KR100915615B1 - Encryption and decryption module for hardisk having partitioning function with user card - Google Patents

Abstract

An encryption and decryption module for a hard disk having partitioning function is provided to maintain security by performing an encryption when saving data in a hard disk. If a serial number stored in a card(14) coincides with a serial number stored in a memory(32), a microcontroller(33) allows operating. An initial address and partition size of a configuration data delivered from the microcontroller are used to divide the hard disk(40) by a hard disk encryption/decryption module(30). An application specific integrated circuit(ASIC)(34) of the hard disk encryption/decryption module ciphers data lighted from the main board(20) to the hard disk to the key value of configuration data. The application specific integrated circuit decodes data read from the divided hard disk as described above to the key value of configuration data.

Description

Hard disk encryption / decryption module with user-specific hard disk partitioning function {ENCRYPTION AND DECRYPTION MODULE FOR HARDISK HAVING PARTITIONING FUNCTION WITH USER CARD}

The present invention relates to a hard disk encryption / decryption module for encrypting and decrypting data to be stored in a hard disk. More specifically, the user can physically partition a hard disk for each user so that a single computer can be used independently by several people. The present invention relates to a hard disk encryption / decryption module having a hard disk partitioning function.

In general, a hard disk is a large-capacity recording module for storing data, and is composed of a platter and a head of a hard disk, a spindle motor, a head arm, a circuit board, and the like. The platters are written on a metal disk with a magnetized body, and the platters are stacked several times and fixed to the spindle axis, and the spindle motor is configured to rotate the spindle axis at high speed. The head that reads and writes data to the platter is connected to the head arm, which is driven by a voice coil motor (VCM).

The physical hard disk creates a master boot record (MBR), partition table (PT), file allocation table (FAT), etc. according to the file system through the format process. Rom BIOS). Rom BIOS's built-in program includes a boot routine that reads the first sector of the first hard drive, called the master boot record (MBR). The MBR section stores the hard drive partition information, which is called the Master Boot Program and the Partition Table. The boot routine runs the Master Boot Program. It finds the active primary partition of your hard drive and starts the boot process for you to see.

In order to separate a user's environment while using a single computer, the Windows system supports multi-user login. However, the multi-user function supported by the operating system has a problem that it is difficult to keep a secret because the hard disk is shared.

The present invention has been proposed to solve the above problems, and an object of the present invention is to have a hard disk partition function for each user to physically partition the hard disk for each user so that several people can use a single computer independently. It is to provide a hard disk encryption and decryption module.

In order to achieve the above object, the encryption / decryption module of the present invention includes a card slot for connecting with a card lead / writer; A memory in which the serial number is stored; It takes the setting data (serial number, key value, start address, division size) of the card inserted from the card lead / writer connected through the card slot and stores it in the internal memory, and the serial number stored in the card and the serial number stored in the memory. Comparing the microcontrollers to allow operation if they match and stop the operation if they do not match; And dividing the hard disk into a start address and a split size of the setting data received from the microcontroller, encrypting data written from the main board to the hard disk using key values of the setting data, and storing the split data in the divided hard disk. And a hardware configuration including an application specific integrated circuit (ASIC) for decoding the data read from the hard disk into key values of the setting data and transmitting the same to the main board.

The hard disk encryption module according to the present invention performs encryption while storing data on the hard disk, so that security can be maintained even when the hard disk is lost, and even if several people share the same computer, the user can use the hard disk. Can be used physically and completely, keeping secrets and security between users.

1 is a schematic diagram showing a desktop computer to which a hard disk encryption / decryption module according to the present invention is applied;

2 is a flowchart illustrating a procedure for setting a card for dividing a hard disk according to the present invention;

3 is a conceptual diagram illustrating a hard disk partitioning concept according to the present invention;

4 is a block diagram illustrating a hard disk encryption / decryption module having a user-specific hard disk partitioning function according to the present invention;

5 is a detailed functional block diagram of an ASIC equipped with a hard disk partitioning and decryption engine shown in FIG. 4;

6 is a flowchart illustrating an operation procedure of a hard disk encryption / decryption module having a user-specific hard disk partitioning function according to the present invention.

* Explanation of symbols for main parts of the drawings

10: Computer 11: Card Interface Section

12: Cable 13: Installation CD-ROM

14: card 20: motherboard

30: encryption / decryption module 31: card slot

32: memory 33: microcontroller

34: ASIC 35: USB port of encryption / decryption module

40: hard disk

The technical problems achieved by the present invention and the practice of the present invention will be more clearly understood by the preferred embodiments of the present invention described below. The following examples are merely illustrated to illustrate the present invention and are not intended to limit the scope of the present invention.

1 is a diagram schematically illustrating a desktop computer to which a hard disk encryption / decryption module according to the present invention is applied, and FIG. 2 is a flowchart illustrating a procedure for setting a card for dividing a hard disk according to the present invention.

As shown in FIG. 1, the desktop computer 10 to which the present invention is applied has a main board (20 of FIG. 4), a hard disk encryption / decryption module 30, and a hard disk 40 mounted therein. In front of the case, a USB port 35, a card interface unit 11 for reading and writing the card 14, and a CD-ROM drive capable of reading the CD-ROM 13 are located. When the computer is purchased, a CD-ROM 13 having an installation program for card setting and a USB communication cable 12 for connecting the encryption / decryption module to the USB port of the PC for card setting are provided.

Referring to FIG. 1, the hard disk encryption / decryption module having a hard disk partitioning function for each user according to the present invention can operate only by inserting the card 14, so the card setting procedure for setting the hard disk partitioning for each user is prioritized. Should be. Therefore, a computer purchaser to which the present invention is applied is connected to the encryption / decryption module through a USB communication cable 12 through a USB port, and the installation CD-ROM 13 is inserted into a CD-ROM drive and executed as shown in FIG. 2. Set the card through. In the embodiment of the present invention, for the convenience of description, four cards (smart cards) divided by A to D will be described as an example.

2, in order to set the card according to the present invention, the card setting CD-ROM 13 is inserted and the cable 12 is connected to the USB port 35 of the encryption module 30 and the USB port of the PC. After the power is turned on, the boot operation is executed through the CD-ROM, and the keyboard and the monitor can be used (S201 to S204). Subsequently, it communicates with the encryption / decryption module to obtain the total capacity of the hard disk and the serial number of the encryption / decryption module (S205).

Then, you will be prompted to insert a card through the message "Hard disk size is 400 MB. Please insert a card." When the A card is inserted, the message "Please enter the size of the hard disk to use as A card" is displayed. After that, the card holder receives the card division size to be used by the holder of the A card (S206 to S207).

When the user inputs "100 MB" with the keyboard, the setting data is written to the A card (S208). The setting data written to each card at this time is a serial number SN of the disk encryption / decryption module, a key value to be used for encryption and decryption, a starting cylinder index, a number of cylinders to be used (division size), and the like. The key value is a randomly generated 256-bit value that is written uniquely for each card.

When writing to the A card is completed, the remaining message of the hard disk is notified with the message "The remaining hard disk size is 300 MB." (S209), and the message "Please insert card B" is displayed again. If you insert the B card, you will be prompted again, "Please enter the hard disk size to use as B card."

Then, after setting data is written to the B card, the remaining capacity of the hard disk is guided, and the above steps are repeated to set the A to D cards.

When the card setting is completed, remove the setting cable 12 and the CD-ROM 13 and turn off the power. Afterwards, the cards A, B, C, and D are divided into 4 people, A You can put any one card, B, C, or D. In this case, install it after using O / S.

3 is a conceptual diagram illustrating a hard disk partitioning concept according to the present invention. In the embodiment of the present invention, for convenience of understanding, the total capacity of the hard disk is 400MB, and the 400MB is divided into four units of 100MB each, and four users use the above-described A to D cards.

Referring to FIG. 3, a hard disk encryption / decryption module 30 having a user-specific hard disk partitioning function is connected between a main board 20 and a hard disk 40 of a computer.

Four card 14A to 14D are stored in the card setting procedure as shown in Table 1 below.

division Card A Card B Card C Card D Setting data S.N = 12345KEY [256bit] = .. 1Start = 000MBSize = 100MB S.N = 12345KEY [256bit] = .. 2Start = 100MBSize = 100MB S.N = 12345KEY [256bit] = .. 3Start = 200MBSize = 100MB S.N = 12345KEY [256bit] = .. 4Start = 300MBSize = 100MB

In Table 1, S.N stored in each card is the same as the serial number of the encryption / decryption module, and Key is a unique value randomly generated as a key value for encryption / decryption. Start represents the starting position, and Size is the partition size of the hard disk that can be used by partitioning the card.

The encryption / decryption module according to the present invention divides a 400MB hard disk by 100MB according to an inserted card when the power is turned on so that four users can use the 100MB hard disk. For example, when the card A 14A is inserted, the user A can use up to 0 to 99 MB, and when the card B 14B is inserted, the user can use up to 100 to 199 MB, and when the card C 14C is inserted, the 200 to 299 MB is used. Enable to use. Therefore, each user can use only the hard disk area allowed according to the cards 14A to 14D, and other hard disk areas are inaccessible, so each user can use the device independently.

For example, if you have about 400 MB hard disks (cylinder = 800, head = 16, sector = 61), four smart cards, and divide the hard disk into quadrants, the 000 to 099 Mega Byte area of the 400 Mega Byte hard disk is HDD-A is allocated, 100 ~ 199 Mega Byte area of 400 Mega Byte hard disk is allocated to HDD-B, 200 ~ 299 Mega Byte area of 400 Mega Byte hard disk is allocated to HDD-C, 400 Mega Byte 300 ~ 399 Mega Byte area of hard disk is allocated to HDD-D.

In addition, the encryption / decryption module 30 of the present invention stores a serial number (S.N), which is for authentication. So four cards should store the module's S.N values. However, four encryption key values should be specified differently. Each card must contain a start position and a partitioned hard disk size to partition the hard disk. So partitions must be specified so that they do not overlap.

On the other hand, the operation of the hard disk 40 is largely composed of an initialization process and a data access process and these are made of various commands. The hard disk 40 goes through an initialization process before being used. The initialization process is reset in hardware and consists of commands such as Identify and init_parameter. During the initialization process, the Identify process acquires all the information (cylinder number, head number, sector number, etc.) of the hard disk. After the initialization process, the data access process, that is, read data at random locations, The process of writing continues. Typical commands include "read sectors" when reading a hard disk and "write sectors" when writing to a hard disk.

Therefore, the present invention requires an operation for converting the size of the hard disk to match the configuration data of the card in the "Identify" process, and converting the access position to the range specified by the configuration data of the card in the data access process. Do.

4 is a block diagram showing the configuration of a hard disk encryption / decryption module having a user-specific hard disk partitioning function according to the present invention, and FIG. 5 is an on-demand integration in which the hard disk partitioning and encryption / decryption engine shown in FIG. 4 is mounted. Detailed functional block diagram of an application specific integrated circuit (ASIC).

Hard disk encryption and decryption module 30 according to the present invention, as shown in Figure 4, the smart card slot 31 for connecting to the smart card 14, the memory 32, the serial number is stored, the overall operation Dividing the hard disk 40 into the setting data received from the micro-controller 33, the micro-controller 33 for controlling and encrypts the data written to the hard disk from the main board 20 and stored in the hard disk 40 And an on-demand integrated circuit (ASIC) 34 that decrypts the data read from the hard disk 40 and transfers the data to the main board 20.

Referring to FIG. 4, the memory 32 is a kind of EEPROM that no one reads a value without knowing the protocol in a security embedded system, and the microcontroller 33 is a card read / connected through the card slot 31. Takes the setting data (serial number, key value, start address, division size) of the card 14 inserted from the writer and stores them in the internal memory, and compares the serial numbers stored in the card 14 with the serial numbers stored in the memory 32. If it matches, the operation is allowed and if it does not match, the operation is stopped.

The ASIC 34 transfers the start address register 55 storing the start address of the setting data received from the microcontroller 33 and the microcontroller 33 as shown in FIG. 5. The partition size register 56 which stores the division size of the received setting data, the key register 57 which stores the key value of the setting data received from the microcontroller 33, and the hard disk at the motherboard 20 side. A first serial-parallel conversion unit 51a for converting serial write data transmitted to 40 into parallel data, an instruction separation unit 52 for separating an instruction from the first serial-parallel conversion unit 51a, and In the hard disk read / write command according to the control signal, the first mux 54a for separating the read / write address and the write data in the case of the write data from the first serial-parallel converter 51a and the first mux 54a. Separated Leads / The read / write address converting means 60 for converting the cylinder address by adding the start address of the start address register 55 to the cylinder address, which is the write address, and the write data separated from the first mux 54a. The encryption unit 58 for encrypting the key value stored in the < RTI ID = 0.0 >), < / RTI > and the second mux 54b for combining the converted address of the read / write address conversion means 60 and the write data encrypted by the encryption unit 58 according to the control signal. ), A first parallel-to-serial converting unit 55a for converting the parallel data of the second mux 54b into serial and transferring the serial data to the hard disk 40 side, and transferring the hard disk 40 from the hard disk 40 to the motherboard 20 side. A second serial-parallel conversion section 51b for converting the serial read data into parallel data; and a status (for example, HDD) from the second serial-parallel conversion section 51b in response to a hard disk read or status read command according to a control signal. The status returned by the Identify command is the cylinder Size, head size, sector size, ...) and the read data separated from the third mux 54d and the third mux 54d, which separate the read data, into a key value stored in the key register 57. Cylinder size converting means 61 for converting the cylinder size of the status separated by the decoder 59 and the third mux 54d into the dividing size of the dividing size register 56, and the cylinder size converting means in accordance with a control signal. A fourth mux 54c that combines the transformed size of 61 and the read data decoded by the decoder 58 and the parallel data of the fourth mux 54c are serially converted and transferred to the motherboard 20. A second parallel-to-serial conversion section 55b and a state machine 53 which receives a command from the command separation section 52 and generates a control signal according to the command.

Referring to FIG. 5, in the embodiment of the present invention, the hard disk 40 is based on the SATA method currently used universally. SATA method has two signal lines, TX and RX. Thus, the line through which the signal is moved from the motherboard 20 to the hard disk 40 is a Tx line, and the line through which the signal is moved from the hard disk 40 to the motherboard 20 is an Rx line.

The motherboard 20 issues numerous hard disk commands. Since the SATA method is serial data, the first serial-parallel converter 51a converts the data into parallel data. In parallel data, the command is separated from the command separator 52 and transmitted to the state machine 53.

The state machine 53 is a block in charge of the brain portion of the ASIC and controls each mux (mux: 54a to 54d) appropriately according to a command to determine which value to select. The first mux AUX 54a selects and outputs a parameter indicated by the state machine 53 from the preceding data. For example, the command to designate "Hard Disk Sector Address" is to separate cylinder (C), head (H) and sector (S) values separately. In particular, since "C" is a cylinder index, it must be separated and added to "cyl_start" read from the smart card 14 to be transmitted to the next block.

 The data that needs to be manipulated can be separated and passed through as "other parameters". S and H need not be manipulated and do not need to be separated, but are separated for ease of understanding. "Hard disk write data" must be separated and encrypted with the key read from the smart card 14.

All of the separated, manipulated or unmanipulated data is controlled by the state machine 53 according to the appropriate timing and is received by the second mux BUX54b to receive the first parallel-to-serial converter 55a. It is converted into high-speed serial data and transferred to the hard disk.

Data moving from the hard disk 40 to the main board 20 is first converted into parallel data in the second serial-to-parallel conversion unit 51b, and then controlled by the state machine 53 in the third mux DUX54d. Received and manipulated parameters are separated. The hard disk read data must be separated and decrypted with a key read from the smart card 14. In the case of the Identify command, the number of cylinders (cyl) is not transmitted as it is. Instead, the partition size (cyl_size) read from the smart card is sent. All the separated, manipulated or unmanipulated data is received by the state machine 53 according to the appropriate timing, and the fourth MUX C: 54c receives the second parallel-to-serial conversion unit 55b. After the high speed serial data is converted to the main board 20. The three registers 55, 56, and 57 are registers for storing the start address (cyl_start), the partition size (cyl_size), and the key, respectively, read from the smart card.

6 is a flowchart illustrating an operation procedure of a hard disk encryption / decryption module having a user-specific hard disk partitioning function according to the present invention.

First, in the embodiment of the present invention, since the hard disk 40 is divided into four cylinder units, sector address translation is required in the access process. To this end, the encryption / decryption module 30 of the present invention should store the starting cylinder value "start_cyl" instead of "Start" of Table 1 and the number "size_cyl" of the cylinder to be used instead of "Size" of Table 1 in the card 14. do. Therefore, in the case where the entire cylinder of the hard disk is "800" evenly divided into cylinder units, the above Table 1 is changed to the following Table 2.

division Card A Card B Card C Card D Setting data S.N = 12345KEY [256bit] = .. 1Start_cylinder = 000Size_cylinder = 200 S.N = 12345KEY [256bit] = .. 2Start_cylinder = 200Size_cylinder = 200 S.N = 12345KEY [256bit] = .. 3Start_cylinder = 400Size_cylinder = 200 S.N = 12345KEY [256bit] = .. 4Start_cylinder = 600Size_cylinder = 200

When divided into cylinder units as shown in Table 2, the conversion is as follows. That is, when booting with A card 14A, "Hdd_cylinder_index = main_board_cylinder_index + 000", when booting with B card 14B, "Hdd_cylinder_index = main_board_cylinder_index + 200", and booting with C card 14C. "Hdd_cylinder_index = main_board_cylinder_index + 400", and booting with the D card 14D is "Hdd_cylinder_index = main_board_cylinder_index + 600".

Referring to FIG. 6, when the card 14 is inserted and the power button is pressed, the microcontroller 33 starts operation. The card 14 reads four set values SNc, Key, Start_Cyl, and Size_Cyl (S1). The serial number SNm stored in the module is read from the memory 32. Subsequently, the ASIC chip 34 is reset, and the serial number (SNc value) read from the card is compared with the serial number (SNm value) stored in the memory. If the value is different, the ASIC chip 34 is instructed and the main board ( The cable between 20) and the hard disk 40 is equivalently disconnected and no further operation is performed (S2).

If the serial number (SNc value) read from the card 14 and the serial number (SNm value) stored in the memory are the same, three setting values (Key, Start_Cyl, Size_Cyl) are written to the registers 55 to 57 of the ASIC chip 34. The hard disk partitioning function and the encryption / decryption function are started.

On the other hand, the operation of the hard disk is largely composed of an initialization process and a data access process, which are performed by various commands. Hard disks are initialized before being used. This is reset by h / w and consists of commands such as Identify, init_parameter, and so on. During the initialization process, all the information (cylinder number, head number, sector number, etc.) of the hard disk is acquired (S3).

Since the motherboard 20 obtains most of the information of the hard disk 40 in the "Hdd Identify" command, the encryption / decryption module 30 should intercept this command and change the value according to the card for each card. In particular, the size is determined by the number of cylinders (C), the number of heads (H), and the number of sectors (S). The number of cylinders does not carry the actual number of hard disk cylinders. .

For example, suppose you have a hard disk with cylinders = 800, heads = 16, sectors = 61. If four people use A, B, C, and D cards and their hard disks are equally divided into four, A, If the motherboard 20 issues an "Identify" command when one of the B, C, or D cards is inserted, the module 30 receives "800" as the number of cylinders from the hard disk 40, but the " Delivers 200 ". In this case, the motherboard 20 determines "100MB" instead of "400MB".

When partitioning a hard disk, the area must be divided by cylinder. Because the head travels less distance, it takes less seek time, and there is a command called "init_parameter" among the hard disk commands. Even if the hard disk is divided into A, B, C, and D, the parameter value of this command is changed. Because there is no. This is because the "init_parameter" command requires only the number of heads and sectors as parameters.

After the initialization process, a data access process, that is, a process of reading or writing data at an arbitrary position continues (S4). Representative commands include read sectors (S41) when reading a hard disk, and write sectors (S42) when writing to a hard disk.

The motherboard 20 interfaces in sector units (512 bytes) to access arbitrary data on the hard disk 40. So, you can specify a sector address and read or write data as needed. For example, the read function is "Read_sectors (C, H, S, Cnt, Buf [])" and the write function is "Write_sectors (C, H, S, Cnt, Buf [])". In this case, C is a cylinder position to be accessed as a cylinder index, H is a head position to be accessed as a head index, and S is a sector position to be accessed as a sector index. Cnt denotes the number of sectors to be accessed as a sector count, Buf [] denotes a buffer to be accessed as a buffer, and data on the hard disk is input and output to buf []. For example, if the main board 20 commands "Read_sectors (1, 2, 3, 4, Buf [])", four cylinder indexes from the 1st cylinder index, 2nd head, and 3rd sector of the hard disk will be displayed. Read sector into buf []. Converted to Byte, 4 * 512 = 1024 byte.

As described above, according to the present invention, when one of the A, B, C, and D cards is inserted, the computer treats the 400 MB physical hard disk as one 100 MByte hard disk connected.

Looking at the application of the present invention, if you have four dorm roommates and use one PC and divide cards A, B, C, and D, you cannot use the PCs at the same time. Works. So you can use one with linux, one with windows-xp, one with windows-vista, and one with unix, without sacrificing each other's privacy. If one person is seriously infected with a virus while in use, it will not harm another user.

In the military administration, for example, a single computer can be used independently from several security officers in terms of security. That is, military confidentiality can be maintained because his data is not passed on to other executives. Furthermore, according to the present invention, even when the hard disk is stolen, all areas of the hard disk are encrypted, so that data cannot be found and security is ensured.

And if you take a family example, you can use it to avoid invading your family's privacy.

The present invention has been described above with reference to one embodiment shown in the drawings, but those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom.

Claims (4)

delete A card slot for connecting with a card lead / writer; A memory in which the serial number is stored; Retrieves and stores in the memory the setting data including the serial number, key value, start address and division size of the card inserted from the card lead / writer connected through the card slot, and the serial number stored in the card and the serial number stored in the memory. Comparing the microcontrollers to allow operation if they match and stop the operation if they do not match; And The hard disk is divided into a start address and a split size of the configuration data received from the microcontroller, the data written from the motherboard to the hard disk is encrypted with a key value of the configuration data, and stored in the partitioned hard disk. A hard disk encryption / decryption module having a user-specific hard disk splitting function of a hardware configuration including an ASIC which decrypts data read from a hard disk into a key value of setting data and transmits the same to an motherboard. The custom integrated circuit, A start address register for storing a start address of the configuration data received from the microcontroller; A division size register for storing a division size of the configuration data received from the microcontroller; A key register for storing a key value of setting data received from the microcontroller; A command separator for separating a command from parallel data transferred from the motherboard to the hard disk; A first mux for separating the write address and the write data from the parallel data transmitted from the motherboard to the hard disk according to the control signal; Read / write address conversion means for converting a cylinder address by adding a start address of the start address register to a cylinder address which is a read / write address separated from the first mux; An encryption unit for encrypting the write data separated from the first mux with a key value stored in the key register; A second mux for combining the converted address of the read / write address conversion means and the write data encrypted by the encryption unit according to a control signal; A third mux for separating the status and the read data from the parallel data transmitted from the hard disk in response to the control signal in the hard disk read or status read command; A decoder which decrypts the read data separated from the third mux into a key value stored in the key register; Cylinder size converting means for converting the cylinder size of the status separated from the third mux to the dividing size of the dividing size register; A fourth mux for combining the divided size of the cylinder size converting means and the read data decoded by the decoder according to a control signal; And And a state machine for receiving a command from the command separating unit and generating a control signal according to the command. The hard disk encryption / decryption module of claim 2, wherein the hard disk encryption / decryption module having a user-specific hard disk partitioning function is provided. A first serial-parallel conversion unit converting serial write data transferred from the main board side to the hard disk into parallel data; A first parallel-serial converting unit converting the parallel data of the second mux into a serial and transferring the parallel data of the second mux to a hard disk; A second serial-to-parallel converter for converting serial read data transferred from the hard disk to the motherboard to parallel data; And a second parallel-serial conversion unit converting the parallel data of the fourth mux into a serial unit and transmitting the serial data to the motherboard. Hard disk encryption and decryption module with a user-specific hard disk partitioning, characterized in that to support the serial data transfer (SATA) hard disk. The system of claim 2, wherein the state machine is When the "HDD Identify" command is received from the motherboard during the initialization process, the partition size read from the card is transmitted. When the "Write_sectors (C, H, S, Cnt, Buf [])" command is received during the data access process, the cylinder address is received. Hard disk encryption and decryption module having a user-specific hard disk partitioning function, characterized in that the transfer to the hard disk side by adding the starting cylinder address.