characterised in that DEU data encryption unit (12) is also set up in the data line, the DEU data encryption unit (12) is respectively It is electrically connected with the first interface (10) and the second interface (11), encryption and decryption computing is carried out for the data to transmission； Wherein, the first interface (10) is connected with main frame, and the second interface (11) is connected with storage device, and the data add Close unit (12) sets up communication with main frame and storage device respectively and is connected and carries out data transmission according to the communications protocol of agreement, institute State DEU data encryption unit (12) and the clear data that main frame writes is encrypted as ciphertext data storage in storage device or will be from Storage device read ciphertext data deciphering be clear data after be transferred to main frame.

2. the encrypted data transmission line according to claim 1 for computer, it is characterised in that the data encryption list First (12) include the 3rd interface (121), the 4th interface (126), the first protocol process module (122), master controller (123) plus Deciphering module (124) and second protocol processing module (125), wherein, the 3rd interface (121) by the first cable (13) with First interface (10) electrical connection, the 4th interface (126) passes through the second cable (14) and the second interface (11) Electrical connection；First protocol process module (122) is used to carry out data communication by first cable (13) and main frame； The second protocol processing module (125) is used to carry out data communication by second cable (14) and storage device；It is described Encryption/decryption module (124) is used to perform enciphering and deciphering algorithm；The master controller (123) and first protocol process module (122), encryption/decryption module (124) and second protocol processing module (125), control first protocol process module (122), add Deciphering module (124) and second protocol processing module (125) carry out data processing.

3. the encrypted data transmission line according to claim 2 for computer, it is characterised in that first cable (13) built-in power line (131), signal wire (132) and ground wire (133), the second cable (14) built-in power line (141), Signal wire (142) and ground wire (143), first cable (13) and second cable (14) are arranged on gum cover (15) together Within；The first interface (10) and the second interface (11) include FPDP and power port.

4. the encrypted data transmission line according to claim 1 or 2 for computer, it is characterised in that the data add Close unit (12) is realized using dedicated encrypted switching chip.

5. the encrypted data transmission line according to claim 4 for computer, it is characterised in that the dedicated encrypted turns Chip is connect to be arranged in first interface (10) or second interface (11).

6. the encrypted data transmission line according to claim 1 or 2 for computer, it is characterised in that the storage is set It is standby that the first interface (10) is connected with the hard disc data interface of host mainboard when being hard disk, the second interface (11) and The data-interface of hard disk is connected；The first interface (10) and the second interface (11) are SATA interface or SAS interfaces.

7. the encrypted data transmission line according to claim 1 or 2 for computer, it is characterised in that the storage is set During for being mobile storage disc, the first interface (10) is connected with the data-interface of host mainboard, the second interface (11) With setting Peripheral Interface seat on host machine casing to be connected；Mobile storage disc is added after accessing the Peripheral Interface seat by the data Close unit (12) is set up communication with main frame and is connected.

8. the encrypted data transmission line according to claim 7 for computer, it is characterised in that the first interface (10) and the second interface (11) use USB interface or UFS interfaces.

9. the encrypted data transmission line according to claim 1 or 2 for computer, it is characterised in that also setting up is used for Strengthen the signal regenerator (15,16) of transmission signal strength, the signal regenerator (15,16) is arranged on the data encryption list The front end and/or rear end of first (12).

10. the encrypted data transmission line according to claim 1 or 2 for computer, it is characterised in that the data add Close unit (12) goes back the control instruction of Receiving Host transmission and carries out corresponding information configuration according to the control instruction.