201207660 六、發明說明： 【發明所屬之技術領域】 [000〗]一種限制檔案存取的方法，特別是利用儲存媒體的控制 器執行一特殊命令以對一限制存取檔案設定存取限定條 件的方法。 【先前技術】 [0002]201207660 VI. Description of the Invention: [Technical Field of the Invention] [000] A method for restricting file access, in particular, using a controller of a storage medium to execute a special command to set access restrictions on a restricted access file. method. [Prior Art] [0002]
[0003][0003]
由於傳統硬碟、固態硬碟不斷的發展，其速度以及容量 都不斷的提升，並且售價不斷的降低。而固態硬碟又可 廣義的包含可攜式的非揮發性記億體，亦即俗稱的隨身 碟，隨身碟的容量亦足以容納大量的資料。因此，儲存 媒體的發展助益了數位資料的儲存、攜帶與傳輸。 習知的儲存技術如中華民國專利公告第374161號「備有 播案配置表記憶體之硬碟機」，該前案所揭示的硬碟機 包含許多磁區’每-磁區依序地包含―啟動區域、一根 目錄區域以及-資料區域。而該硬碟機之特徵在於包含 有-用以寫人資料至—硬碟機上並且用以從該硬碟機上 讀取資料之讀寫頭、—用㈣存—標案配置表訊息之非 依電性播案配置表記憶體，以及—用以控制該讀寫頭的 移動'_碟機的旋轉以及資料讀寫動作之控制器。 [0004] ^ ^ 巴含一控制器，並且 :硬=空間區分為—資料儲存區以 區备其::資料儲存區被區隔為許多資料儲存區塊，並 且每1料儲純塊具㈣^位址 則儲存了每-筆資料所儲存”邊址儲存區 取資料時，都需透過該位址儲存器絲存或讀 099126557 表單編號_ 第3· 獲侍與該筆資料對應 第3頁/共13頁 0992046588-0 201207660 的位址才可從資料儲存區找到對應的資料儲存區塊。 [0005] 但由於數位資料過於便於複製、傳輸與攜帶，從保護資 料内容的角度來看反而損害了保密性，甚至於任何人可 透過可攜式硬碟直接複製、儲存有版權的資料内容，而 侵害了智慧財產權。 [0006] 而現有的資料保密技術可參閱中華民國專利證書第 1 31 7502號「即時資料保密方法」，該前案揭示的方法係 運作於利用一資料夾所掛載成一保密分割區所在的一作 業系統中。該方法包括有：接收一檔案之儲存指令，係 由該作業系統之檔案系統接收該檔案之儲存指令；執行 一加密程序；附加一即時加解密控制項至該檔案之屬性 中，係依據該保密分割區建立之時所加入的即時加解密 控制項，將該檔案附加該即時加解密控制項；以及執行 儲存作業。更進一步的，該先前案件的說明書揭示加密 程序可使用一對稱金鑰或非對稱金錄進行加密，並由對 應的金鑰解密。再者，該方法更可包括一執行身分辨識 附加流程，透過確認身分後才可解密。透過上述方法， 被選擇加密的檔案資料夾需透過至少一次的驗證才可開 啟0 [0007] 但透過金鑰以及身分驗證的保密仍可能讓加密的檔案在 開啟後被複製外流，因此保密的機制仍有不斷改進創新 的空間。 【發明内容】 [0008] 為了改善習知技術中，檔案容易被複製、外流。因此本 案的目的在於提供一種透過記憶體内的控制器限制檔案 099126557 表單編號 A0101 第 4 頁/共 13 頁 0992046588-0 201207660 [0009] ❹ [0010]Due to the continuous development of traditional hard drives and solid state drives, their speed and capacity are constantly increasing, and the price is continuously decreasing. The SSD can also include a portable non-volatile counterfeit body in a broad sense. It is also known as a portable disc. The capacity of the flash drive is also sufficient to accommodate a large amount of data. Therefore, the development of storage media has helped to store, carry and transmit digital data. Conventional storage technologies such as the Republic of China Patent Bulletin No. 374161 "hard disk drive with memory configuration table memory", the hard disk drive disclosed in the previous case contains a plurality of magnetic regions 'per-magnetic region sequentially included ―Startup area, a directory area, and - data area. The hard disk drive is characterized by comprising: a read/write head for writing human data to a hard disk drive and for reading data from the hard disk drive, and a (four) storage-standard configuration table message. The non-electrical broadcast configuration table memory, and the controller for controlling the movement of the read/write head, the rotation of the disc drive, and the reading and writing operations of the data. [0004] ^ ^ Ba contains a controller, and: Hard = space is divided into - data storage area to prepare it:: The data storage area is divided into a number of data storage blocks, and each material storage block (4) ^ address is stored in the data stored in the "address" storage area, you must use the address memory to save or read 099126557 form number _ 3rd and the corresponding information corresponding to the third page A total of 13 pages 0992046588-0 201207660 can only find the corresponding data storage block from the data storage area. [0005] However, because the digital data is too easy to copy, transmit and carry, it damages from the perspective of protecting the content of the data. Confidentiality, even if anyone can directly copy and store copyrighted content through a portable hard drive, infringe intellectual property rights. [0006] The existing data security technology can refer to the Republic of China Patent Certificate No. 1 31 7502 No. "Instant Data Privacy Method", the method disclosed in the previous case is operated in an operating system in which a folder is mounted as a secure partition. The method includes: receiving a file storage instruction, receiving, by the file system of the operating system, a storage instruction of the file; executing an encryption program; and attaching an instant encryption and decryption control item to the attribute of the file, according to the confidentiality The instant encryption and decryption control item added when the partition is established, the file is attached to the instant encryption and decryption control item; and the storage operation is performed. Further, the description of the previous case reveals that the encryption program can be encrypted using a symmetric key or an asymmetric record and decrypted by the corresponding key. Furthermore, the method may further include performing an identity identification additional process, which can be decrypted after confirming the identity. Through the above method, the selected file folder must be verified by at least one verification. [0007] However, the security of the key and the identity verification may still cause the encrypted file to be copied out after being opened, so the mechanism of confidentiality There is still room for continuous improvement and innovation. SUMMARY OF THE INVENTION [0008] In order to improve the prior art, files are easily copied and outflowed. Therefore, the purpose of this case is to provide a way to limit files through the controller in memory. 099126557 Form No. A0101 Page 4 of 13 0992046588-0 201207660 [0009] ❹ [0010]
GG
[0011] 099126557 K數或時_技術，並在職所限定的 時間後刪除該槽案，以限制該檔案外流。人數或案存取的方法，該方法由1存_ 以心 且該儲存媒體包含—實體記恃區均 ，存-個或多個槽案，而該控制器接 ：〔域 :了判斷該特殊命令所指定之-限制存取:::: =建立-限制條《輯表以對騎—限制耗稽㈣ 驟、-判斷該限定條件是否達到的步驟 /、 :件邏輯表内儲存了限制存取檔案的存取的至少―：： 么、件。當到達該限定條件後該控制器刪除在”、定 邏輯表以及實體記憶區域中對應該限制存取槽案的内： 透過上述的方法，可限定播案的存取次數或 :在超過存取次數或可存取時間刪除，以限軸= 【實施方式】 限爾的方法’以下將配合圖式說明 本案之技術。知參_、圖2，圖i揭示了一儲存 與一資訊處理系統2電性連接。該儲存媒體i可為磁盤硬 碟2固態硬碟、或非揮發性記憶體;該資訊處理系統2 可為桌上型電腦、或筆記型電腦、或—行動通訊裝置。 該儲存媒體i包含—實體記憶區域14以储存一個或多個槽 案，以及該儲存媒體1内具有-控制器。連接該儲存媒體 1的處理系統2具有一應用程式以輸出相容於該控制 器的存取命令’且誠祕錢^㈣馳制器支援 表單編號A0101 第5頁/共13頁 0992046588-0 201207660 二= 寺殊命令。當該控制器接收該特殊命令後則首先執 1斷該特殊命令所指定之— 而接乱〃 w讦取檔案的步驟。 執仃建立-限制條件邏輯表u以對應該限制存 =步驟，使該特殊命令所指㈣槽案皆有—限制條件 輯表11相對應，且該限制條件邏輯表_ 2定條件以聞該限制存取檔案的存取。接著執行:判 趣料件是否達到的步驟，其中該控制器在接收到 、封限制存取檔案的存取命令時， f而經由該限制條件邏 099126557 11以取得儲存於實體記憶區域14的槽案。若未達到 =限定條件’該控制器自實體記憶區域14存取該限制存 檔案；若達到限定條件，則該控制器刪除在該限制條 邏輯表U以及實體記憶區域14中對應該限制存取檔案 的内容。上述龍定條件為該_存取難的存取次數 限制，或者為限制存取㈣儲存於該料媒體⑽時限， 該限定條件亦可„包含限制存取擋案的存取次數限制 以及限制存取標案赌存於鑛存媒體1的81限。該儲存媒 體1的具體實施態樣如圖1所示，該错存媒體i更儲存了〆 邏輯位址表10、-邏輯轉㈣位址表12、—實體位址表 該控制器接收外部的存取命令或特殊命令而令該邏 輯位址表11提供被該些命令所指定稽案的邏輯位址。當 該存取命令所請求存取的不是限制存取檔案可直接透 過—存取一般檔案路徑101以該邏輯位址對映（mapping )到該邏輯轉實體位址表12而得到實體位址，再透過該 實體位址表13對映（mapping)到被指定檔案在實艚記 憶區域14中的位置，從而自該實體記憶區域14存取被指 定檔案的内容。當該存取命令所請求存取的為一限制存 表單編號A0101 第6頁/共13頁 099204 201207660 取宰，λ 取限制;r麵輯位址表1G所提供的邏輯位址將透過—存 輯表u颂檔案路彳fl_映（mapping)到限制條件邏 該限·ί此時由該控㈣判斷限制存取财是否到達 定條件邏輯表11敎義的限定條件。若未到達該限 maPpi 4邏輯位址將從該限制條件邏輯表11再對映（ 再读、g)到销輯轉實體位址表12而得到實體位址， 過實體位址表13對映（mapping)f|j被指定槽案在 ❹ Ο 099126557 取被==14中的位置’從而自該實體記憶區域14存 ，嗲 檔案的内容。若控制器判斷到達該限定條件後 切^制ϋ將刪除·制存取财在該雖媒體1内的一 刀。谷’包含該邏輯位址表1Q、該限制條件邏輯表^、 t = 3位址表12、實體位址表13、實體記憶區域14 次…（制存取標案的内容都將被控制器刪除。由於 該資訊處理系統2可能對多個檔案輸_殊命令，因此該 儲存媒體1建立多個限制條件邏輯表11對應每-限制存取 插案。如圖1所示’假設該儲存媒體兩個限制存 取棺案’因此該儲，體1内具有兩個限制條件邏輯表u 對應各限制存取·。並且兩個限制條件邏輯表u可且 有不同的限定條件，限找件的内容可由操作者透過資 訊處理系統2下達特殊命令時決定。該控制器的實施流程 如圖2所示’首先從該資訊處理系統2接收輸入之命令（ 如步驟方塊31)，先判斷是否為特殊命令（如步驟方塊 32)。若是，_立-_條件邏輯細對應限制存取 禮案（如步驟方塊33)。若否，則代表該輸人之命令為 存取命令，此時進-步_該命令所指㈣案是否為限 制存取檔案（如步驟方塊34)，若該命令所指定權案並 表單編號A0101 第7頁/共13頁 0992046588- 201207660 非限制存取檔案，則可允許直接存取該檔案（如步驟方 塊35)。如果該命令所指定檔案為限制存取檔案的話， 控制器將透過限制條件邏輯表11判斷是否達到該限定條 件（如步驟方塊3 6 )。若未到達限定條件，則允許存取 該限制存取檔案（如步驟方塊37)。若到達限定條件， 則由控制器刪除對應該限制存取檔案的内容（如步驟方 塊38)。 [0012] 透過上述的方法，可限定檔案的存取次數或可存取時間 ，並在超過存取次數或可存取時間刪除，以限制該檔案 外流，更增加了一機制確保機密不會外洩。上述的控制 器更可限定該資訊處理系統2必須安裝相容的軟體才可存 取該限制存取檔案。 [0013] 雖然本申請案已以較佳實施例揭露如上，然其並非用以 限定本申請案，任何熟習此技藝者，在不脫離本申請案 之精神和範圍内，而所作之些許更動與潤飾，皆應涵蓋 於本申請案中，因此本申請案之保護範圍當視後附之申 請專利範圍所界定者為準。 [0014] 綜上所述，本申請案較習用之技術增進上述功效，應已 充分符合新穎性及進步性之法定創新專利要件，爰依法 提出申請，懇請貴局核准本件發明專利申請案，以勵創 作，至感德便。 【圖式簡單說明】 [0015] 圖1為該儲存媒體與資訊處理系統之方塊示意圖。 [0016] 圖2為本方法之實施流程方塊圖。 099126557 表單編號A0101 第8頁/共13頁 0992046588-0 201207660 【主要元件符號說明】[0011] 099126557 K number or time_technology, and delete the slot after the time limit defined by the job to limit the outflow of the file. The method of accessing the number of people or the case, the method consists of 1 save and the storage medium contains - the entity records the area, saves one or more slots, and the controller connects: [domain: judges the special The command-restricted access::::=establishment-restriction bar "The table is used for riding-restricted consumption (four), - the step of judging whether the qualification condition is reached /, : the limit is stored in the logic table At least "::" of the access to the file. When the qualification condition is reached, the controller deletes the corresponding access slot in the ", logical table and entity memory area: through the above method, the number of accesses of the broadcast can be limited or: The number of times or the access time is deleted, and the axis is limited. [Embodiment] The method of the limit is described below. The technology of the present invention will be described below with reference to the drawings. The reference _, Fig. 2, Fig. i discloses a storage and an information processing system 2 The storage medium i can be a hard disk 2 solid state hard disk or a non-volatile memory; the information processing system 2 can be a desktop computer, or a notebook computer, or a mobile communication device. The media i includes a physical memory area 14 for storing one or more slots, and a storage controller 1 having a controller. The processing system 2 connected to the storage medium 1 has an application for outputting compatible with the controller. Access command 'and sincere money ^ (4) Chirp support form number A0101 Page 5 / 13 pages 0992046588-0 201207660 2 = Temple special command. When the controller receives the special command, it first executes the special Command office Specifying - and taking the steps of 档案 讦 讦 讦 讦 讦 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制 限制And the conditional logic table _2 sets the condition to notify the access of the restricted access file. Then, the step of: determining whether the item is reached, wherein the controller receives and blocks access to the restricted file When the command is f, the constraint condition is 099126557 11 to obtain the slot stored in the physical memory area 14. If the = limit condition is not reached, the controller accesses the restricted file from the physical memory area 14; The controller deletes the content corresponding to the access file in the restriction bar logical table U and the physical memory area 14. The above-mentioned condition is the access limit of the _access difficulty, or the restricted access (4) Stored in the media medium (10) time limit, the qualification condition may also include the limit of access times for restricting access files and limiting the access limit to the limit of 81 deposits of the mineral storage medium 1. The specific implementation of the storage medium 1 is as shown in FIG. 1. The storage medium i further stores a logical address table 10, a logical (four) address table 12, a physical address table, and the controller receives an external device. Accessing a command or special command causes the logical address table 11 to provide the logical address of the audit specified by the commands. When the access command requests access to the restricted access file, the physical address can be obtained directly by accessing the general file path 101 and mapping the logical address to the logical entity address table 12. The physical address table 13 is then mapped to the location of the designated file in the real memory area 14, thereby accessing the content of the designated file from the physical memory area 14. When the access command requests access to a restricted form number A0101 page 6 / 13 pages 099204 201207660, the λ takes the limit; the logical address provided by the r face address table 1G will pass through - save The table u file path fl_fl maps to the limit condition logic limit. At this time, the control (4) determines whether the restricted access money reaches the qualification condition of the conditional logic table 11 . If the limit maPpi 4 logical address is not reached, it will be re-mapped from the constraint logic table 11 (reread, g) to the pin-transfer entity address table 12 to obtain the physical address, and the entity address table 13 is mapped. (mapping) f|j is specified in the slot ❹ 99 099126557 is taken in the position == 14 and thus stored from the physical memory area 14, the contents of the file. If the controller determines that the limit condition is reached, the controller will delete the system and access the money in the medium 1. Valley ' contains the logical address table 1Q, the constraint condition table ^, t = 3 address table 12, the physical address table 13, the physical memory area 14 times ... (the contents of the access standard will be controlled by the controller Since the information processing system 2 may input a plurality of files, the storage medium 1 establishes a plurality of restriction condition logic tables 11 corresponding to each-restricted access insertion. As shown in FIG. 1 'hypothetical storage medium Two restricted access files 'Therefore, there are two restricted conditional logical tables u corresponding to each restricted access in the body 1. And the two restricted conditional logical tables u can have different qualification conditions, and are limited to find The content can be determined by the operator when a special command is issued through the information processing system 2. The implementation flow of the controller is as shown in FIG. 2 'Firstly receiving an input command from the information processing system 2 (step block 31), first determining whether it is special The command (such as step 32). If yes, the _立-_ conditional logic corresponds to the restricted access case (such as step block 33). If not, the command representing the input is an access command, and then the step is advanced. _ Is the order referred to in the order (4) Access the file (such as step block 34), if the command specifies the rights and form number A0101 page 7 / 13 pages 0992046588 - 201207660 unrestricted access file, you can allow direct access to the file (such as the step block 35) If the file specified by the command is to restrict access to the file, the controller will determine whether the qualification condition is reached through the constraint logic table 11 (step block 36). If the limit condition is not reached, the access is allowed. Restrict access to the file (step block 37). If the qualification is reached, the controller deletes the content corresponding to the restricted access file (step block 38). [0012] Through the above method, the file access can be restricted. The number of times or access time, and deleted in the access times or access time to limit the outflow of the file, and a mechanism to ensure that the secret will not leak. The above controller can further limit the information processing system 2 A compatible software must be installed to access the restricted access file. [0013] Although the present application has been disclosed above in the preferred embodiment, it is not intended to limit the application. Anyone who is familiar with this skill and does not deviate from the spirit and scope of this application, and some of the changes and retouchings should be covered in this application. Therefore, the scope of protection of this application is subject to the scope of patent application. [0014] In summary, the application of this application to enhance the above-mentioned effects, should fully comply with the statutory innovation patent requirements of novelty and progressiveness, and apply in accordance with the law, and request your approval of this article. [0015] Figure 1 is a block diagram of the storage medium and information processing system. [0016] Figure 2 is a block diagram of the implementation of the method of the present invention. 099126557 Form No. A0101 Page 8 of 13 0992046588-0 201207660 [Main component symbol description]
[0017] 1 · · · · ••儲存媒體 [0018] 10 · · · [0019] 11 · · · •••限制條件邏輯表 [0020] 12 · · · •··邏輯轉實體位址表 [0021] 13 · · · ...實體位址表 [0022] 14 · · · • ••實體δ己憶£域 [0023] 100 ·· · •••存取限制存取檔案路徑 [0024] 101 ... •••存取一般檔案路徑 [0025] 2 · · ·. •..資訊處理系統 [0026] 31 · · · •·.步驟方塊 [0027] 32 · · · •••步驟方塊 [0028] 33 · · · 步驟方塊 ...步驟方塊 [0029] 34 ——· [0030] 35 · · · •••步驟方塊 [0031] 36 · · · •..步驟方塊 [0032] 37 · · · .··步驟方塊 [0033] 38 · · · • _ .步驟方塊 099126557 表單編號A0101 第9頁/共13頁 0992046588-0[0017] 1 · · · · •• Storage media [0018] 10 · · · [0019] 11 · · · •••Restriction logic table [0020] 12 · · · •···················· 0021] 13 · · · ... physical address table [0022] 14 · · · • • • entity δ 忆 £ [ [0023] 100 · · · • • • access restricted access file path [0024] 101 ... •••Access to the general file path [0025] 2 · · ·......Information Processing System [0026] 31 · · · •·. Step Block [0027] 32 · · · •••Step Block [ 0028] 33 · · · Step block... Step block [0029] 34 ——· [0030] 35 · · · ••• Step block [0031] 36 · · · •.. Step block [0032] 37 · · ····Step Block [0033] 38 · · · • _ . Step Block 099126557 Form No. A0101 Page 9 / Total 13 Page 0992046588-0