TW201327259A - Data protection method - Google Patents

Abstract

A data protection method comprises a facilities connection step, an authentication identification ID step, a startup virtual system step, a startup application program step, and an access right authentication step. Users have to pass several authentication mechanisms, such as identification ID authentication, startup password authentication, execution account authentication, and right authentication, to be allowed to access a confidential file database. Accordingly, the purpose of protecting confidential information can be achieved by avoiding utilization of confidential file without authorization.

Description

Data protection method

The present invention relates to a data protection method, and more particularly to a data protection method for protecting confidential data by using a virtual system.

According to the development of technology, the current information transmission and preservation work has been carried out by computer, in order to increase the efficiency of work through electronic processing. In order to prevent the leakage of confidential files, the secrets are often The file is encrypted, forcing the user to use a specific application for decryption, in order to open the confidential file, thereby controlling the use of the confidential file and protecting the confidential file from leakage.

However, although the above-mentioned method of using encryption can achieve the effect of controlling the use of the confidential file, once the confidential file is decrypted, it will lose protection and cannot prevent unauthorized use, and although the current system is in the application, The protection mechanism is added to further control the use of the confidential file, but this method must modify the code of the application, and is not applicable to the system that has been developed. Therefore, after observing the above shortcomings, the inventor of the present invention thinks This prior art data protection method is necessary for further improvement, and is accompanied by the present invention.

SUMMARY OF THE INVENTION The object of the present invention is to provide a data protection method which can be directly applied to an existing operating system and which can effectively prevent unauthorized use of confidential files.

In order to achieve the above objective, a data protection method provided by the present invention includes a device connection step, a verification identification ID step, a startup virtual system step, an activation application step, and a verification access permission step, wherein The device connecting step is to connect a verification device to a computer host, and the verification device stores an identification ID, and the computer host is provided with an operation system, and the operation system is installed with an initial program, the start The program system is connected with an identification ID database, a startup password database, and an execution account database. In addition, the operating system is further connected with a virtual system, and the virtual system is connected with a confidential file database and a permission database. The operating system further includes an application; and the verification identification ID step means that when the user connects the verification device to the computer host, the startup program stores the identification ID stored in the verification device with the Identifying the ID database for comparison, determining whether the identification ID is valid; and the step of starting the virtual system means If the identification ID of the verification device is valid, the startup program may request to input a startup password, and compare the startup password with the startup password database to determine whether the startup password is correct, if the startup password is If it is correct, the virtual system is started; and the startup application step means that if the identification ID of the verification device is valid, the startup program will request to input an execution account, and the execution account and the execution account data. The library performs comparison to determine whether the execution account is valid. If the execution account is valid, the application is started; and the verification access step refers to when the application wants to access the confidential file database. The application must log in to the virtual system with the execution account, and the virtual system compares the execution account with the permission database to determine whether the execution account has the right to access the confidential file database, and if the execution is performed The account has access to the confidential archive database, allowing the application to access the confidential archive.

The data protection method of the present invention, through the device connection step, the verification identification ID step, the startup virtual system step, the startup application step, and the verification access permission step, so that the user must verify and activate the password by identifying the ID one by one. The verification, execution of account verification and permission verification and other multi-pass authentication mechanisms can access the confidential file database, thereby not only preventing unauthorized use of confidential files, but also protecting the confidential data, and because the start program The virtual system and each database can be directly installed in an existing operating system. Therefore, the present invention can achieve the effect of protecting data without modifying the program code of any program.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram of a preferred embodiment of the present invention, and is a block diagram of a preferred embodiment of the present invention, which is a schematic diagram of a preferred embodiment of the present invention. The data protection method 100 mainly includes the following steps: a device connection step S1: connecting a verification device 10 to a computer host 20, wherein the verification device 10 stores an identification ID 11 and a startup The password 12, an execution account 13 and an execution password 14, and the computer host 20 is provided with an operating system 30, and the operating system 30 is provided with an initial program 31, and the initial program 31 is connected with an identification ID data. The library 32, a second password database 33, a startup password database 34, and an execution account database 35. In addition, the operating system 30 is further connected to a virtual system 36, and the virtual system 36 is connected to a confidential file database. 37 and a permission database 38. In addition, the operating system 30 is further provided with an application 39. In the embodiment, the verification device 10 is a USB key, and the virtual system 36 is The boot password 12 is further cut into a first boot password 121 and a second boot password 122, and the first boot password 121 is stored in the verification device 10, and the second boot password is stored in the operating system 30. 122 is stored in the second password database 33, and the execution password 14 is also cut into a first execution password 141 and a second execution password 142, and the first execution password 141 is stored in the verification device 10, and the The second execution password 142 is stored in the second password database 33. In addition, the identification ID database 32 may pre-store a plurality of the identification IDs 11, and the startup password database 34 may be pre-stored. The activation password 12 is plural, and the execution account database 35 may pre-store a plurality of the execution account 13 and the execution password 14 matching the execution account 13, and the permission database 38 may be pre- There are a plurality of the execution accounts 13 and, in addition, it must be noted that the verification device 10 can also be other devices such as an IC card, and the virtual system 36 can be installed on another computer host and then through the Ethernet. Connect to Operating system 30, wherein the present embodiment is only a preferred embodiment and does not limit the scope of the patent condensing invention.

Verifying the identification ID step S2: After the user connects the verification device 10 to the computer host 20, the startup program 31 compares the identification ID 11 stored in the verification device 10 with the identification ID database 32, and determines Whether the identification ID 11 is valid.

Starting the virtual system step S3: If the identification ID 11 of the verification device 10 is valid, the startup program 31 will request to input a startup password 12, and compare the startup password 12 with the startup password database 34 to It is determined whether the startup password 12 is correct. If the startup password 12 is correct, the virtual system 36 is activated. In this embodiment, since the startup password 12 is pre-stored in the verification device 10, the startup program 31 is The startup password 12 will be automatically read, wherein the startup program 31 automatically reads the first startup password 121 by the verification device 12, and then reads the corresponding second by the second password database 33. The password 122 is activated, and finally the first startup password 121 and the second startup password 122 are calculated and synthesized into the startup password 12.

Starting the application step S4: If the identification ID of the verification device is valid, the startup program 31 will request to input an execution account 13 and compare the execution account 13 with the execution account database 35 to determine the Whether the execution account 13 is valid, if the execution account 13 is valid, further requesting an execution password 14 and comparing the execution password 14 with the execution account database 35 to determine whether the execution password 14 is related to the execution account. If the execution password 14 matches the execution account 13, the application 39 is started. In this embodiment, the execution account 13 and the execution password 14 are pre-stored in the verification device 10, Therefore, the startup program 31 will automatically read the execution account 13 and the execution password 14, wherein the startup program 31 automatically reads the first execution password 141 by the verification device 14, and then the second The password database 33 reads the corresponding second execution password 142, and finally combines the first execution password 141 and the second execution password 142 into the execution password 14.

Verifying Access Rights Step S5: When the application 39 wants to access the confidential file repository 37, the application 39 must log in to the virtual system 36 with the execution account 13 at the moment, and the virtual system 36 will execute the account 13 Comparing with the permission database 38, determining whether the execution account 13 has the right to access the confidential file database 37, and if the execution account 13 has the right to access the confidential file database 37, the application is allowed. 39 access to the confidential archive database 37.

In order to further understand the structural features of the present invention, the application of the technical means, and the intended effect, the manner of use of the present invention will be described. It is believed that the invention can be more deeply and specifically understood as follows: Referring to the third embodiment, which is a flowchart of the operation of the preferred embodiment of the present invention, when the user wants to access the confidential file database 37, the user must first connect the verification device 10 to the user. The host computer 20, after which the start program 31 automatically reads the identification ID 11 in the verification device 10 and compares the identification ID 11 with the identification ID database 32 to determine whether the identification ID 11 is If the identification ID 11 is valid, the startup program 31 further reads the first startup password 121 from the verification device 10, and reads the corresponding identification ID 11 from the second password database 33. The second startup password 122 is used to calculate the startup password 12 by synthesizing the first startup password 121 and the second startup password 122, and then comparing the startup password 12 with the startup password database 34 to determine the password. start up If the code 12 is correct, if the startup password 12 is correct, the virtual system 36 is activated and the virtual system 36 is placed in a standby state; in addition, while the first startup password 121 is read, the startup program 31 is also The execution account 13 is read by the verification device 10, and the execution account 13 is compared with the execution account database 35 to determine whether the execution account 13 is valid. If the execution account 13 is valid, the The first execution password 141 is read in the verification device 10, and the second execution password 142 corresponding to the account 13 is read by the second password database 33, and the first execution password 141 and the second execution are executed. The password 142 is calculated to synthesize the execution password 14, and the execution password 14 is compared with the execution account database 35 to determine whether the execution password 14 matches the execution account 13, if the execution password 14 and the execution After the account 13 matches, the application 39 is started; finally, after the virtual system 36 and the application 39 are started, the user must further log in to the virtual system 36 with the execution account 13, the virtual system. 36, the execution account 13 is automatically compared with the permission database 38 to determine whether the execution account 13 has the right to access the confidential file database 37, and if the execution account 13 has access to the confidential file database The permission of 37 allows the application 39 to access the confidential archive database 37, thereby allowing the user to save the identification by multiple functions such as ID verification, password verification, account verification, and authority verification. The confidential file database 37 is taken, and the user with insufficient authority can only access other files in the computer host 20, thereby preventing unauthorized use of the confidential file, so as to protect the confidential data, and because The startup program 31, the virtual system 36, and the respective database systems can be directly installed in the existing operating system. Therefore, the present invention can achieve the effect of protecting data without modifying the program code of any program.

Further, the features of the present invention and the achievable expected effects thereof are as follows: the data protection method of the present invention, through the device connection step, the verification identification ID step, the startup virtual system step, the startup application step, and the The step of verifying access rights allows the user to access the confidential file database by identifying multiple authentication mechanisms such as ID verification, password verification, account verification, and permission verification, thereby preventing not only confidential files but also confidential files. Authorized to use for the purpose of protecting confidential information, and because the starting program, the virtual system and each database can be directly installed in an existing operating system, the present invention can be achieved without modifying the program code of any program. Protect the effectiveness of the data.

In summary, the present invention has excellent advancement and practicability in similar products, and at the same time, the technical materials of such structures are frequently investigated at home and abroad, and the same structure is not found in the literature. The invention already has the invention patent requirements, and the application is filed according to law.

However, the above-mentioned ones are merely preferred embodiments of the present invention, and the equivalent structural changes of the present invention and the scope of the claims are intended to be included in the scope of the present invention.

100. . . Data protection method

10. . . Verification device

11. . . Identification ID

12. . . Start password

121. . . First startup password

122. . . Second boot password

13. . . Executive account

14. . . Execution password

141. . . First execution password

142. . . Second execution password

20. . . Computer host

30. . . working system

31. . . Starter

32. . . Identification ID database

33. . . Second password database

34. . . Start password database

35. . . Executive account database

36. . . Virtual system

37. . . Confidential file database

38. . . Permission database

39. . . application

S1. . . Device connection step

S2. . . Verify ID step

S3. . . Start virtual system steps

S4. . . Launch application step

S5. . . Verify access steps

The first figure is a schematic view of the connection of the device of the preferred embodiment of the present invention.

The second drawing is a block diagram of a preferred embodiment of the invention.

The third drawing is a flow chart of the operation of the preferred embodiment of the present invention.

S1. . . Device connection step

S2. . . Verify ID step

S3. . . Start virtual system steps

S4. . . Launch application step

S5. . . Verify access steps

Claims (8)

A data protection method includes the following steps: a device connection step: connecting a verification device to a computer host, wherein the verification device stores an identification ID, and the computer host is provided with an operation system, and The operating system is installed with a starting program, the starting program is connected with an identification ID database, a startup password database and an execution account database, and the operating system is further connected with a virtual system, and the virtual system is connected The connection has a confidential file database and a permission database, and the operating system further has an application installed; the verification identification ID step: when the user connects the verification device to the computer host, the startup program verifies the verification The identification ID stored in the device is compared with the identification ID database to determine whether the identification ID is valid; and the virtual system is started: if the identification ID of the verification device is valid, the startup program may request to input a startup password. And comparing the startup password with the startup password database to determine whether the startup password is correct, if If the password is correct, the virtual system is started; the application step is started: if the identification ID of the verification device is valid, the startup program may request to input an execution account, and the execution account and the execution account database are performed. Comparing to determine whether the execution account is valid, if the execution account is valid, launch the application; verify access rights step: when the application wants to access the confidential file database, the application must The execution account is logged into the virtual system, and the virtual system compares the execution account with the permission database, and determines whether the execution account has the right to access the confidential file database, and if the execution account has access to the secret The permissions of the archive database allow the application to access the confidential archive. According to the data protection method of claim 1, wherein the startup password is pre-stored in the verification device, and is configured to allow the startup program to automatically read the startup password when the virtual system is started. . According to the data protection method of claim 2, the start program is further connected to a second password database, and the startup password is cut into a first startup password and a second startup password, and The first startup password is stored in the verification device, and the second startup password is stored in the second password database, so that when the step of starting the virtual system is enabled, the startup program is automatically read by the verification device. The first startup password, and the second startup password is read by the second password database, and the first startup password and the second startup password are calculated and synthesized into the startup password. According to the data protection method of claim 1, wherein, when the application step is started, the startup program further requires an execution password to be entered, and the execution password is performed with the execution account database. The comparison is to determine whether the execution password matches the execution account, and the application can be started if the execution password matches the execution account. According to the data protection method of claim 4, the execution account and the execution password are pre-stored in the verification device, and the start program is automatically read when the application step is started. Take the execution account and the execution password. A data protection method according to claim 5, wherein the initial program is further connected to a second password database, and the execution password is cut into a first execution password and a second execution password, and The first execution password is stored in the verification device, and the second execution password is stored in the second password database, so that when the application step is started, the startup program is automatically read by the verification device. First executing the password, and reading the second execution password by the second password database, and synthesizing the first execution password and the second execution password into the execution password. A data protection method according to claim 1, wherein the verification device is a USB key. A data protection method according to claim 1, wherein the virtual system is installed in the operating system.