201025004 v/wov/o. i ντ 29784twf.doc/n. 六、發明說明： 【發明所屬之技術領域】 本發明是有關於-種儲存裝置加密的方法，且特別是 有關於一種以軟體來進行資料加密的方法。 【先前技術】 隨著曰新月異科技的科技技術以及電腦的普及，各種 ⑩ 賴祕已漸漸成為日常生活中不可或缺的OL具，同時也 是工作時主要的資料處理工具。在資料儲存上硬碟（Hard Disk，HD)為目前儲存裝置中具有最大容量的儲存裝置， 同日守也疋最主要的資料儲存裝置。目前，電腦系統雖然未 完全取代傳統的紙張，但在資料數位化與無紙化的趨勢 下，許多重要資料常存放於儲存裝置當中，例如會議記錄、 開會報告與公司機密等等。因此，當儲存裝置遺失時，使 用者的重要資料將隨之外沒。 為了防止上述情況的產生，市面上則出現具有密碼保 _ 護功能的硬碟。此種具有密碼保護功能的硬碟内之控制器 月匕夠依據基本輸入輸出系統（Basic Input Output System BIOS )所發出的特殊指令’將硬碟上鎖（1〇淡）或解鎖 (unlock)。此外，也有密碼保護的方式，避免其他使用 者使用其硬碟内的資料。然而，目前市面上大部分的硬碟 仍然不具有資料保護功能，只要將硬碟安裝在其他電腦上 便可讀取其内部資料，導致硬碟遺失時，機密資料便隨之 外茂。 3 J 29784twf.doc/n 201025004 【發明内容】 本發明提供-種㈣紐方法’叫體方絲執行資 料加密的動作，在資料儲存時，先進行資料加密後再儲存 至儲存裝置中，由於儲存裝置中的資料皆為加密過 料因此即使將儲存裝置取出也無法讀取其中的機密資料。 承上述，本發明提出—種資㈣護枝包括下列步 . til先’啟動作㈣統，然後載人儲錢置加解密程式 至作業糸統，接著執行儲存裝置加解密程式以顯示登入晝 ^面’並經由登人晝面要求輸人登人資訊。在確認其登入資 ’根據登入資訊取得一加密金鑰。當作業系統讀 取=裝置中之資料時，使用加密金餘對所讀取的資料進 再輸出，業系統。當作業系統寫人資料至儲存 ^置中〗使用加②金鑰對資料進行加^後再儲存至儲存 在本發明—實施射，其巾在使用加密金鑰對所讀取 式行解密或加密之步驟更包括執行儲存裝置驅動程 ^時^:存裳置中之資料，以及當資料需要壓縮或解麼 、’、置加解密程式對資料進行壓縮與解壓縮。 對鄉實施射’更包括提供使用者介面以設定 資鑰所對應之加密等級或加密路徑。若存取的 二 ==路徑之下’則會在存取資料之前，透過儲 、费程式對資料進行加密與解密動作。 儲存步if r—實施财’上述_倾方法更包括：將 刀：、、、加在區域與普通區域。當作業系統儲存資料 4 201025004 v/ 29784twf.doc/n 至加密區域或讀取加密區域中之資料時， 錄進行資料加密或解密。當作業系統儲存“至 ==料時，則直接經由儲‘-程 在^發明—實施例中’其中在根據登人資訊取得加密 ，鑰之步驟更包括經由指紋辨識、臉部辨 得上述登入資訊。 扎辨馮取 基=上述，本發_雜體的方式來進行資料加密盘 U ’因此不需額外設置可信任安全平台模味峨d platform module，簡稱τρΜ)等硬體裝置即可進 ^，藉此可降低電腦裝置的製造成本。此外，不同的使用〇 台電腦上奴個人錄，在專屬的加密路經上 進仃貝料加密以避免機密外洩。 為讓本發明之上述特徵和優點能更明顯易懂，下文特 舉實施例，並配合所附圖式作詳細說明如下。 、 【實施方式】 賴照圖1，目1為根據本發明一實施例之資料處理 圖。作㈣統UG提供使用者介面讓使用者進行 式當使用者經由作業系統110上的應用程 錢中的f料時，作㈣統11G會透過錯 ^置驅動程式13G去讀取儲存裝置⑽中相對位置 =亚執行财裝置加解練式120對所讀取的資料進行 解密後再輪出至作㈣統⑽。反之，當使用者需要儲存 5 201025004 wuvwvu.j. γ/ 29784twf.doc/n 資料至儲存裝置14〇中時，儲存裝置 先將資料加密，然後再經由儲存 會將 ，裝置⑽中。儲存二 碟(solid-state drive，SSD) 疋m 固態硬 換句話說，儲存裝置加解密程式 置驅動程; 透過儲存裝置加解密程式12〇。管理者可 白 ❹ 生物特徵’如指紋辨識、臉孔辨钟 庫登入資料可對應於不同的加密麵二=產= 或資料存取路徑選擇性的使用加密麵來^貝=夹 二料機密資料 料路徑下時，儲存裝置加解密程; 金餘來進行加解㈣動作。 卩會自較用加挽 此外’值得注意的是，儲存裝置加 ’當作業系統1 iq讀取館存裝置⑽ 料解密程式120可在資 系統開啟咖縮她，則蝴置加解== 201025004 WOVOVO.Α v/ 29784twf.doc/n 壓縮資料，然後再對壓縮過的資料進行加密，最後再交由 儲存裝置驅動程式130儲存至儲存裝置14〇中。藉由上述 資料加密與解密的存取流程，儲存在儲存裝置中^資料^ 以得到完整的保護，因為儲存在儲存裝置中的機密資料都 是經由加密後的資料，未經儲存裝置加解密程式12〇解密 便無法讀取到有效的資料，因此，即使儲存裝置遺失，其 中所儲存的資料也無法被別人所讀取。 • 接下來，進一步說明本實施例的實施流程，請同時參 考圖1與圖2 ’圖2為根據本實施例之資料保護方法流程 圖。首先，啟動一作業系統(步驟S21〇)，然後作業系統11〇 會載入儲存裝置加解密程式至上述作業系統11〇(步驟 S220)。值得注意的是，在此步驟中更包括載入儲存裝置驅 動耘式130以驅動儲存裝置。然後，執行儲存裝置加解密 程式120以顯示一登入晝面，並經由登入晝面要求輸入一 登^資訊(步驟S230^在確定使用者所輸入的登入資訊正 確後，會根據登入資讯取得一加密金錄(步驟S24〇)。在步 ❹ 驟S240巾’可配合電腦的硬體配備，利用指紋辨識、語 音辨識或臉孔辨識等生物辨識方式來作為登入資訊或是設 疋不同的帳號、密碼來區分使用者，更可以使用者設定或 電腦產生加密金鑰。 在取得對應於使用者的加密金鑰後，當作業系統11〇 需要璜取儲存裝置140中的資料時，會使用加密金鑰對所 讀取的資料進行解密後再輸出至作業系統11〇(步驟 S250)。當作業系統11〇需要儲存資料至儲存裝置14〇中 7 201025004 。 ,, 297〇4twf*.doc/n 時，同樣會使用加密金鑰對所讀取的資料進行加密後再經 由儲存裝置驅動程式U0寫入至儲存裝置⑽ = S260)。值得注意的是，在上述步驟S25〇、_ _，^ !料=至儲存裝置140前進行壓縮，然後在讀取資料 時反向進行解壓縮以還原回原本的資料。 密卜本實施射，也可以將儲存裝置⑽分為加 在&域與普通區域，其對應於不 當使用者所要存取的資料位於普通區域中日^^^；用 =存裝置驅_式13G來存取轉，儲存裝置加=程式 不會對其資料進行加密。當使用 = 不論讀取或儲存，皆會透 解山私式120來進行貧料的加密與 通區域，如視窗作業祕下的 二為 算資源。而個人資料 又為加在區域以達到其資料保護的功效。 用者===置加解密程式 密資料=::i 密等級或其加密職、加 的資料=用者可以依照本身需求設定個人化 穿當存取位於加密路徑下的資料時，儲存 :、口解畨程式12〇便會自動發揮作用，對 密’對所要讀取的資料進行解密。必要時广可^ 订貝料壓縮與解壓縮的動作以減少所需的儲存空間。 8 / 29784twf.doc/n 201025004201025004 v/wov/o. i ντ 29784twf.doc/n. VI. Description of the Invention: [Technical Field] The present invention relates to a method for encrypting a storage device, and in particular to a software Data encryption method. [Prior Art] With the rapid development of technology and the popularity of computers, various secrets have gradually become an indispensable OL tool in daily life, and also a major data processing tool at work. Hard disk (HD) is the storage device with the largest capacity in the current storage device. The same day, the main data storage device. At present, although computer systems have not completely replaced traditional papers, many important materials are often stored in storage devices, such as meeting minutes, meeting reports and company secrets, in the trend of digitalization and paperlessness. Therefore, when the storage device is lost, the user's important information will not be available. In order to prevent the above situation, a hard disk with a password protection function appears on the market. The controller in the hard disk with such password protection can lock (until) or unlock the hard disk according to the special command issued by the Basic Input Output System BIOS. In addition, there is also a password-protected way to prevent other users from using the data on their hard drive. However, most of the hard drives currently on the market still do not have data protection. As long as the hard disk is installed on other computers, the internal data can be read. As a result of the loss of the hard disk, the confidential information will be followed. 3 J 29784twf.doc/n 201025004 SUMMARY OF THE INVENTION The present invention provides a method for performing data encryption by means of a method of "four (4) New Zealand". When data is stored, the data is first encrypted and then stored in a storage device, due to storage. The data in the device is encrypted, so even if the storage device is taken out, the confidential data cannot be read. In view of the above, the present invention proposes that the seed (four) guards include the following steps: til first 'starts (four) system, then the person saves the money to add the decryption program to the operating system, and then executes the storage device encryption and decryption program to display the login 昼 ^ Face and ask for the loss of information through the boarding. Confirm that its login information is based on the login information to obtain an encryption key. When the operating system reads the data in the device, the encrypted data is used to re-output the read data. When the operating system writes the person data to the storage device, the data is added to the data stored in the present invention by the addition of the 2 key, and the towel is decrypted or encrypted using the encryption key. The steps further include executing the storage device driver ^^: storing the data in the device, and when the data needs to be compressed or solved, ', the encryption and decryption program compresses and decompresses the data. The implementation of the launch of the township also includes providing a user interface to set the encryption level or encryption path corresponding to the key. If the access is below the == path, the data will be encrypted and decrypted through the storage and fee program before the data is accessed. The storage step if r - the implementation of the above method _ tilting method further includes: adding the knife: , , , to the area and the common area. When the operating system saves data 4 201025004 v/ 29784twf.doc/n When the data in the encryption area or the encrypted area is read, the data is encrypted or decrypted. When the operating system stores "to == material, then directly through the storage process - in the invention - in the embodiment" where the encryption is obtained according to the personal information, the key step further includes the above identification through fingerprint identification, face recognition Information. Tie discerns the basis of the above = the above, the way of the _ miscellaneous way to carry out the data encryption disk U 'so no need to set up a trusted security platform 峨 d platform module, referred to as τρΜ) and other hardware devices can enter ^, thereby reducing the manufacturing cost of the computer device. In addition, different use of the slave computer on the computer, in the exclusive encryption path to enter the shell material encryption to avoid confidential leakage. To make the above characteristics of the present invention The advantages and the advantages are more obvious and understood. The following detailed description of the embodiments will be described in detail below with reference to the accompanying drawings. [Embodiment] Referring to Figure 1, Figure 1 is a data processing diagram according to an embodiment of the present invention. (4) The UG provides a user interface for the user to perform the method when the user passes the application material in the operating system 110, and the (11) system 11G reads the storage device (10) through the error driver 13G. Position=Asian execution device plus deduction 120 decrypts the read data and then rotates to work (4). (10) Conversely, when the user needs to store 5 201025004 wuvwvu.j. γ/ 29784twf.doc/n data When the storage device is in the middle of the storage device, the storage device encrypts the data first, and then stores it in the device (10). The solid-state drive (SSD) 疋m solid-state hard, in other words, the storage device encryption and decryption program Set the driver; through the storage device encryption and decryption program 12 〇. Manager can white ❹ biological characteristics 'such as fingerprint identification, face recognition library login data can correspond to different encryption surface 2 = production = or data access path selectivity The use of the encryption surface to ^ = = clip two material confidential data path, the storage device encryption and decryption process; Jin Yu to carry out the addition (four) action. 卩 will be more than the use of the addition of the other 'notable, the storage device plus 'When the operating system 1 iq reads the library device (10) material decryption program 120 can open the coffee system in the capital system, then add the solution == 201025004 WOVOVO.Α v/ 29784twf.doc/n compress the data, and then compress Data added The secret is finally stored in the storage device 14 by the storage device driver 130. The access process for encrypting and decrypting the data is stored in the storage device to obtain complete protection because it is stored in the storage device. The confidential information in the file is encrypted and cannot be read without being decrypted by the storage device encryption/decryption program. Therefore, even if the storage device is lost, the stored data cannot be read by others. Next, the implementation flow of the embodiment will be further described. Please refer to FIG. 1 and FIG. 2 simultaneously. FIG. 2 is a flowchart of the data protection method according to the embodiment. First, an operating system is started (step S21), and then the operating system 11 loads the storage device encryption/decryption program to the above-described operating system 11 (step S220). It is worth noting that in this step, the loading device is further loaded to drive the magazine 130 to drive the storage device. Then, the storage device encryption/decryption program 120 is executed to display a login page, and a login message is requested via the login page (step S230^, after determining that the login information input by the user is correct, a login information is obtained according to the login information. Encrypted gold record (step S24〇). In step S240, the towel can be equipped with the hardware of the computer, and use biometric identification methods such as fingerprint identification, voice recognition or face recognition as login information or set up different accounts. The password is used to distinguish the user, and the encryption key can be generated by the user or the computer. After the encryption key corresponding to the user is obtained, when the operating system 11 needs to retrieve the data in the storage device 140, the encryption key is used. After decrypting the data read by the key, the data is output to the operating system 11 (step S250). When the operating system 11 needs to store the data to the storage device 14 201025004, , 297〇4twf*.doc/n The encrypted data is also encrypted using the encryption key and then written to the storage device via the storage device driver U0 (10) = S260). It should be noted that the above steps S25, _ _, ^ 料 料 = to the storage device 140 before compression, and then reverse the decompression when reading the data to restore the original data. The Bub is implemented, and the storage device (10) can also be divided into the & field and the normal area, which corresponds to the data that the inappropriate user wants to access in the normal area. ^^^; 13G to access the transfer, the storage device plus = program will not encrypt its data. When using = regardless of reading or storage, the mountain private 120 will be used to carry out the encryption and communication areas of the poor materials, such as the second task of the window operation. Personal data is added to the area to achieve its data protection. User === Set and decrypt the decrypted program data =::i Secret level or its encrypted job, plus data = users can set the personalized wear according to their own needs when accessing the data located in the encrypted path, save: After the program is opened, the program will automatically play the role of decrypting the data to be read. If necessary, you can customize the compression and decompression of the beech material to reduce the required storage space. 8 / 29784twf.doc/n 201025004
以系統資料為例，若將系統資料所儲存的位置設定為 普通區域’則可以提升電腦的運算效能，其資料存取的流 程凊參照圖3，® 3為轉本實施例之資料賴方法流程 圖。首先’系統開機(步驟S310)，然後顯示登入畫面(步驟 S320) ’接著確定登入資訊是否正確？(步驟S33〇)。在取得 正確的登人資訊後，依照登人資訊會產生對應的加密金 錄，並取得與加絲輕配的加/解碼演算法(加密與解密 可視為一種加碼與解碼的流程)(步驟S34〇)。接下來，判斷 所讀取的資料是否為系統資料(步驟⑽），若為系統資料 則直接由儲存裝置驅動程式來存取儲存裝置(步驟S39〇)。 若非系統資料’則判斷是寫人或讀取資料(步驟S36〇)，當 寫入資料時，職韻存裝置加解練式來妨加密並^ 壓縮後交由儲存裝置驅動程式寫入儲存裝置(步驟幻7〇、 S39〇);當讀取資料時’職透過儲雜置轉程式讀 =(步驟S380) ’然後透過儲存裳置加解密程式來進行解 密，並在解壓縮後輸出至作業系統(步驟S385)。 綜上所述，本發明利用軟體來執行資料加密鱼解密， 以軟體來取代硬體，不僅方便安裝料也降低硬體的制造 成，。本發明的儲存裝置加解密程式可針對整顆儲存褒置 或是指定路縣進行加密’不僅可錢㈣者需求進^調 =产同時在緖檔案不加密的情況下可以增加系統的執行 雖然本發明已以實施例揭露如上，然其並非用以限定 本發明，任何所屬技術領域中具有通常知識者，在不 29784twf.d〇c/n 201025004Taking the system data as an example, if the location where the system data is stored is set to the normal area, the computing performance of the computer can be improved. The process of data access is as shown in FIG. 3, and the processing flow of the data is as follows. Figure. First, the system is powered on (step S310), and then the login screen is displayed (step S320). Then, is the login information correct? (Step S33〇). After obtaining the correct boarding information, the corresponding encryption record is generated according to the boarding information, and an encryption/decoding algorithm that is lightly matched with the wire is obtained (the encryption and decryption can be regarded as a process of adding and decoding) (step S34) 〇). Next, it is judged whether the read data is system data (step (10)), and if it is system data, the storage device is directly accessed by the storage device driver (step S39). If it is not the system data, it is judged to be a person to write or read the data (step S36〇). When the data is written, the job storage device is added to the solution to encrypt and ^ is compressed and then written to the storage device by the storage device driver. (Steps 幻7〇, S39〇); when reading the data, 'The job reads through the memory transfer program=(Step S380)' and then decrypts it by storing the scam encryption and decryption program, and outputs it to the job after decompressing System (step S385). In summary, the present invention utilizes software to perform data encryption fish decryption, and replaces the hardware with software, which not only facilitates the installation of materials but also reduces the manufacture of hardware. The storage device encryption and decryption program of the present invention can encrypt the entire storage device or the designated road county. 'Not only can the money (four) need to enter the adjustment = production while the offline file is not encrypted, the system can be executed although the present The invention has been disclosed in the above embodiments, but it is not intended to limit the invention, and any one of ordinary skill in the art is not 29784twf.d〇c/n 201025004
V 【圖式簡單說明】 圖1為根據本發明-實施例之資料處理結構示意圖。 圖2為根據本實施例之資料保護方法流程圖。 圖3為根據本實關之資料保護方法流程圖。V [Simplified Description of the Drawings] Fig. 1 is a schematic diagram of a data processing structure according to an embodiment of the present invention. 2 is a flow chart of a data protection method according to the present embodiment. FIG. 3 is a flow chart of a data protection method according to the present invention.
【主要元件符號說明】 110 :作業系統 120 .儲存裝置加解密程式 130 :儲存裝置驅動程式 140 :儲存裝置 S210〜S260 :流程圖步驟 S310〜S390 :流程圖步驟[Description of main component symbols] 110: Operating system 120. Storage device encryption and decryption program 130: Storage device driver 140: Storage device S210 to S260: Flow chart steps S310 to S390: Flow chart steps