TW201738802A - A removable security device and a method to prevent unauthorized exploitation and control access to files - Google Patents

Abstract

A removable security device configured to prevent unauthorized exploitation of files, connectable with a host device, the removable security device comprising a central processor, an operating system, a graphic processor, memories and a communication link configured to exchange data with the host device. The removable security device further comprises an identification module for verifying conformity of at least one user credential received from the host device via the communication link. The operating system enables through a remote desktop agent remote access to at least one file and executes a file processing application with the at least one file. The operating system, the remote desktop agent and the file processing application are stored in a non-volatile memory of the removable security device. The graphic processor generates displayable frames corresponding to the execution of the application with the file. A watermarking module coupled to the graphic processor inserts additional data into the displayable frames, said additional data forming a watermark generated on all or part of the displayable frame. The additional data allows retrieving at least the identifier of the removable security device. The communication link transmits the watermarked displayable frames to the host device.

Description

Detachable security device and method for preventing unauthorized use and control access of files

The present disclosure is generally related to detachable security devices and methods for preventing unauthorized use and control access to files stored in local or remote storage devices.

A removable security device connectable to the personal computer can be used to authenticate the user of the personal computer to the remote network content server. The removable security device can include a memory storing an interface software program configured to use the encryption/decryption key generated during the initialization phase. The interface software program is executed on a personal computer for interfacing the personal computer to the content server via the network. The encryption/decryption key is used by the interface software program to authenticate the user of the personal computer to the content server and to establish a secure connection between the personal computer and the content server. The removable security device can be connected to a personal computer via a standard USB (Universal Serial Bus) link.

Since the memory system of the removable USB device can be overwritten, the interface software program can be configured to write any temporary file in the position of the removable USB device memory instead of writing during connection to the personal computer. Go to the standard temporary folder of your PC. This ensures that after the secure connection to the content server is closed and after the removable secure USB device is removed, the temporary file without confidential information remains on the personal computer and thus provides enhanced security against the hacker. .

The detachable security device can be based on a "USB powered computer" device, for example based on a device known as "USB armory". This type of detachable device can be designed to be connected to a USB port of a personal computer that provides power and a two-way serial data link between the personal computer and the detachable device. In addition to the rewritable memory for storing application software programs and related materials, the detachable security device can include a central processing unit and an operating system. The operating system management application software program stored in the non-volatile memory and the bidirectional serial data link.

In accordance with an embodiment, a detachable security device is disclosed that is configured to prevent unauthorized use of computer files stored in a local or remote storage device.

In accordance with another embodiment, a method is disclosed for preventing unauthorized access to computer files from a host device associated with a detachable security device.

According to one example of a detachable safety device, the disclosed The unloading safety device can be based on a "USB powered computer" device. This type of detachable device can be designed to be connected to a host device via a USB (Universal Serial Bus), which provides power to the detachable device and provides between the host device and the detachable device. Bidirectional serial data link.

A removable USB security device or a USB powered computer has the advantage of being able to be presented as a variety of USB devices, such as an external plug-in type having a USB type communication port, to be inserted into any host device having a corresponding USB port. . It can be used for other types of communication, such as Apple Lightning, FireWire IEEE 1394, etc. According to a further embodiment, the detachable security device can be powered by other sources of the USB port of the non-host device, such as an internal battery or an external power supply.

The host device may preferably be a portable personal computer (PC), also referred to as a laptop, or a desktop personal computer coupled to a display screen. Other portable devices such as tablets, smart phones, personal digital assistants (PDAs) or pocket PCs can also be used as host devices.

According to a first embodiment, the detachable security device can include components including at least one processor, memory, and a communication link configured to exchange data with the host device. The operating system stored in the memory of the removable security device manages these components and the various applications described below. For example, by using an SSH (Secure Shell) connection via USB or by using a remote desktop display (for example, by using Microsoft® RDP (Remote Desktop Protocol)), on the host device and The communication link between the detachable security devices can be managed by the host device to allow interaction between the host device and an application running on the detachable security device. Such a removable safety device Designed to be secure and provide a secure internal working environment for storing and editing files. Applications (eg, word processing, forms, presentations, etc.) can be used to process files in a removable security device.

According to a second embodiment, the removable security device can further include a network interface configured to communicate with the network resources of the local network or a public network such as the Internet using the network connectivity of the host device. The network resources can include a remote server, virtual drive, or database that can be accessed by the host device through a removable security device for extracting and storing files. The removable security device can thus be recognized by the host device as, for example, having an effective network resource attached to the shared network drive. For processing by an application of a removable security device, the file can be downloaded from the remote server into the memory of the removable security device and stored in the memory and/or uploaded from the memory after processing. Go to the remote server.

In several embodiments, the file is processed without being stored on the host device, preventing copying to another external memory or drive. The detachable security device allows files to be used on host devices without software and copyright protection to prevent potential leaks.

However, conventional anti-copy measures cannot include a screenshot of the content displayed by the host device or for capturing protection corresponding to the displayed image. For example, a screenshot or screen capture can be performed using an application of the host device, or a camera of a smart phone can be used to capture all or part of the content. The host device can be modified to redirect the signal from the display to the signal recording module for capturing the digital signal corresponding to the displayed content.

As an illustrative aspect of the disclosed method and apparatus, the frame can be displayed on the screen of the host device by integrating the information into a displayable frame generated by the removable security device to provide anti-copy protection. The integrated information can be used to identify a removable security device associated with an unauthorized copy of a displayable frame (eg, a screenshot or image capture). This information is best not visible to the user. The detachable security device is referenced by a unique identifier registered in the database, which can also be used by the database to correlate with the user profile. This information, referred to hereinafter as a watermark, may not prevent unauthorized copying (eg, screen capture), but may be capable of identifying the removable security device associated with the host device displaying the copied frame. In addition, the watermark may also include the identifier and time data of the host device.

According to an embodiment, the watermark may be a code that allows at least the identifier of the removable security device in the database to be retrieved.

10‧‧‧Removable safety device

20‧‧‧Host device

30‧‧‧Tracking server

40‧‧‧Database

100‧‧‧ central processor

101‧‧‧Operating system

102‧‧‧ memory

102'‧‧‧ random access memory

103‧‧‧Encryption/Decryption Module

104‧‧‧Graphic processor

105‧‧‧Watermark module

106‧‧‧ Identification module

107‧‧‧Remote desktop agent

108‧‧‧Communication埠

109‧‧‧Network interface

109’‧‧‧Wireless Network Communication Module

109”‧‧‧Wireless Network Communication Module

110‧‧‧Communication link

120‧‧‧File Processing Application

121‧‧‧File Processing Application

130‧‧‧ text file

Figure 1 shows a block diagram of a detachable security device coupled to a host device. The remote desktop agent operating on the host device allows access, display, and editing of the content of the additional material that can be inserted by the watermarking module implemented in the removable security device.

2 shows a more detailed block diagram of a detachable security device connectable to a host device that allows the host device to execute an archival processing application that is stored locally or stored in a remote server. The watermark module inserts the additional data into a displayable frame generated by the graphics processor of the removable security device.

The removable security device of the present disclosure can preferably be connected to a host device via a standard USB (Universal Serial Bus), which has the advantage of providing a fast two-way data communication link with the host device. It may also advantageously provide power to the host device. The standard universal serial data bus can be used, for example, for USB 2.0, USB 3.0, or USB 3.1 types, where different types differ in their throughput, with 480 Mbit/s, 5 Gbit/s, and 10 Gbit/ respectively. The flux of the value of s.

Removable safety device module

The removable security device 10, as illustrated in the block diagram of FIG. 2, may include, for example, a central processing unit 100, a memory 102, a graphics processor 104, a network interface 109, and a communication port 108 (eg, USB port). ) hardware module. The memory can include a plurality of types of memory segments, such as read-only and read/write non-volatile memory 102 (i.e., non-volatile memory), and random access memory 102'.

The detachable security device 10 further includes various software modules that are loaded into the non-volatile memory using the hardware resources of the detachable security device 10. The operating system 101 manages different hardware and software modules. To ensure that the stored software module is secure, the trusted root function can be embedded in the operating system 101, preferably in a hard form. The hardware trusted root provides a higher level of trust than the software trusted root, which is typically more vulnerable to hackers. Trusted roots are provided to ensure detachable security Services (eg, monitoring) of hardware and software integrity are maintained during different modes of operation of device 10 (eg, power, initialization, and general mode of operation).

The software module may include an identification module 106, a file processing application 120, 121, a remote desktop agent 107, an encryption/decryption module 103, and/or a watermark module 105.

The identification module 106 can receive and store at least one user identity code for authenticating the user to access the resources of the removable security device 10.

For example, the file processing application 120, 121 includes a text file editor (such as Microsoft® Word), a slide editor (such as Microsoft® Power Point), or a form editor (such as Microsoft® Excel), or any other file. Create/edit an application. The file processing applications 120, 121 can be managed by the central processing unit 100, which is controlled by the operating system 101 and a dedicated user interface.

The remote desktop agent 107 can be integrated with the operating system 101. The remote desktop agent 107 is configured to perform remote access to at least one file and execution of at least one file processing application (e.g., 120, 121) having the file. The remote desktop agent 107 is also enabled to communicate with the host device 20 and to enable remote access to the file and file processing applications 120, 121 for execution by the host device 20. The remote desktop agent 107 can preferably be embedded in the operating system 101 and protected by a hardware trusted root to prevent any tampering or unauthorized modification (e.g., storing files into the host device 20).

The encryption/decryption module 103 is coupled to the network interface 109 and coupled to the memory 102. When the file is retrieved for processing, the encryption/decryption module 103 encrypts the file before storing and decrypting it. The encryption/decryption operation can be performed by using an appropriate algorithm with a symmetric or asymmetric encryption key. The network interface 109 can be configured to utilize the network connection resources of the host device 20 for exchanging data with the remote server 30 and the repository 40. The exchanged data can be encrypted by the encryption/decryption module 103.

The watermark module 105 is coupled to the graphics processor 104 and can insert additional material into the displayable frame generated by the graphics processor 104. For example, the screen associated with the host device 20 displays a frame. Different embodiments of additional material content and methods of capture will be described below.

According to an embodiment, the removable security device 10 can include a wireless network communication module (e.g., 109', 109" in FIG. 2) associated with the network interface 109. The network interface 109 can be, for example, WiFi module, mobile network communication module such as 3G, 4G, LTE (Long Term Evolution) type module, etc. In some embodiments, the removable security device 10 can be connected to a host device without network communication resources 20. In several embodiments, the wireless network communication modules 109', 109" ensure access by the host device 20 to files stored on the remote server 30 or virtual drive.

Removable safety device operation

The detachable security device 10 coupled to the communication port of the host device 20 can be activated automatically or manually (eg, by means of detachable security) Physical switches, buttons, etc. on the entire device 10. Automatic activation can occur when the removable security device 10 is plugged into the communication device of the host device 20. Enabling may include the step of installing the removable security device 10 as an active network device resource for the host device and exchanging information with the host device 20. The exchanged information can be authenticated to the user of the host device 20. The user interface of the host device 20 can prompt the user to enter an identity code such as a username and password. The identity codes may also be in the form of fingerprints or other biometric data that is input by the user through a dedicated device associated with the host device 20 or through a dedicated device located directly on the detachable security device 10. The identity codes may also include a one-time password (OTP) having a limited validity period associated with the username or user address.

The identity of the identity code can be verified by comparing the user profiles previously recorded in the identification module 106 during the initialization phase of the removable security device 10. When the recorded user data and the entered identity code match, access to the resources of the detachable security device 10 is validated. Through the enabled remote desktop agent 107, the applications and files used to process the files with the host device 20 become operational. Otherwise, access to files and applications is denied when user authentication fails.

According to an example, a standard RDP protocol (Remote Desktop Protocol) can be used for communication over a USB type link. The RDP protocol provides a graphical user interface to connect to another computer via a network connection. The detachable security device 10 can be recognized by the host device 20 as a network device. The RDP protocol can further provide a secure connection by encrypting the data exchanged between the connected devices.

The remote desktop agent 107 stored in the detachable security device 10 provides a user interface on the host device 20. The user interface can be used for file selection and launching of applications to perform the opening and editing of selected files. For example, the text file 130 stored in the read/write non-volatile memory 102 can be opened by the text file editor 120. The desktop agent 107 can facilitate execution of the text file editor 120 and facilitate storage of files once the files are modified in the read/write non-volatile memory 102 without providing a copy of any stored files to the host device 20 The possibility in the memory.

1 illustrates an example in which a file 130 stored in the read/write non-volatile memory 102 of the removable security device 10 is turned on by the execution of the text file editor 120, through the remote desktop agent. 107 provides a corresponding window on the host device 20.

The application 120 operates on an operating system 101 that manages the hardware and software modules of the removable security device 10 and manages the communication link 110 with the host device 20.

The execution of the text file editor 120 with the file archive (by the graphics processor 104) enables the generation of the displayable frame of the watermark by the watermark module 105. At the end of execution by the file of the text file editor 120, the file can be stored in the read/write non-volatile memory 102 of the removable security device 10.

In accordance with an embodiment, in addition to accessing files stored in the read/write non-volatile memory 102 of the removable security device 10, the remote desktop agent 107 may allow for the previous storage at the remote server 30. Medium or Access to files on a virtual drive. The remote desktop agent 107 uses the network resources of the host device 20 and the network interface 109 of the removable security device 10 for accessing files on the remote server 30. According to the preferred mode, the user authentication performed after the activation of the detachable security device 10 also enables the connection of the host device 20 to the remote server 30 via the detachable security device 10, and authorizes the storage of the storage file. take. These files can be encrypted using the user's personal encryption key to prevent unauthorized access by unauthorized users.

During the file processing session, the remotely stored file can be downloaded to the random access memory 102' associated with the central processing unit 100 of the removable security device 10, which is decrypted by the encryption/decryption module 103. And executed by the file processing application 120. At the end of the process, and assuming that a modification of the file has been made, the file can be re-encrypted and stored in the remote storage and/or read/written non-volatile locally in the removable security device 10. In memory 102. Files executed for read-only can be downloaded into random access memory 102' and decrypted for reading, and the remaining files in the remote storage are encrypted. In order to prevent any capture of the file loaded in the random access memory 102', it is preferably deleted from the random access memory 102'. After the end of the file processing application 120, the remote desktop agent 107 can empty the random access memory 102', wherein the file processing application 120 closes and stores the executed file in the removable security device. The read/write of 10 is in non-volatile memory 102 or in remote server 30 or virtual drive.

The above solution can solve the problem that the file is stored in the host device The problem in memory, because only these files are stored on the removable security device instead.

Can display the watermark of the frame

Further, when processing the file, the watermark module 105 modifies the displayable frame generated by the graphics processor 104. The watermark module 105 can insert additional data into at least some of the displayable frames.

When the file processing application 120 executes the pre-determined file, the graphics processor 104 coupled to the central processor 100 generates a displayable frame that will be displayed as an image on the screen of the host device 20. For example, in accordance with the screen update rate criteria, graphics processor 104 generates a 60 frame per second to cause host device 20 to display the content. The watermark module 105 modifies the displayable frame such that image capture made at any time will include additional material. The displayable frame output to the graphics processor 104 will be marked with a watermark by the watermarking module 105, and the watermarking module 105 inserts the additional data into the host device 20 before being delivered to the host device 20 via the communication link 110. The message box can be displayed. The watermarking module can mark each frame or a subset of the frames as having a watermark.

The watermark is preferably invisible to the human eye (invisible) and the watermark is inserted into the displayable frame. For example, a technique based on encoding a video data block of a display frame with additional data by applying a pre-determined watermark algorithm may be used. Therefore, only computer-based image analyzers can localize, extract, and read watermarks from images captured by the host device. For coding The video data block and the image analyzer capable of identifying the encoded video data block and knowing the watermark algorithm can determine the watermark representing the additional data. Depending on the type of the watermarking algorithm, the watermark can be determined by comparing the video data of the captured image with the video data of the reference image without the watermark.

The watermark of the displayable frame allows identification of the source of the copy of the content made, for example, by the screen capture on the host device 20. According to an embodiment, the unique identifier of the detachable security device 10 can be used as additional material. The watermarking of the screen capture content as determined by the image analyzer allows for an understanding of which detachable security device has the content and additional knowledge of the user profile associated with the unique identifier of the detachable security device 10.

Many embodiments may be implemented to provide additional material to be used by the watermarking module 105, namely:

a) The additional information includes the unique identifier of the detachable security device 10. This identifier can be retrieved from the local read-only memory (or non-volatile memory) by the watermark module 105 and inserted into the displayable frame during the watermark processing.

b) Additional material including the unique identifier of the detachable security device 10 may further include a unique identifier of the host device 20. When enabled, during the step of exchanging information with the detachable security device 10, the host device identifier can be received and, for example, it will be stored by the identification module 106 to the read/write non-volatile memory 102. in. The watermark module 105 retrieves the host device identifier from the memory and, for example, connects the host device identifier to the identifier of the removable security device 10.

c) includes the unique identifier of the detachable safety device 10 and / The additional information of the identifier of the host device 20 may also include temporal data and/or session number representing the date and time of the current file processing. The date and time may be received from the host device 20 via the remote desktop agent 107 or provided by the internal clock of the removable security device 10. The dialog number can be retrieved from a conversation counter (eg, embedded in memory associated with the recognition module 106). For example, the dialog counter is incremented each time the user authentication is successful and the conversation is opened.

d) the additional material includes application of the additional data by a reversible mathematical function (for example, by using XOR of the pre-determined parameter, addition, multiplication, or by using a reversible transformation of inversion, exponentiation, etc.) (as in Example a) , b), or c) or a combination thereof, the results provided. This mathematical function is known to the tracking server to capture the contents of the attached material.

e) The additional material includes a code representing an identifier of at least the removable security device 10 from the remote network repository 40. According to an embodiment, user authentication performed on the host device 20 using the detachable security device 10 will enable the network connection of the host device 20 to the tracking server 30 of the management repository 40. The network connection allows the host device 20 to transmit data associated with the removable security device 10 associated with the host device 20, as well as to communicate user data associated with the user whose authentication with the removable security device 10 is successful, to Tracking server 30. The tracking server 30 stores the received data in the database 40 and stores it in the form of a record for a given session. The dialog is defined herein as an interactive data exchange between the detachable security device 10, the host device 20, and the tracking server 30 after successful user authentication. When the user is authenticated each time with the detachable security device 10, the new one The conversation is opened and a new record is created by the tracking server 30 in the database 40.

During the conversation, the host device 20 transmits the user data retrieved from the identification module 106 via the network interface 109 of the removable security device 10 and the communication link 110. For example, the user profile may include a username, password, and other identifying information. The user profile is complete by at least the identifier of the removable security device 10 and by further information such as the identifier of the host device 20, the temporal data, and the session number.

Information relating to the operation of the detachable security device 10 can also be transmitted by the host device 20 to the tracking server 30 for addition to the record in the repository 40. This information may, for example, include an identifier of a file previously processed by the detachable security device 10, file processing time data, an application version and/or reference for processing the file, and the like.

Information relating to the hardware and software configuration of the detachable security device 10 can also be added to the record, for example, type reference or mode identifier of the detachable security device 10, reference to configuration options, memory capacity , reference to installed applications, operating system type and version, etc.

In addition to user data, the encryption key used by the encryption/decryption module to encrypt/decrypt files can also make the record more complete. These keys can be generated by the user using a suitable application on the host device 20.

The recording can be done by using a code that will be used to attach the displayable material to the additional material that is watermarked.

Code generated by the tracking server

According to an embodiment, the code can be generated by the tracking server 30 and added to the record of the repository 40. The code can be a random number associated with the record or a digest obtained by applying the hash function or any mathematical function of all or part of the recorded data.

According to this embodiment, when the file is executed by the application of the removable security device 10 via the remote desktop agent 107, the watermark module 105 transmits a request to the tracking server 30 for obtaining the code from the database 40. . The request may thus be delivered to the tracking server 30 by the watermarking module 105 via the network resources of the network interface 109, the communication link 110, and the host device 20. The request may include at least an identifier of the removable security device 10 and an instruction to allow the retrieval code to be in the corresponding record of the database 40.

When the detachable security device 10 is used by more than one user, the request may additionally include an identifier of the user that has been recorded by the tracking server 30 at the time of authentication. The identifier of the user can be retrieved from the recognition module 106 by the watermark module 105 and transmitted to the tracking server 30 along with the identifier of the removable security device 10, which will return the corresponding code.

In response to the request, the detachable security device 10 thus receives the code from the tracking server 30 via the network resources of the host device 20, the communication link 110, and the network interface 109 of the detachable security device 10. The code is then stored in the memory 102 of the removable security device 10 and is available to the watermark module 105.

For each session, the tracking server 30 generates a new code that is added to the record in the database 40, and the watermark module 105 transmits the request to the chase. The trace server 30 is configured to receive the code from a database record corresponding to the current session.

According to a further embodiment, the detachable security device 10 can request the tracking server 30 to transmit the code and all remaining data contained in the repository 40 associated with the current conversation. The received data can be stored in the non-volatile memory 102 of the detachable security device 10 for use in an offline mode in which the host device 20 is not connected to the tracking server 30 and the database 40. .

When the file is executed by the application, all or part of the displayable frame generated by graphics processor 104 will be marked as having a watermark in accordance with the code.

Code generated by a detachable safety device

According to a further embodiment, the code can be generated by the detachable security device 10 instead of the tracked server 30 and stored in the non-volatile memory 102 of the detachable security device 10 and stored in the database 40. .

In this case, the watermarking module 105 transmits an instruction to the tracking server 30 to store the generated code into the record of the database 40 corresponding to the current conversation. The instructions include at least an identifier of the detachable security device 10 that is used to find a record in which to store the code. The identifier of the removable security device 10 can be transmitted by the host device 20 to the tracking server 30 and stored in the database record at the beginning of the session.

The command can also contain the user's identifier as a detachable Additional parameters for the identifier of the safety device 10. After successful authentication, the watermark module 105 obtains the identifier of the user by interrogating the identification module 106 that has stored the user identity code. The watermarking module 105 thus transmits instructions to the tracking server 30 via the network resources of the network interface 109, the communication link 110, and the host device 20 to store the records previously generated in the corresponding user identifiers. Code. In fact, the user's identifier is transmitted by the host device 20 to the tracking server 30 and stored in the database record at the beginning of the session.

For each session, the removable security device 10 generates a new code that is transmitted by the watermarking module 105 to the tracking server 30 for storage in the database record corresponding to the current conversation.

According to a further embodiment, the detachable security device 10 may request the tracking server 30 to transmit all of the material contained in the repository 40 that is relevant to the current conversation. The received data can be stored in the non-volatile memory 102 of the detachable security device 10 for use in an offline mode in which the host device 20 is not connected to the tracking server 30 and the database 40. .

Once transmitted to the tracking server 30 for storage in the database 40, the code stored in the removable security device 10 can be directly used by the watermarking module 105 for watermarking the displayable frame.

Code protection

According to a further embodiment, the code transmitted by the tracking server 30 to the detachable security device 10 (or vice versa) can be used to track The server 30 is encrypted with the key of the removable security device 10. This encryption prevents misuse of the code, for example, it is intercepted and modified by the host device 20 during transmission between the tracking server 30 and the detachable security device 10.

According to a further embodiment, to prevent modification of the captured code and to avoid the use of the modified captured code for a watermark, the transmission code may be signed. For example, the signature of the code can be calculated by applying a one-way collision-free hash algorithm (eg, MD5 or SHA type) to obtain an abstract. The encryption algorithm can then be applied to the abstract by using a key known to the tracking server 30 and the detachable security device 10 to generate the signature. The set formed by the code and the signature can then be transmitted. For example, the signature verification application of the removable security device 10 operating system verifies the signature of the code before the processing application 120 executes the file. In the case where the digest using the key decryption is mismatched with the recalculated digest using the code, the code is not accepted by the detachable security device 10, and the file processing is blocked by the signature verification application.

Code analysis

The code inserted by the watermark module 105 as a watermark can be extracted by analyzing the displayed image. The image may be captured from the display by the screen capture application of the host device 20 or by outputting any of the corresponding digital signals from the host device 20. The camera can also be used to perform a screen capture, and the captured image is output from the camera to the image analyzer. By knowing the watermarking technology used, the image analyzer can extract floating water from the image. Print and convert the extracted watermark into a code.

The obtained code can then be submitted to the database 40 for retrieval of at least the identifier of the removable security device 10. Further information related to the user (e.g., the user's identifier, time data, and other data received by the tracking server 30 from the host device 20) allows identification of the origin of the displayable frame.

The tracking server 30, the server that stores the file, and the database 40 can form a single remote server entity dedicated to the management of the removable security device.

According to a further embodiment, the type reference may be added to the additional material for defining the additional material under discussion according to the embodiment a), b), c), or d) based on the identifier or representative according to embodiment e) The code of the identifier is allowed to be retrieved from the database 40. For example, a leading bit 0 may indicate additional material based on a valid identifier, and leading bit 1 may indicate additional material represented by the code.

Design example of detachable safety device

The detachable security device 10 can be designed as an external connector that can be connected to a wide variety of host devices 20 by using a universal communication port. For example, the external plug-in can be provided with a USB or micro USB connector that fits into the corresponding jack of most portable computers or mobile devices. The appropriate operating system and appropriate communication protocols implemented in the add-on and supporting the file processing application ensure compatibility of the external plug-in with the most commonly used host device.

10‧‧‧Removable safety device

20‧‧‧Host device

101‧‧‧Operating system

105‧‧‧Watermark module

107‧‧‧Remote desktop agent

108‧‧‧Communication埠

110‧‧‧Communication link

120‧‧‧File Processing Application

130‧‧‧Text file

Claims (13)

A detachable security device configured to prevent unauthorized use of a file, connectable to a host device, the detachable security device comprising a central processing unit, an operating system, a graphics processor, a memory, and a configuration a communication link for exchanging data with the host device, the removable security device further comprising: an identification module configured to verify consistency of at least one user identity code received from the host device via the communication link, And for storing the at least one user identity code in the memory associated with the identification module, the operating system configured to enable remote access of at least one file through the remote desktop agent, and For executing a file processing application having the at least one file, the operating system, the remote desktop agent, and the file processing application are stored in a non-volatile memory of the removable security device, a graphics processor configured to generate a displayable frame corresponding to execution of the application having the file, and a watermarking module coupled to the graphics processor, the watermark The set is configured to insert additional data into the displayable frame, the additional data forming a watermark of at least all or part of the generated displayable frame, the additional data allowing at least the removable security device to be retrieved An identifier, the communication link configured to transmit the watermarkable display frame to the host device. The detachable security device of claim 1, wherein the detachable security device further comprises an encryption/decryption module configured to be stored in the memory The file is previously encrypted and decrypted prior to execution by the file processing application, the encryption/decryption module using the user's personal encryption previously stored in the memory of the removable security device key. The detachable security device of claim 2, further comprising a network interface coupled to the encryption/decryption module and the identification module, the network interface configured to utilize the host device Network connection resources. The detachable security device of claim 1, wherein the additional material to be inserted into the displayable frame comprises an identifier of the detachable security device, the identifier being stored in the detachable In the non-volatile memory of the safety device. The detachable security device of claim 1, wherein the additional material to be inserted into the displayable frame comprises an identifier of the host device, the identifier being from the host device via the communication link Received and stored in the memory of the recognition module. The detachable security device of claim 4 or 5, wherein the additional material to be inserted into the displayable frame further comprises time data representing a date and time of current file processing, the temporality The data is received from the host device via the communication link or the remote desktop agent or provided by an internal clock of the detachable security device. The detachable security device of claim 6, wherein the additional material to be inserted into the displayable frame comprises a result provided by a reversible mathematical function, the reversible mathematical function being applied to the detachable The identifier of the security device, the identifier of the host device, and the time resource On or in combination. The detachable security device of claim 3, wherein the additional information to be inserted into the displayable frame comprises allowing the removable security device to be retrieved from a database associated with the remote server. At least the code of the identifier. A method for preventing unauthorized use of a file, the file being accessible under the control of a removable security device, the removable security device being connectable to a host device, the removable security device comprising a central processing unit, An operating system, a graphics processor, a memory, and a communication link configured to exchange data with the host device, the method comprising the steps of: verifying, via the communication module, the identification module of the removable security device The at least one user identity code received by the host device is stored, and the at least one user identity code is stored in the memory associated with the identification module, and the remote desktop proxy is used by the operating system Configuring a remote access of at least one file and executing a file processing application having the at least one file, the operating system, the remote desktop agent, and the file processing application being stored in the detachable In the non-volatile memory of the security device, the display processor generates a display frame corresponding to the execution of the application having the file, by being coupled to the image The watermark processor module, additional information may be inserted into the display information box, all of the additional watermark data is formed on the portion of the frame may display information generated in or, at least the additional information to allow The identifier of the detachable security device is retrieved, and the watermarkable display frame is transmitted to the host device via the communication link. The method of claim 9, wherein the file is stored in a non-volatile memory implemented in the detachable security device. The method of claim 9, wherein the file is stored in a remote server associated with the communication network, the removable security device further comprising allowing access to the remote server via the communication network The network interface is connected to the network by utilizing the network of the host device. The method of claim 9, wherein the method further comprises an encryption step of the encryption/decryption module of the removable security device, the step for storing in the local non-volatile memory or the remote The file is previously encrypted in the server and decrypted prior to execution by the file processing application, by using a user's personal encryption key previously stored in the memory of the removable security device This encryption and decryption. The method of claim 11, wherein the watermark module inserts additional data into the displayable frame, the additional data comprising allowing the detachable data to be retrieved from a database associated with the remote server At least the code of the identifier of the safety device.