KR100407692B1 - Hard Disk Real Time Security System and Preservation Method of Hard Disk Real Time Security System - Google Patents

Abstract

The present invention relates to a hard disk real-time security system and a security method using the encryption technology, and after specifying a specific directory of the hard disk as the encryption directory, when the data write event to the encryption directory occurs using the encryption board Encrypted data is stored in the cipher directory, and when a read event occurs for the encrypted data, the encrypted data is decrypted using an encryption board.

Because of this, the encrypted data is very safe from hacking such as physical attacks on the system, attacks using defects of the operating system, attacks using hacking software, password theft, and the like.

Description

Hard Disk Real Time Security System and Preservation Method of Hard Disk Real Time Security System

The present invention relates to a hard disk real-time security system and a security method using the encryption technology, in more detail, by encrypting the data stored in the hard disk in real time, hard to protect important data from illegal access Disc real-time security system and security method.

Conventional technology related to such a hard disk real-time security system, the rights holder is Samsung Electronics [Patent Name: Computer system and method with a security function of the data stored in the storage device, Application No .: 1998-052997, Application Year: 1998]. It uses EEPROM and hard disk file allocation table (FAT) copying mechanism to provide high security against physical pruning of the hard disk. However, hacking through the network, hacking through the console has the disadvantage that it is completely defenseless.

In addition, in the existing security system, when the user logs in to the system, the user can perform the authentication process, and if the user passes the authentication process, the system can be used. Otherwise, the user is regarded as an illegal user. To make the data in the hard disk inaccessible. However, such an authentication-based hard disk security system uses hacking software to destroy the authentication process of the system, or if the password is stolen, illegally taking data in the hard disk over the network, and physically taking the hard disk. In this case, it is difficult to maintain data security in the hard disk.

In order to solve this problem, recently, a method of encrypting data in a hard disk with a software using a symmetric key encryption algorithm has been used. Since the encryption or decryption is performed by software, it imposes a heavy encryption operation burden on the main processor. do. That is, not only is it impossible to process encryption and decryption of data in the hard disk in real time, but also a low level of security is required because a short key value is inevitably used to process a fast operation.

An object of the present invention for solving the above problems of the prior art is to set the encryption directory in which files to be encrypted are stored, without having to artificially perform encryption and decryption on individual files, and to store the encrypted directory. The present invention provides a hard disk real-time security system and a security method for automatically encrypting and storing files and decrypting the encrypted files.

1 is an overall configuration diagram of a hard disk real-time security system according to an embodiment of the present invention,

2 is a block diagram of an encryption board used in the hard disk real-time security system shown in FIG.

3 is a flowchart illustrating an operation process of a hard disk real-time security system according to an embodiment of the present invention.

※ Explanation of code about main part of drawing ※

110: hard disk management unit

120: hard disk event detection unit

130: PCI operating unit for hard disk encryption board

140: hard disk 150: encryption board

160: memory 170: smart card

220: PCI bus interface

The present invention for achieving the above object is a hard disk real-time security system for encrypting / decrypting data stored in the hard disk in real time, a hard disk for setting a specific directory of the hard disk as a password directory by a user command A management unit; A hard disk event detection unit generating an encryption request signal when a file write event to the encryption directory is generated, and a decryption request signal when a read event is generated for the encrypted file stored in the encryption directory; An encryption board that receives and encrypts the file where the write event occurred when the encryption request signal is generated, and receives and decrypts the encrypted file where the read event occurs when the decryption request signal is generated; And a hard disk encryption board for transmitting the encryption request signal and the decryption request signal to the encryption board, and transmitting the file having the write event and the encrypted file having the read event to the encryption board. It provides a hard disk real-time security system comprising an operating unit.

In addition, a hard disk real-time security method for encrypting / decrypting data stored in the hard disk in real time, comprising: a first step of setting a specific directory of the hard disk as an encryption directory by a user command; A second step of encrypting a file in which the write event occurs and storing the encrypted file in the cipher directory when a file write event is generated in the cipher directory; And a third step of decrypting the encrypted file having the read event generated when a read event occurs with respect to the encrypted file stored in the encrypted directory.

In addition, a first step of setting a specific directory of a hard disk as an encryption directory on a computer by a user's command; A second step of encrypting a file in which the write event occurs and storing the encrypted file in the cipher directory when a file write event is generated in the cipher directory; And when a read event occurs for the encrypted file stored in the cipher directory, providing a computer-readable recording medium having recorded thereon a program for executing a third step of decrypting the encrypted file in which the read event has occurred.

Hereinafter, a hard disk real-time security system and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. 1 is an overall configuration diagram of a hard disk real-time security system according to an embodiment of the present invention.

Hard disk real-time security system, the central processing unit 100, the hard disk management unit 110, the hard disk event detection unit 120, the PCI operating unit 130 for hard disk encryption board, hard disk 140, encryption board ( 150) and a smart card 170.

The hard disk manager 110 designates and releases a specific directory of the hard disk 140 as an encryption area (password directory) by a user's command. At this time, the encryption target directory is specified and released using a hard disk encryption system management software having a special graphical user interface (GUI) environment designated by the user. Through this process, all information about the data that has been designated and decrypted is stored in the window register.

The hard disk event detection unit 120 generates an encryption request signal when a file write event is generated in the encryption directory set as the encryption area, and transmits a file to be written in the encryption directory to the central processing unit 100 by the encryption board 150. Request to send to. That is, when a file write event occurs in any one of the directories set in the hard disk, the hard disk event detecting unit 120 checks a window register to confirm whether the directory is an encryption directory or not, and then the file. Request encryption In addition, the hard disk event detection unit 12 generates a decryption request signal when a read event occurs for the encrypted files stored in the cipher directory, and transmits the encrypted file to the central processing unit 100 by encrypting the encrypted board ( 150) to send.

In addition, in transmitting the data to the encryption board 150, in order to prevent a drop in the transmission speed, the DMA (Direct Memory Access) transmission with the encryption board 150 is performed for the data to be encrypted over a predetermined length. I solve it by making it possible.

The PCI operating unit 130 for the hard disk encryption board enables the hard disk real-time security system to recognize the encryption board 150 by using information in the PCI configuration register that the PCI bus interface in the encryption board 150 has. The encryption request signal and the decryption request signal of the hard disk event detector are transmitted to the encryption board, and the file in which the write event occurs and the file in which the read event occurs are transmitted to the encryption board.

The encryption board 150 performs encryption and decryption using the encryption processor 160. When the hard disk event detection unit 120 generates an encryption request signal, the encryption board 150 receives the file in which the write event occurs and performs encryption. When the disk event detector 120 generates a decryption request signal, the disk event detector 120 receives an encrypted file having a read event and decrypts the file.

Smart card 170 is an interface using the same interface as the UART (Universal Asynchronous Receiver and Transmitter), is directly connected to the encryption board 150 to encrypt the user key value stored in the smart card 170 in advance or It can be used as a decryption key value. In addition, the smart card 170 may rewrite or update the personal encryption key value.

At this time, when the smart card 170 is abnormally separated from the hard disk real-time security system, the temporary file of the currently working system is not only automatically deleted for security purposes, but also an interrupt is generated in the encryption board 150. In other words, it may be recognized as an illegal user.

In addition, the encryption key value that can be used in the hard disk real-time security system according to an embodiment of the present invention may use a CMOS boot password, a smart card key value, a key value directly input, by combining these key values Can also be used.

A directory (folder) designated as an encryption area as described above is displayed with the symbol mark of an encryption area and the user ID that is the owner of the directory. In addition, you can add a simple comment, which is often used as a hint as to which encryption key value was used in the various encryption key values used by the user.

On the other hand, in order for the hard disk real-time security system according to the present invention to detect the hard disk operation, the entire hard disk may be designated as an encryption area by modifying the hard disk interrupt routine of the PC BIOS. To do this, however, the BIOS code for the hard disk must be modified. For this reason, it becomes difficult to set an encryption area on a directory basis.

Before looking at the operation process of the hard disk real time security system including such a feature, the encryption board 150 used in the hard disk real time security system shown in FIG. 1 will be described. FIG. 2 is a detailed block diagram showing an encryption board used in the hard disk real-time security system shown in FIG.

The encryption board 200 includes a PCI bus interface 220, an encryption processor 240, a smart card 260, and high speed input / output buffers 230 and 250.

The PCI bus interface 220 uses a PCI configuration register in the PCI bus interface 220 to communicate with the encryption board and to transmit and receive data to be encrypted and decrypted. At this time, the PCI setting register provides the PCI bus interface 220 with information about the Device ID, status register, command register, header information of the transport packet, timer, address, and the like.

The encryption processor 240 encrypts or decrypts encryption and decryption target data received from the input buffer 230 by performing symmetric key algorithms such as SEED, Triple-DES, and Rijndael at high speed.

Looking at the operation of the encryption board 200 configured as described above are as follows. The data to be encrypted and decrypted through the PCI input / output bus 210 is transferred to the input buffer 230 through the PCI bus interface 220 and temporarily stored, and then moved to the encryption processor 240 to be encrypted or decrypted. Data encrypted or decrypted by the encryption processor 240 is transmitted to the output buffer 250 and temporarily stored, and then transmitted to the hard disk through the PCI bus interface 220 is stored.

At this time, the encryption key value used for encryption or decryption may directly receive the key value from the outside, or store the personal encryption key value safely and store and update various key values so that the user can easily change the key value. Use smart card terminals.

The operation process of the hard disk real-time security system including the above features is as follows. 3 is a flowchart illustrating an operation process of a hard disk real-time security system according to an embodiment of the present invention.

A directory to store the encryption target file is designated as an encryption directory (encryption area). (S310) When a file write event to the encryption directory occurs, the file is transmitted to the encryption board (S320, S330). The encryption target file is received and encrypted in real time using an encryption key (S340). After performing encryption, the encryption board transmits the encrypted file to the hard disk. (S350) Meanwhile, the encryption directory is stored in the encryption directory as described above. When a read event occurs for the stored encrypted file, the encrypted file is transmitted to the encryption board (S360). The encryption board receives the encrypted file and decrypts it using a decryption key (S370). Thereafter, the encryption board transmits the decrypted file to the hard disk (S380).

While the invention has been described above based on the preferred embodiments thereof, these embodiments are intended to illustrate rather than limit the invention. It will be apparent to those skilled in the art that various changes, modifications, or adjustments to the above embodiments can be made without departing from the spirit of the invention. Therefore, the scope of protection of the present invention should not be limited only by the appended claims, but should be construed as including all such changes, modifications or adjustments.

As described above, according to the present invention, it is possible not only to perform encryption or decryption on real-time data, but also to use hacking software, without affecting the main task of the user due to the use of the encryption board. In case of destroying the authentication process of the system, it is effective to protect the user's data from taking the hard disk physically.

Claims (8)

In the hard disk real-time security system for encrypting / decrypting data stored in the hard disk in real time, A hard disk management unit that sets a specific directory of the hard disk as an encryption directory by a user command; A hard disk event detection unit generating an encryption request signal when a file write event to the encryption directory is generated, and a decryption request signal when a read event is generated for the encrypted file stored in the encryption directory; An encryption board that receives and encrypts the file where the write event occurred when the encryption request signal is generated, and receives and decrypts the encrypted file where the read event occurs when the decryption request signal is generated; And The PCI operating unit for hard disk encryption board for transmitting the encryption request signal and the decryption request signal of the hard disk event detection unit to the encryption board, and transmits the file the write event and the encrypted file the read event occurs to the encryption board. Hard disk real-time security system comprising a. The method of claim 1, wherein the encryption board, Receives an encryption request signal, a decryption request signal, a file having a write event and an encrypted file having a read event through the PCI operating unit for the hard disk encryption board, and encrypts the encrypted file and the decrypted file with the PCI for the hard disk encryption board. PIC bus interface to the operating unit, Receiving the file generated by the write event is encrypted using an encryption key and transmitted to the PCI bus interface, and receives the file generated the read event is decrypted using a decryption key and transmitted to the PCI bus interface Hard disk real-time security system characterized in that it comprises a / decoding processor. The method of claim 2, wherein the encryption board, A smart card for storing and managing an encryption key for encrypting the file and a decryption key for decrypting the file; And a smart card interface for providing an encryption key and a decryption key stored in the smart card to the encryption / decryption processor through the PCI bus interface. The method of claim 3, wherein The encryption / decryption processor includes a CMOS boot encryption key / decryption key, an encryption key / decryption key stored in the smart card, an encryption key / decryption key directly input by a user, or a combination of two or more of the keys. Hard disk real-time security system, characterized in that for performing encryption and decryption using a key. In the hard disk real-time security method for encrypting / decrypting data stored in the hard disk in real time, A first step of setting a specific directory of the hard disk as an encryption directory by a user command; A second step of encrypting a file in which the write event occurs and storing the encrypted file in the cipher directory when a file write event is generated in the cipher directory; And And a third step of decrypting the encrypted file in which the read event occurs when a read event occurs for the encrypted file stored in the cipher directory. The method of claim 5, wherein the encryption key for encrypting the file is stored in a separate storage medium or received directly from a user. The second step may include encrypting a file in which the write event occurs by using a CMOS boot encryption key, an encryption key stored in the storage medium, an encryption key directly input by a user, or a combination of two or more of the keys. Hard disk real-time security method, characterized in that. The method of claim 5, wherein the decryption key for decrypting the file is stored in a separate storage medium or received directly from a user. In the third step, the encrypted file is decrypted by using a CMOS boot decryption key, a decryption key stored in the storage medium, a decryption key input by a user, or a combination of two or more combinations of the keys. Hard disk real-time security method. On your computer, A first step of setting a specific directory of a hard disk as an encryption directory by a user's command; A second step of encrypting a file in which the write event occurs and storing the encrypted file in the cipher directory when a file write event is generated in the cipher directory; And And when a read event occurs for the encrypted file stored in the cipher directory, a computer-readable recording medium having recorded thereon a program for executing a third step of decrypting the encrypted file in which the read event has occurred.