KR100991191B1 - Computer security module and computer apparatus using the same - Google Patents

Abstract

The present invention relates to a computer security module and a computer device employing the same, which allows any user to utilize some functions of the computer while strongly preventing inappropriate computer information change or leakage. By combining security modules to authenticate users prior to booting the computer, the computer user account is determined and booted according to these authentications, and the user is reauthenticated by exchanging security information with the security module during computer booting. This can increase the security of your computer when it boots up. In addition, fingerprints can be continuously recognized and re-authenticated during use to increase security while in use, and certain functions such as restricting file management when using a communication function when a user uses a computer. The combination prevents the security from being weak and enables the use of the computer by any user, thereby increasing the computer utilization.

Security module, computer security, partition, camera, fingerprint, encryption

Description

COMPUTER SECURITY MODULE AND COMPUTER APPARATUS USING THE SAME}

The present invention relates to a computer security module and a computer device employing the same, and more particularly, to a computer security module and a computer device applying the same so that any user can utilize some functions of the computer while strongly preventing inappropriate changes or leakage of computer information. will be.

The rapid developments in the computer and telecommunications fields have led to the daily use of networked computers, making it increasingly difficult to imagine a computerless life. On the other hand, the situation in which various information is exchanged and stored and managed through a computer is becoming more common in not only businesses but also individual homes.

In addition, as the use of computers becomes more common, it is easy for anyone to acquire basic knowledge about computers, and information that can bypass the general security configuration is leaked to the communication network. Acquiring the information is not difficult, and in severe cases, the computer may be physically cut off to acquire the stored information.

1 is a brief conceptual diagram of a computer security technology that is currently commonly used, the security of the computer is largely applied to a technology that applies a hardware security configuration and a software security configuration operating in the operating system inside the computer or to integrate it It is divided into techniques. The higher the security level by applying these configurations, the greater the burden of replacing existing hardware with special expensive hardware, and the slower the operation of the computer due to the continuous operation of the security software.

As an example of the present computer security technology, there is a method of first applying a password to a file or folder stored in a hard disk (HDD) 11 of the computer 10 or preventing manipulation of information. Mainly, hide the location of the folder or change the contents of the file to a different format through a specific program, and use it to enter the password to display the folder or change the format of the file to the normal format. However, this method is cumbersome to operate and time-consuming when there are many conversion files for file-by-file format conversion. In addition, there is a security method that uses a special hard disk to change the device configuration of the hard disk 11 physically different from the operating system, but the general purpose is low because it is not a commonly used hard disk.

As another security method, a method of verifying the password or verifying the contents of the security card or the security device 16 inserted into the authentication interface 15 provided separately during the booting of the operating unit 12 in which the operating system is operated may be performed. exist. However, this method is not secured when acquiring the corresponding security card or security device 16. In addition, there may be password-based security provided in the BIOS portion of the motherboard of the computer 10, but this also knows only how to initialize the BIOS settings of the motherboard (for example, a specific pin connection on the motherboard) It becomes useless.

In addition, there are security methods, such as asking for a password during or after booting the operating system or by applying a separate external permission device to stop using the keyboard and mouse as input devices when they are not authenticated or when their usage time has passed. However, if this is also an internal program of the operating system, the security method can be bypassed, and security is weak, such as by reconnecting a separate input device.

In addition, as the network connection becomes more common, software hacking prevention means and hardware hacking prevention means are applied to prevent various hacking. Most of them are for preventing hacking or network attack from the outside, and the firewall of the operating system itself and various viruses / It can be blocked to some extent by malware monitoring software. However, it is difficult to check if a neighboring user directly installs a program that leaks information from the computer in the absence of an authenticated user.

As mentioned above, various hardware / software computer security is implemented, but security at the same level as a small office or personal computer is mostly focused on software, and such software security is vulnerable to an internal information leaker. The level of security is low because various bypasses are possible.

In addition, if the computer is disassembled in the most physical way to obtain the information, the hard disk is disconnected and then connected to another computer to copy the stored files, so there is no means to prevent it. The traditional approach is less secure.

On the other hand, recently, there has been a configuration in which fingerprint recognition means / near-field communication means is applied to a computer to authenticate specific programs or files through passwords or near field communication means, but this also operates on an operating system. Because it operates in dependence on the system, it is possible to bypass the authentication process by cracking or the like, and information may be leaked while the user is away from an already authenticated computer.

Although the various computer security methods described above are vulnerable to active information leakage by experts or insiders, it is possible to restrict the access of information to general users. Focusing on blocking use greatly restricts access for unauthorized or less secure users who want to use the computer. That is, any user who is not an authorized user cannot use the computer.

As a result, public computers (for example, servers used in small offices, home computers) used by several people cannot increase the security level unconditionally.

For example, a computer may be inexperienced by manipulating a home or public server where sensitive information is stored, and important information may be lost. Highly secure computers may not be available to other users, reducing the availability of the computer. Can be.

Therefore, there is a growing demand for a computer to which a new type of security configuration is applied, which basically guarantees the accessibility of the computer, which is being generalized to household goods and home appliances, while maintaining the security of special information.

In order to prevent the possibility of bypassing the conventional computer security technology as described above and preventing the use of unauthorized users, an object of the present invention is newly provided while maintaining the hardware configuration of the existing computer, while combining additional security modules before booting the computer. Authenticate the user to the computer, allow the computer user account to be determined and booted according to the authentication, and maximize the security of the computer by allowing the user to re-authenticate by exchanging security information with the security module during computer boot. It is to provide a computer security module and a computer device applying the same.

Another object of the embodiments of the present invention is to re-authenticate a booted user and a user using a real computer by using the sameness of the fingerprint information obtained through the security module and the fingerprint information obtained during booting via the camera built-in mouse, and also operate the computer. It provides a computer security module and a computer device that applies the computer security module to continuously authenticate the user process by re-checking the fingerprint when specifying security-related operations such as file manipulation, network connection, and peripheral connection. will be.

Still another object of the embodiments of the present invention is to perform authentication on a fingerprint obtained through a built-in mouse through a security module, so that even if the computer is operated, it is difficult to bypass fingerprint authentication or crack the fingerprint authentication software. And to provide a computer device applying the same.

Another object of the embodiments of the present invention is to reconfigure logical drive partition information of hardware in which key information is stored at the time of booting a computer according to the level of a user authenticated by the security module so that the corresponding hard disk information is provided only to the authenticated user. The present invention provides a computer security module and a computer device to which the internal information cannot be checked even if the hard disk is disconnected and connected to another system.

Another object of the embodiments of the present invention is to use the Internet by disabling the file manipulation window when a non-authenticated or authenticated but low-security user connects to the network, but provides internal information externally or stores external information internally. The present invention provides a computer security module and a computer device using the same, which can be used in general, but prevents information leakage and unauthorized information.

In order to achieve the above object, a computer security module according to an embodiment of the present invention is a security module that is connected to the computer to determine whether the power supply, the camera unit for obtaining a fingerprint image of the user; A fingerprint database for storing registered fingerprint information; A power controller configured to generate a control signal for powering the computer; A security information storage unit for storing unique security information determined by the user's unique information, the unique information of the connected computer, and random number information according to the user fingerprint information; By comparing the fingerprint information obtained through the camera unit with the fingerprint registered in the fingerprint database, the user is distinguished and authenticated to control the power control unit, and the unique information of the computer provided through the communication unit and the unique information of the computer and the authenticated user. And a controller configured to generate unique security information based on random number information according to the user's information, compare the result with the unique security information stored in the security information storage unit, and provide the authenticated user information to the computer through the communication unit.

The controller may be configured to perform fingerprint authentication using a fingerprint image provided through the communication unit during operation of the computer and provide the result to the computer.

The controller provides a signal to the computer to enter the sleep mode when the fingerprint is different from the fingerprint provided for controlling the power controller by performing fingerprint authentication using the fingerprint image provided by the computer through the communication unit.

The control unit provides unique security information of the security information storage unit as a secret key in response to a request of the computer, and stores and provides an authorized certificate for a user currently authenticated to the security information storage unit in response to a request of the computer.

The controller may store and provide hard disk partition information for a user currently authenticated to the security information storage unit at the request of the computer.

In addition, a computer device to which the computer security module is applied according to another embodiment of the present invention is provided with a security module for applying power to a computer according to fingerprint recognition, and includes a mouse having a built-in camera for obtaining a fingerprint. Identify the authenticated users by the controller, apply power to the connected computer, and perform self-authentication based on the unique security information determined by the unique information of the connected computer, the unique information of the connected computer, and the random number information according to the user fingerprint information. A security module for providing said differentiated authenticated user information or said unique security information upon said computer request; Power is applied by the security module and booting is performed, booting with different user accounts according to user authentication information provided by the security module, and requesting unique security information from the security module to the hard disk for the authenticated user. After interpreting the password information including the logical partition information and completing the disk configuration for the authenticated user, the booting is completed, and the authentication module is provided to the security module by providing fingerprint information obtained through the camera built-in mouse to the security module during operating system operation. Including the computer to confirm the identity of.

The computer performs fingerprint authentication through a camera embedded in the mouse in at least one of a file manipulation, a network connection, a peripheral device connection, and a re-entry situation after no input of a preset time during operating system operation.

The computer further includes a separate video communication camera to detect a user's movement by the video communication camera, and waits for fingerprint authentication through a camera built in the mouse when the time without movement exceeds a preset time.

The security module further includes a partition manager that compresses and stores the hard disk partition information for the currently authenticated user using the unique security information and provides the request on request.

The security module further includes a connection bypass unit that is directly connected to the camera-embedded mouse and uses the camera for fingerprint recognition until the computer power is applied, and bypasses the connection interface to the computer after the computer power is applied. do.

The computer monitors the communication driver operation of the operating system when booted by an unauthenticated user or a user with low security level, and when the communication driver is operated, a communication monitoring unit that immediately sends a message corresponding to cancellation when a window for file management is displayed. Include.

The computer security module and the computer device employing the same according to an embodiment of the present invention combine the additional security module to authenticate the user before booting the computer while maintaining the hardware configuration of the existing computer, and the computer user account is determined according to the authentication. In addition to booting, the user may be authenticated by exchanging security information with the security module during booting of the computer, thereby increasing security when the computer is booted.

A computer security module and a computer device employing the same according to an embodiment of the present invention re-use a booted user and a user who uses a real computer by using the sameness of fingerprint information obtained through the security module and fingerprint information obtained during booting using a camera built-in mouse. In addition to authenticating, the user's fingerprints can be continuously authenticated by verifying fingerprints when specifying security-related actions such as file manipulation, network connection, and peripheral connection while the computer is running. There is an effect that can prevent information leakage or unauthorized use when emptying or when an authorized computer is left unattended.

The computer security module and the computer device employing the same according to an embodiment of the present invention are configured to perform authentication on a fingerprint obtained through a built-in mouse through a security module, so that even if the computer is operated, a bypass of fingerprint authentication or cracking of fingerprint authentication software is prevented. By making it difficult, there is an effect that can maximize the security.

According to an embodiment of the present invention, a computer security module and a computer device to which the same is applied may reconfigure logical drive partition information of hardware in which main information is stored at the time of booting a computer according to the level of a user authenticated by the security module, and the information may be provided only to the authenticated user. By not only controlling access per drive, but also removing the hard disk and connecting it to another system, internal information cannot be checked, thereby increasing the accessibility of security information and reducing the possibility of security information leakage.

The computer security module and the computer device employing the same according to an embodiment of the present invention can use the Internet by disabling the file manipulation window when a user who is not authenticated or authenticated but has a low security level connects to a network. By not allowing external information to be stored internally, general use is possible, but information leakage and unauthorized information are prevented from receiving, which increases the usability of the computer.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings.

Figure 2 is a configuration example for explaining the conceptual operation of an embodiment of the present invention, as shown in the security module 21 is a computer 20 mounted as a kind of peripheral device, and applied as an accessory configuration of the computer 20 The computer device to which the security module is applied may be configured through the monitor 30 and the mouse 40 in which the camera 41 for fingerprint recognition is embedded. On the other hand, the image communication camera 31 may be applied for additional functions.

If shown, the computer 20 preferably does not have a separate power switch, and only the reset switch 22 needs to be configured. Of course, when using the existing computer case, the power switch portion is configured not to operate.

That is, the security module 21 may control the power of the computer by connecting the connector connected to the power switch of the computer case to the security module 21 in the main board configured inside the computer.

In the configuration shown, the security module 21 is an example configured to fit in the 3.5-inch bay for compatibility with a general computer case, but it can be configured in various ways. Meanwhile, although the illustrated configuration is based on a desktop computer, the configuration may be applied to a notebook computer or a similar type of computer as well as a large server computer.

3 is a block diagram illustrating an embodiment of a security module, and includes a main board 110 including a communication unit 111, a hard disk 120, and a power supply 130, in which information is stored. The security module 200, which is connected to a typical computer configuration, internally includes a camera 210 and an image processing unit 220 for acquiring a fingerprint image, a fingerprint database 270 storing information about a pre-registered fingerprint and corresponding user information. ), A power control unit 240 for providing a signal for applying power to the power applying signal receiving unit configured in the main board 110, and a communication unit 250 for exchanging information with the communication unit 111 of the main board 110. A fingerprint user is compared with the information stored in the fingerprint database 270 and the fingerprint information obtained through the image processing unit 220. By authenticating and controlling the power control unit 240, the power supply signal is provided to the main board 110. The unique security information for each authentication user and the authenticated user information are transmitted through a communication unit of the main board 110. The control unit 230 is provided to. In addition, a user interface 280 may be further configured to receive a user input if necessary, or to notify an error or success of the fingerprint input.

The process of registering a fingerprint in the fingerprint database 270 registers a fingerprint registered at the time of initial installation as a top manager fingerprint, and then registers a fingerprint after the corresponding top manager is authenticated for further registration, and the top manager is authenticated. User account management based on a registration fingerprint may be enabled only by a management program automatically installed by the security module on a computer booted from. Of course, such fingerprint registration may be performed using only the security module itself, and various fingerprint registration methods may be applied.

The control unit 230 of the security module 200 is obtained from the unique information of the computer (for example, the serial information of the motherboard, the MAC information of the network card, etc.) connected with the unique information of the module at the time of initial registration and the registered user fingerprint The random number obtained by seeding the feature is combined to generate unique security information for each user, and stored in the security information storage unit 260. The stored unique security information may be added every time the fingerprint of the authorized user is registered, and may be configured to not be changed externally. The unique security information can basically be used as a secret key for encrypting and decrypting user-specific information, and the security module can be used for self-authentication of its installation. That is, when the user starts the computer by recognizing the fingerprint, the security information storage unit generates unique security information for the user by combining the random number obtained from the fingerprint information with the unique information of the module and the unique information provided from the computer. By comparing with the unique security information stored in the (260) it can be confirmed that the security module 200 is a computer installed, it is possible to ensure the stability of the security module installation.

In addition, the security module 200 may perform authentication for booting while exchanging various information in the process of booting the computer 100, and may be variously used in the process of driving the computer. That is, not only the basic function of operating the computer by fingerprint authentication but also the information on the authenticated user can be provided to the computer so that the computer can identify the user so that the user account can be determined at boot time. In addition, even after the computer is operated, functions related to fingerprint recognition may be independently performed. Thus, cracking due to software fingerprint recognition may be prevented by not performing a function related to fingerprint recognition inside the computer. In other words, when the computer needs to recognize a user's fingerprint while in use, the computer may request a fingerprint recognition from the security module 200 through the communication unit 111 or transmit a fingerprint image to receive a fingerprint recognition result thereof. have.

In order to further increase the independence of the security module 200, a subsequent processing for fingerprint recognition may be added by itself. For example, if the fingerprint for starting the computer and the fingerprint recognized while using the computer are different, the security module 200 may provide the information to the computer, but itself sleep mode (that is, power saving mode). ), A signal corresponding to a signal generated when the sleep key on the keyboard is pressed may be provided.

Therefore, the security module 200 continuously performs the user authentication process by fingerprint recognition before or after the computer is operated. Meanwhile, the security module 200 may provide encryption and decryption of key information related to a system or a setting, a specific file or folder for each user by providing the unique security information as a secret key according to a request of a computer, and for system operation. In the case of specific information required, the encrypted information itself may be stored in the secure information storage unit 260 and provided when requested by a computer. In addition, it may be provided with a function that can be stored in the security information storage unit 260 by dividing a public certificate or a private certificate used for personal authentication by the authentication user and provided when necessary.

On the other hand, in the configuration of the illustrated computer 100, in the case of the illustrated hard disk 120 when the security software is driven by the operating system configured to some degree of security, but somebody separates the hard disk 120 to another computer If you check the internal information by connecting to the internal information will be exposed. Therefore, in order to prevent this, in the present embodiment, logical hard disk partition information is configured differently for each user to use the corresponding information.

In general, the first physical sector of a hard disk is called a master boot record (MBR), and information about the executable code and the partition table for booting is stored in the corresponding area. Since the information on the partition table is completely exposed by default, file access according to the drive partition configuration of the hard disk is freely possible. As a result, security software to enhance the security of a file or folder uses a method of storing the file or folder in a different format, which is very cumbersome and time-consuming because it requires a format conversion if necessary. Even in the old format, the copy itself is possible so that the copied content can be interpreted later.

Therefore, in the present embodiment, a logical drive is set in a hard disk to set a drive for managing files requiring security, and partition information according to the logical drive is managed by using the security module 200.

For example, when the authentication user creates a specific logical drive, the computer may encrypt the partition information after creation of the logical drive using the unique security information of the authentication user. After booting, the computer boots only with partition information for the remaining capacity except the logical drive, and decrypts the encrypted partition information using the unique security information, and then uses the drive management program or the own program of the operating system to obtain the corresponding partition information. Register to expose the logical driver partitioned by the user.

Of course, the partition information itself can be stored in the security information storage unit 260 of the security module 200 and recalled when needed. When the partition information is adjusted in this way, the hard disk 120 is attached to another computer for confirmation. However, the contents of the logical drive without the partition information cannot be confirmed.

In other words, authenticated users are able to use the environment in which their own drive is exposed only by fingerprint recognition, thereby enabling safe and easy file management.

4 illustrates an example of a modified configuration of the security module 200. As illustrated, the communication unit 251 is configured by a plurality of communication units, and the first communication unit 252 communicates with the communication unit of the main board. It is a basic structure for exchanging information. The second communication unit 253 may be connected to, for example, a camera built-in mouse 500 as a USB communication unit. That is, when using this, the camera of the built-in mouse can be shared without the camera or the image processor in the security module itself. To this end, the second communication unit 253 connects the camera-embedded mouse 500 with the control unit 230 of the security module when power is not applied to the computer, and obtains fingerprint information. When applied, the camera built-in mouse 500 may be provided with a switch to bypass the connection to the communication unit on the main board of the computer. Meanwhile, if necessary, a general mouse and a camera for fingerprint recognition may be separately configured without using the camera built-in mouse 500.

When the security module 200 is shared with the camera built-in mouse 500 in this way, the degree of freedom of configuration of the security module 200 can be increased. For example, in the case of a notebook computer, a PCMCIA slot, a CF card slot, or an SD card slot may be used. It can be configured to be connected and buried so that it can be applied to existing computers with a minimum of external exposure.

In addition, a TV or set-top box with an adjacent short distance communication tag (for example, an RFID tag) attached to the third communication unit 254, a mobile communication terminal having a Bluetooth function, a wireless LAN access point (not shown), a mobile communication base station ( Receiving various broadcast or communication signals such as not shown), WiBro base station (not shown), TDMB broadcasting station (not shown), and further adding a receiving unit for distinguishing a corresponding region to collect identifier information of each communication method. Information can be distinguished. In other words, it is possible to identify whether the computer has been moved unauthorizedly by identifying previously collected identifier information and currently collected identifier information, and when exchanging information through a network, the hacker can reconfirm his location information. It can also be used as information to prevent spoofing your location.

5 is a signal flow diagram illustrating a booting process according to an embodiment of the present invention. As shown in FIG. 5, when the security module recognizes a fingerprint and provides a power authorization signal to the computer, the computer starts booting. The computer sets up a user account in the process of booting, and at this time, the security module requests the security module, and the security module provides the user information according to the recognized fingerprint. If you are an unauthenticated user, you can become a guest account, and the computer may stop booting and stop using the computer.

The booting proceeds with the user account set up using the authenticated user information. The computer checks the camera's built-in mouse and requests the user for fingerprint authentication through the camera embedded in the mouse. At this time, the fingerprint authentication may be performed by a computer, but may provide image information on the fingerprint to the security module and check whether the fingerprint module is the same as the authenticated user. In the case of a guest account by an unauthenticated user, this process may be omitted and the recognized fingerprint information may be stored in the computer or the security module as the usage log information.

If booting by an authenticated user, the computer requests the security module's unique security information as an encryption key and receives the information to decrypt the previously encrypted partition information to configure the hard disk logical drive of the authenticated user. You can change the drive configuration. Meanwhile, even encrypted partition information together with an encryption key may be received from the security module.

Through this process, when the booting is completed after the authentication process for the user, a basic environment in which the authenticated or non-authenticated user can use the computer is set. If necessary, boot-related information (boot time, boot user, fingerprint information, etc.) may be provided to the security module to be recorded as a boot log as shown.

On the other hand, the computer may be installed with software to limit the use of a particular program, function, peripheral device according to the user account.

6 is a flowchart illustrating an embodiment of continuously authenticating a user during a process of using a computer. As illustrated in FIG. In such an environment, if the input is attempted again after being inactive for a certain period of time while using the computer, fingerprint authentication may be required through a camera built in the mouse. If the fingerprint authentication fails, the user can go to sleep mode to prevent unauthorized users from using the computer.

In addition to these basic methods, when a user attempts to manipulate a file, connect to a network, or connect to a peripheral device, the user may perform a process of re-printing a fingerprint through the camera built in the mouse. If it is installed, it can detect the movement through the camera and if the movement is not detected for a certain time, fingerprint authentication can be performed again. By applying this method, it is possible to prevent the computer from being exposed unprotected while the authenticated user is away for a while.

On the other hand, the configuration and operation process relates to the content so that only the authenticated user can use the computer, but there may be a situation that a variety of users using the computer, the user who is not authenticated or the authentication level but low security level Consideration should be given to how the computer is made available to the computer by default.

Therefore, in the present embodiment, when not using a communication network, the user can restrict the use of security-related functions such as file manipulation and peripheral connection, or leave fingerprints, usage logs, etc. when using the corresponding functions. have. However, when using a communication network, it is very easy to transfer files or receive illegal files. Therefore, the operating system monitors the use of communication-related drivers (for example, winsock.dll in Windows), and then monitors the use of built-in or specific files. When a communication function is activated by a program, a monitoring means can be applied to disable a file management window that allows a user to manage a file among file-related functions. The monitoring means may be automatically installed by the security module according to the user account. That is, while the network is in use, the file management window is monitored and the message generated when pressing the 'cancel' button of the file management window is immediately generated so that the user can not use the file-related functions while minimizing the impact on the operating system. Of course, other methods of monitoring a driver related to file management and forcibly terminating the process may also be used.

7 is an exemplary flowchart illustrating an information security method according to the use of a communication program when booted by an unauthenticated user as described above. As shown in FIG. Booting is complete with only the disk displayed. This allows for the security of files that require security by default. At this time, the program for monitoring the use of the program for communication may be automatically installed by the security module.

When the user executes the communication program, the monitoring means detects the operation contents. Thereafter, when a user wants to transmit or download a specific file, a file manipulation window appears. The monitoring means forcibly cancels the file so that file management is impossible while the user uses the communication program.

In this way, unauthenticated users or users with low security can use basic computers such as Internet browsing, but they cannot use file transfers or downloads that affect the security of their computers. To increase.

In the above described and illustrated with respect to preferred embodiments according to the present invention. However, the present invention is not limited to the above-described embodiments, and various changes and modifications may be made by those skilled in the art without departing from the scope of the present invention. .

1 is a conceptual diagram showing a general computer security configuration.

Figure 2 is a block diagram showing the configuration of an embodiment of the present invention.

3 is a block diagram showing the configuration of a security module and a computer device to which the same according to an embodiment of the present invention.

4 is a configuration diagram of a communication unit of a security module according to an embodiment of the present invention.

5 is a signal flow diagram between a security module and a computer according to an embodiment of the invention.

6 is a re-authentication flowchart according to an embodiment of the present invention.

7 is a flowchart illustrating a file manipulation prevention process according to an exemplary embodiment of the present invention.

** Description of symbols for the main parts of the drawing **

100: computer 110: motherboard

111: communication unit 120: hard disk

130: power source 200: security module

210: camera 220: image processor

230: control unit 240: power control unit

250: communication unit 260: security information storage unit

270: Fingerprint Database 280: User Interface

Claims (20)

A security module connected to a computer to determine whether to apply power. A camera unit for obtaining a fingerprint image of a user; A fingerprint database for storing registered fingerprint information; A power controller configured to generate a control signal for applying power to the computer; A security information storage unit for storing unique security information determined by the user's unique information, the unique information of the connected computer, and random number information according to the user fingerprint information; A communication unit connected with an internal communication unit of the computer to exchange information; By comparing the fingerprint information obtained through the camera unit with the fingerprint registered in the fingerprint database, the user is distinguished and authenticated to control the power control unit, and the unique information and the unique information of the computer provided through the communication unit and the authentication. And a controller configured to generate unique security information based on random number information according to the user's information, compare the result with the unique security information stored in the security information storage unit, and provide the authenticated user information to the computer through the communication unit. And performing self-authentication according to the unique security information. The computer security module of claim 1, wherein the controller performs fingerprint authentication using a fingerprint image provided through the communication unit while the computer is operating, and provides the result to the computer. The system of claim 1, wherein the controller is further configured to perform a fingerprint authentication using a fingerprint image provided by the computer through the communication unit to cause the computer to enter a sleep mode when the fingerprint is different from the fingerprint provided to control the power controller. Computer security module, characterized in that to provide. The computer security module of claim 1, wherein the controller acquires boot information provided by the computer through the communication unit after the booting of the computer is completed and stores the boot information in the security information storage unit as a boot log. The computer security module of claim 1, wherein the control unit provides unique security information of the security information storage unit as a secret key in response to a request of the computer. The computer security module of claim 1, wherein the control unit stores and provides an authorized certificate for a user currently authenticated to the security information storage unit at the request of the computer. The computer security module of claim 1, wherein the control unit stores and provides hard disk partition information for a user currently authenticated to the security information storage unit according to a request of the computer. The computer security module of claim 1, wherein the camera unit is configured separately from the module. The computer security module of claim 1, wherein the camera unit is configured inside a mouse and is connected to the module through the communication unit. The method of claim 1, wherein the communication unit further comprises a position determining communication unit for receiving at least one communication of Bluetooth, WLAN, WiBro, mobile communication, RFID, the control unit of the adjacent communication means obtained through the position determination communication unit Storing identifier information in the security information storage unit, and checking the identifier information of the adjacent communication means at every operation to provide the computer that the position of the computer has not changed when at least one of them is confirmed. Computer security module. A security module for applying a power to a computer according to fingerprint recognition is applied, the computer device comprising a mouse with a built-in camera for fingerprint acquisition, After the authentication user is identified by fingerprint recognition, power is supplied to the connected computer, and self-authentication is performed by the unique security information determined by the unique information of the connected computer, the unique information of the connected computer, and random number information according to the user fingerprint information. A security module for providing said differentiated authenticated user information or said unique security information upon said computer request; Power is applied by the security module and booting is performed, booting with different user accounts according to user authentication information provided by the security module, and requesting unique security information from the security module to the hard disk for the authenticated user. After interpreting the password information including the logical partition information and completing the disk configuration for the authenticated user, the booting is completed, and the authentication module is provided to the security module by providing fingerprint information obtained through the camera built-in mouse to the security module during operating system operation. And a computer for checking the identity of the computer security module. The method of claim 11, wherein the security module performs fingerprint authentication using a fingerprint image provided by the computer through a camera built-in mouse to allow the computer to enter a sleep mode when the computer differs from the fingerprint provided for powering on the computer. A computer device to which the computer security module is applied, characterized in that it comprises an identity verification unit for providing a signal. The method of claim 11, wherein the computer re-executes fingerprint authentication through a camera embedded in the mouse in at least one of a file manipulation, a network connection, a peripheral device connection, and a re-entry situation after no input of a preset time. A computer device to which a computer security module is applied. The method of claim 11, wherein the computer further comprises a separate camera for video communication, the video communication camera to detect the user's movement, if the time without movement exceeds a preset time the camera built in the mouse A computer device to which the computer security module is applied, characterized by waiting for fingerprint authentication through the device. The computer system of claim 11, wherein the computer provides the boot information to the security module after booting is completed, and the security module further includes a log manager configured to store the boot information as a boot log and to provide the boot information. Computer device to which the computer security module is applied. The computer security module of claim 11, wherein the security module further comprises a public certificate management unit configured to store and provide a public certificate for a user currently authenticated to the security information storage unit according to a request of the computer. Computer devices. The computer according to claim 11, wherein the security module further comprises a partition management unit configured to compress and store hard disk partition information for a currently authenticated user using unique security information and to provide a request upon request. Device. The system of claim 11, wherein the security module is directly connected to the camera-embedded mouse and uses the camera for fingerprint recognition until computer power is applied, and bypasses the connection interface to the computer after computer power is applied. The computer device to which the computer security module is applied, further comprising a bypass unit. The method of claim 11, wherein the computer monitors the operation of the communication driver of the operating system when booted by an unauthenticated user or a user with low security level, and immediately displays a message corresponding to cancellation when a window for file management appears when the communication driver is operated. And a communication monitoring unit for transmitting the computer security module to which the computer security module is applied. The computer device according to claim 11, wherein the camera of the camera-embedded mouse can be separately configured.

Images