JP2011123625A - Password management and authentication method suitable for trusted platform module - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a password management and authentication method suitable for an electronic device having a trusted platform module (TPM). <P>SOLUTION: An authentication code is made to be automatically generated according to a TPM password (S130), and an authentication device selected by a user is made to store the authentication code (S140). Because the authentication device storing the authentication code directly functions as an electronic key of the TPM, the user does not have to store any password, and can access a hard disk (HD) or data encrypted by the TPM by only connecting the authentication device to the electronic device (S150). <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates generally to password management and authentication methods, and more particularly to password management and authentication methods suitable for electronic devices having a Trusted Platform Module (TPM).

  With the spread of computers and networks, various computer systems have become the most indispensable tools in our daily lives and have become the main data processing tools in the work environment. A hard disk (HD) has the largest storage capacity of all existing storage devices and is the most important data storage device today. Thus, computer system users are increasingly concerned about data security issues. The risk of computer data leaks has increased dramatically as computer intrusions and Trojan programs have increased. Notebook computers are also the main targets of thieves because they are highly portable, expensive, and easy to resell. If data in a computer system is stolen, there can be significant and irreversible loss.

  Currently, the most commonly adopted data protection technology is the Trusted Platform Module (TPM) provided by the Trusted Computing Group (TCG), which includes Intel, Acer, Many global IT such as IBM, IBM, Hewlett-Packard, HP, Advanced Micro Devices, AMD, Sony, Sun Micro, and Microsoft Companies support the TPM protocol. The TPM directly encrypts the HD or data folder, and the encrypted HD or data folder needs to be decrypted using a TPM chip in addition to the password. Therefore, even if the hacker obtains the user password, the encrypted data cannot be accessed because the corresponding password is not provided.

  The user usually needs to manually enter the password and decrypt the encrypted file with the TPM chip to obtain the desired operating rights, functions and time. However, there is a possibility that the user forgets the password and cannot access the encrypted file, which can be a big trouble for the user.

  Accordingly, the present invention provides a password management and authentication method suitable for an electronic device having a trusted platform module (TPM). In this password management and authentication method, an authentication code is set according to the TPM password. Automatically generate and store this authentication code in an authentication device (eg, Universal Serial Bus (USB) flash drive or Bluetooth device) selected by the user, so that the authentication device functions as an electronic key for the TPM Make it possible. Thus, the user does not need to remember any passwords and can simply access the data folder or hard disk (HD) encrypted by the TPM by simply connecting the authentication device to the electronic device. . This makes the password management and authentication method of the present invention very convenient for the user.

  The present invention allows a storage device (eg, a flash drive or a Bluetooth device) to function as an authentication device and sets the authentication device as an electronic key of the TPM so that the user can use the authentication device to make the TPM A computer readable medium is also provided that allows easy access to encrypted data folders or HD.

  The present invention also provides a password management and authentication method suitable for an electronic device having a TPM. This password management and authentication method includes the following steps. In the first step, an authentication device connected to the electronic device is detected. In the next step, the hardware identification code of the authentication device is read. In the next step, an authentication code is generated according to the hardware identification code and the user password, and this authentication code is stored in the authentication device or electronic device so that the authentication device can function as an electronic key. If the authentication device is connected to the electronic device, the authentication code is automatically authenticated. If the authentication code is correct, the data folder or HD encrypted by the electronic device is automatically decrypted and the user can use the data folder or HD.

  According to an example of the present invention, the authentication device is provided with a USB flash drive, a Bluetooth device or a portable HD, and the hardware identification code includes a product serial number or a medium access control (MAC) address. Provides a notebook computer, desktop computer or mobile phone.

  According to an example of the present invention, after the step of detecting the authentication device connected to the electronic device, the user is further asked whether to set the authentication device as an electronic key.

  According to an example of the present invention, the step of generating the authentication code according to the hardware identification code and the user password further includes requesting the user to enter the user password.

  According to an example of the present invention, the step of automatically authenticating the authentication code further comprises determining whether the hardware identification code of the authentication device matches the authentication code.

  According to an example of the present invention, the password management and authentication method further includes the step of closing the data folder or HD encrypted by the electronic device when the authentication device is disconnected from the electronic device.

  According to an example of the present invention, the step of automatically authenticating the authentication code further includes re-authenticating the authentication code when the electronic device returns from a suspended state to a normal state.

  In accordance with an example of the present invention, the step of automatically authenticating the authentication code further includes detecting whether the TPM is operating and ignoring the authentication code if the TPM is not operating. To do.

  According to an example of the present invention, the step of generating the authentication code according to the hardware identification code and the user password further includes the step of encrypting the authentication code.

  According to an example of the present invention, an electronic device uses a TPM to encrypt or decrypt a data folder or HD, and the user password is a TPM password.

  The present invention also provides a password authentication method suitable for an electronic device having a TPM, and this password authentication method includes the following steps. In the first step, it is detected whether the TPM is operating. If the TPM is operating, it detects whether the authentication device is connected to the electronic device. In the next step, the authentication code in the authentication device or electronic device is automatically authenticated. If the authentication code is correct, the data folder or HD encrypted by the TPM is automatically decrypted, and the user can use the data folder or HD.

  The present invention also provides a computer readable medium for storing a plurality of program instructions. Program instructions are loaded into the electronic device to perform the following steps. First, an authentication device connected to the electronic device is detected. Next, the hardware identification code of the authentication device is read. Next, an authentication code is generated according to the hardware identification code and the user password, and this authentication code is stored in the authentication device or electronic device so that the authentication device can function as an electronic key. If the authentication device is connected to the electronic device, the authentication code is automatically authenticated. If the authentication code is correct, the data folder or HD encrypted by the electronic device is automatically decrypted, and the user can use the data folder or HD.

  The present invention also provides a computer readable medium including a plurality of program instructions. These program instructions are loaded into the electronic device to execute the following steps. First, it is detected whether the TPM is operating. If the TPM is operating, it is detected whether the authentication device is connected to the electronic device. Next, the authentication code in the authentication device or electronic device is automatically authenticated. If the authentication code is correct, the data folder or HD encrypted by the TPM is automatically decrypted, and the user can use the data folder or HD.

  As described above, in the present invention, the flash drive or the Bluetooth device functions as an electronic key of the TPM. Thus, the user can select his own authentication device as an electronic key, and after setting the electronic key, the user can use a flash drive or a Bluetooth device to open a file encrypted by the TPM. Can do. This eliminates the need for the user to remember any passwords, which is very convenient. Furthermore, in the present invention, since the electronic key used by the user is determined according to the hardware identification code of the flash drive or the Bluetooth device, the authentication code in the flash drive or the Bluetooth device is protected. This further enhances data security.

FIG. 1 is a flowchart of a password management and authentication method according to the first embodiment of the present invention. FIG. 2 is a flowchart of a password authentication method according to the second embodiment of the present invention. FIG. 3 is a flowchart showing an electronic key setting method according to the third embodiment of the present invention. FIG. 4 is a diagram showing a hardware device according to the fourth embodiment of the present invention.

  The accompanying drawings are included to facilitate a further understanding of the invention and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments of the present invention and together with the description, serve to explain the principles of the invention.

  Reference will now be made in detail to the preferred embodiments of the present invention as illustrated in the accompanying drawings.

(First embodiment)
In this embodiment, a password management and authentication method is provided, in which case the authentication device selected by the user is set as the electronic key of the trusted platform module (TPM), and the user sets the authentication device. By using it, the data folder encrypted by the TPM or the hard disk (HD) can be directly opened. In this case, the user does not need to store the TPM password. Instead, the user simply connects the authentication device to an electronic device (eg, a notebook computer, desktop computer, or mobile phone), which causes the electronic device to automatically verify that the connected authentication device is correct. And the data folder or HD encrypted by the TPM is opened so that the user can use it. This makes the password management and authentication method of the present invention very convenient for the user. In other words, the password management and authentication method realized by the present invention replaces the prior art in which the password needs to be manually input, and the password management and authentication method of the present invention is performed automatically by the system. In addition to authenticating the authentication code, the TPM password is automatically input so that the encrypted data can be decrypted. In the present invention, the authentication device that can function as an electronic key can be a universal serial bus (USB) flash drive, a Bluetooth device, a portable HD, or a mobile phone having a storage function. However, the type of authentication device is not limited in this embodiment.

  FIG. 1 is a flowchart of a password management and authentication method according to a first embodiment of the present invention. Referring to FIG. 1, first, an authentication device connected to an electronic device is detected (step S110). In this case, the authentication device can be connected to the electronic device by wired or wireless connection, but the present embodiment is not limited to this. In step S110, the user can be further asked whether to set the authentication device as an electronic key. Next, the hardware identification code of the authentication device is read (step S120). In this step S120, a list of authentication devices that can function as an electronic key is further provided for the user to select, and the user is requested to set a user password such as a TPM password. Next, an authentication code is generated according to the hardware identification code and the user password (step S130). Thereafter, the authentication code is automatically stored in the authentication device or the electronic device, and the authentication device becomes an electronic key (step S140). In this step S140, the authentication code can be encrypted before it is stored in the authentication device. Any encryption algorithm may be employed for this encryption. When the authentication device is connected to the electronic device, the authentication device or the authentication code in the electronic device is automatically authenticated. If the authentication code is correct, the data folder or HD encrypted by the electronic device is automatically decrypted for use by the user (step S150). The electronic device can use the TPM to encrypt / decrypt the data folder or HD. However, the algorithm or device used to encrypt / decrypt the data folder or HD is not limited to that in this embodiment.

  Further, during the authentication code authentication process, it is determined whether the authentication code matches the hardware identification code of the authentication device, and if the authentication code does not match the hardware identification code of the authentication device, the data folder or HD is not decrypted. According to such an authentication process, even if the authentication code is stolen and stored in another authentication device, the encrypted data cannot be accessed. Even if the authentication code is stolen, the encrypted file cannot be opened as long as a different authentication device is used. Therefore, the encrypted file is more protected than before. It should be noted that the hardware identification code can be an electronic product exclusive code such as a product serial number or a medium access control (MAC) address. However, the hardware identification code is not limited to that of the present embodiment.

  As described above, in the present invention, the electronic key is set using the authentication device and the user password selected by the user, so that the user does not need to memorize the password and is an easy and convenient method. Allows the use of TPM encryption techniques. Further, the password management and authentication method realized by the present embodiment can be applied to a general encryption system in which a user can conveniently set a personal electronic key using a flash drive or a Bluetooth device. Furthermore, it should be noted that the storage of the authentication code is not limited to the case of the present embodiment, and the authentication code may be stored in the authentication device, the electronic device, or these depending on the user's selection. Can be stored in both.

  The present invention also provides a computer readable medium. This computer readable medium is suitable for storing a computer program including a plurality of program instructions for executing the password management and authentication method illustrated in FIG. The computer program is composed of a plurality of program instructions (for example, an organization chart establishment program instruction, a table approval program instruction, a setting program instruction, and a deployment program instruction). These program instructions can be loaded into the electronic device and executed in a manner similar to achieving the electronic key setting and password authentication functions described above.

(Second embodiment)
In the above-described step S150 illustrated in FIG. 1, it is determined whether the authentication device is the correct electronic key. When the technique of the present invention is applied to an electronic device having a TPM, the implementation of step S150 described above will be described in detail. FIG. 2 is a flowchart of a password authentication method according to the second embodiment of the present invention. Referring to FIG. 2, first, it is detected whether the TPM is activated. If the TPM is not activated, the process is terminated and password authentication is not executed. If the TPM is activated, it is further determined whether the authentication device is connected to the electronic device (step S220). If the authentication device is connected to the electronic device, it automatically authenticates the authentication device or the authentication code in the electronic device, further determining if the TPM password (ie user password) and hardware identification code are correct (Step S230). Next, it is detected whether the system is before being restored from the suspended state (ie, S3) to the normal state. If it is before the system is restored from the suspended state to the normal state, Steps S210 to S230 are repeated to avoid misjudgment of the system (Step S240). When the system is in a normal state, the data folder or HD encrypted by the TPM is automatically decrypted so that the user can use it (step S250).

  It should be noted that step S240 described above is performed before the system is recovered from the suspended state and is performed to prevent misjudgment that may occur if not yet stabilized. However, the execution of step S240 is not limited to the case of the present embodiment, and can be determined according to actual design conditions without affecting the function of the present embodiment.

  The present invention further provides a computer readable medium based on the description of FIG. 2, which includes a plurality of program instructions for executing the password authentication method illustrated in FIG. Suitable for memorizing computer programs. This computer program is composed of a plurality of program instructions (for example, organization chart establishment program instructions, table approval program instructions, setting program instructions, deployment program instructions, etc.). These program instructions can be loaded into the electronic device and executed in a manner similar to achieving the electronic key setting and password authentication functions described above.

(Third embodiment)
In the above-described process for setting the electronic key, the user can set the electronic key via the visualized user interface. However, the setting of this interface is not limited to that of the present embodiment. Absent. Next, a method for setting an electronic key realized by the present invention will be described with reference to FIG. FIG. 3 is a flowchart showing an electronic key setting method according to the third embodiment of the present invention. First, all connected authentication devices are detected (step S310), and all authentication devices that can function as electronic keys are provided to the user for selection (step S320). Next, an authentication code is generated according to the hardware identification code and TPM password of the authentication device selected by the user (step S330). Thereafter, this authentication code is encrypted and stored in the authentication device or electronic device selected by the user (step S340). An authentication device with an authentication code can function as an electronic key for the TPM, and the TPM can be used for decryption by simply connecting the authentication device to the electronic device. Thus, this embodiment replaces the conventional method in which the user must manually input the TPM password, and is very convenient for the user. Regarding the authentication code and other details of the present embodiment, the description of the above-described embodiment can be referred to, and the description is omitted here.

(Fourth embodiment)
FIG. 4 is a diagram showing a hardware device according to the fourth embodiment of the present invention. Referring to FIG. 4, the notebook computer 410 has a TPM. When the USB flash drive 420 is inserted into the USB slot of the notebook computer 410, the notebook computer 410 automatically detects whether the correct authentication code is present in the USB flash drive 420. If the correct authentication code is present, the file encrypted by the TPM is automatically opened for use by the user. If the correct authentication code does not exist in the USB flash drive 420, the user can set an electronic key via the user interface as described in the third embodiment. This electronic key setting process is omitted here.

  Furthermore, it should be noted that although the above-described embodiment has been described by taking the TPM as an example, the application apparatus of the present invention is not limited to a system having a TPM. That is, the technology implemented by the present invention replaces the traditional method of manually entering a password by using a flash drive or a Bluetooth device, and other data that is very convenient for the user. It can also be applied to encryption technology. Those skilled in the art can understand other application apparatuses of the present invention from the description of the above-described embodiments, and the description of these other application apparatuses will be omitted.

  As described above, the present invention uses a flash drive or a Bluetooth device as an electronic key, allowing the user to successfully open a file encrypted by the TPM. On the other hand, according to the present invention, the user can set the personal electronic key, and the authentication code of the electronic key is generated according to the hardware identification code and the user password. Make data more secure than before.

  It will be apparent to those skilled in the art that various modifications and variations can be made in the structure of the present invention without departing from the scope or spirit of the invention. As is apparent from the foregoing, the present invention can be modified and changed within the scope of the claims and the equivalents thereof.

Claims (22)

A password management and authentication method suitable for an electronic device having a trusted platform module (TPM), the password management and authentication method comprising:
Detecting an authentication device connected to the electronic device;
Reading a hardware identification code of the authentication device;
Generating an authentication code according to the hardware identification code and a user password;
Storing the authentication code in the authentication device or the electronic device so that the authentication device is an electronic key;
When the authentication device is connected to the electronic device, the authentication code is automatically authenticated, and if the authentication code is correct, the data folder or hard disk (HD) encrypted by the electronic device is automatically A password management and authentication method comprising: an authentication step for decrypting the data folder or the HD to be used by a user.   The password management and authentication method according to claim 1, wherein the authentication device is a universal serial bus (USB) flash drive, a Bluetooth device, or a portable HD.   2. The password management and authentication method according to claim 1, wherein the hardware identification code is a product serial number or a medium access control (MAC) address. The password management and authentication method according to claim 1, wherein after the step of detecting an authentication device connected to the electronic device, the password management and authentication method further includes:
A password management and authentication method including a step of asking a user whether to set the authentication device as the electronic key.   The password management and authentication method according to claim 1, wherein the step of generating an authentication code in accordance with the hardware identification code and a user password further comprises the step of prompting the user to input the user password and Authentication method.   2. The password management and authentication method according to claim 1, wherein the authentication step further includes a step of determining whether the hardware identification code of the authentication device matches the authentication code. The password management and authentication method according to claim 1, wherein the password management and authentication method further includes:
A password management and authentication method including a step of closing the data folder or the hard disk encrypted by the electronic device when the authentication device is disconnected from the electronic device.   The password management and authentication method according to claim 1, wherein the electronic device includes a notebook computer, a desktop computer, or a mobile phone. The password management and authentication method according to claim 1, wherein the authentication step further comprises:
A password management and authentication method including a step of re-authenticating the authentication code when the electronic device returns from a suspended state to a normal state.   The password management and authentication method according to claim 1, wherein the authentication step further detects whether the trusted platform module is operating, and if the trusted platform module is not operating, Password management and authentication method including the step of ignoring the authentication code.   The password management and authentication method according to claim 1, wherein the step of generating an authentication code according to the hardware identification code and a user password further includes a step of encrypting the authentication code.   2. The password management and authentication method according to claim 1, wherein the electronic device uses the trusted platform module to encrypt or decrypt the data folder or the hard disk.   The password management and authentication method according to claim 1, wherein the user password is a trusted platform module password. A password authentication method suitable for an electronic device having a trusted platform module, the password authentication method comprising:
Detecting whether the trusted platform module is operating;
Detecting whether an authentication device is connected to the electronic device if the trusted platform module is operating;
Automatically authenticating an authentication code in the authentication device or the electronic device;
Automatically authenticating the data folder or hard disk encrypted by the trusted platform module to allow the data folder or hard disk to be used by a user if the authentication code is correct .   15. The password authentication method according to claim 14, wherein the authentication device is a universal serial bus flash drive, a Bluetooth device, or a portable hard disk.   15. The password authentication method of claim 14, wherein the step of automatically authenticating an authentication code further determines whether the authentication code matches a hardware identification code and a trusted platform module password of the authentication device. Password authentication method including steps.   The password authentication method according to claim 16, wherein the hardware identification code is a product serial number or a medium access control address. 15. The password authentication method according to claim 14, wherein the password authentication method further includes:
A password authentication method comprising the step of closing the data folder or the hard disk encrypted by the electronic device when the authentication device is disconnected from the electronic device.   15. The password authentication method according to claim 14, wherein the electronic device includes a notebook computer, a desktop computer, or a mobile phone. 15. The password authentication method according to claim 14, wherein the password authentication method further includes:
A password authentication method comprising a step of re-authenticating the authentication code when the electronic device recovers from a suspended state to a normal state. A computer readable medium storing a plurality of program instructions, wherein the program instructions are
These are loaded into the electronic device and this electronic device
Detecting an authentication device connected to the electronic device;
Reading a hardware identification code of the authentication device;
Generating an authentication code according to the hardware identification code and a user password;
Storing the authentication code in the authentication device or the electronic device so that the authentication device is an electronic key;
When the authentication device is connected to the electronic device, the authentication code is automatically authenticated, and if the authentication code is correct, the data folder or the hard disk encrypted by the electronic device is automatically decrypted. A computer readable medium having program instructions suitable for enabling the data folder or the hard disk to be used by a user. A computer readable medium storing a plurality of program instructions, wherein the program instructions are
These are loaded into the electronic device and this electronic device
Detecting whether the trusted platform module is operating;
Detecting whether an authentication device is connected to the electronic device when the trusted platform module is operating;
Automatically authenticating an authentication code in the authentication device or the electronic device;
If the authentication code is correct, the data folder or hard disk encrypted by the trusted platform module may be automatically decrypted so that the data folder or the HD can be used by a user. A computer-readable medium having program instructions for use.

Images