TW202119244A - Disc security system - Google Patents

Abstract

The present invention proposes a novel disc security system, the system structure comprises: processor module, providing the management and operation of computing resources between the system elements; bitlocker disc administer module, providing for the administration of the bitlocker discs and the confidential documents; bitlocker disc drive module, coupling with the bitlocker disc administer module and connecting the bitlocker disc on the processor module, which make the processor module could access the confidential documents; security drive module, coupling with the bitlocker disc drive module, preventing the unpermitted access of confidential documents stored in the bitlocker disc, and, bitlocker disc authentication module, coupling with the bitlocker disc administer module to authenticate the virtual disk or the confidential file when the virtual disk is booted or accessed.

Description

Disk Information Security System

The present invention relates to an information security system. In more detail, it is a method by which files are stored on bit-locked disks and must pass software and hardware encryption authentication when accessing, so as to prevent files from being illegally backed up. Information security protection system for sabotage, or side-channel attack.

With the development of computer technology, modern people use computers or various terminals as operating tools in work, study, scientific research or other applications, especially in enterprises, government units, financial institutions, and military units. Electronic archives. However, in the information age, as long as it involves important electronic files with significant value regardless of business, strategy, military, intelligent creation, etc., there is a possibility of leakage due to inadvertent internal management of the organization, or the possibility of external attacks. For example, from the organization's internal illegal backup, destroying electronic files, or physically entraining storage devices containing electronic files to the outside, and then attacking or stealing from external terminals through the network, and then making the enterprise or organization bear the benefits On the loss. In addition, because the operating system of modern computers can accommodate multiple user accounts, or network server sharing, when multiple users share at the same time, it is necessary to distinguish various documents with different levels of confidentiality.

In the past information security system architecture, for example, Chinese Patent CN102708335, which discloses a protection system for confidential documents. In this system architecture, it reveals an application based on a sandbox program (SandBox), and the client downloads the secret-related files stored on the server into the sandbox program for processing. In the '335 case, after connecting with the server, the client downloads the secret-related files to a sandbox program that is isolated from the physical magnet for limited editing, for example, those accessible according to permission settings Actions, such as writing, reading, copying, and deleting, have the effect of preventing the client from sending out secret-related documents to external terminals, and the information security has indeed improved the level of information security protection of the organization or enterprise. However, as mentioned above, the '335 case did not have the service to identify the encrypted file belongs to. The technical characteristics of the server and the client have led to possible security vulnerabilities in the client. For example, physically removing the storage device in the terminal with the client system (such as removing the computer directly) , The hard disk where the client is located), and the storage device is installed on another terminal (for example, the removed hard disk is installed on another computer), but the secret file can still be stored in the client After the client is connected to the server, it can be used on a third-party client; for another example, the '335 case did not restrict the remote connection of the third-party terminal. When secret files, although it is indeed impossible to back up the secret files to a third-party terminal connected to the client remotely due to the restriction mechanism in the sandbox program, the third terminal still has the opportunity to use its own screenshot function. Record the contents of confidential documents (for example, when using a third-party terminal to do remote connection through TeamViewer, Anydesk, ShowMyPC, UltraVNC, or Splashtop, or even the back door of the operating system, use the third-party terminal screen The function of taking screenshots, instead of directly copying by the client, records the content of secret files, so as to circumvent the client's restriction mechanism in the sandbox program).

For information security, some applications, such as Encrypted Device Application (EDA), can encrypt a specific file space and store the encrypted files on an isolated disk. Isolated disks can use different encryption algorithms to save user information to avoid malicious attacks from viruses or hackers. In the conventional technology, in the process of creating an encrypted file, the encryption device application encrypts the file according to the password set by the user. In the process of processing encrypted files, the encryption device application also determines whether the password is correct to determine whether to set the encrypted file as an isolated disk. Because the file is only encrypted according to the single password set by the user. The password is very likely to be cracked by others, making the encrypted file available to others. In addition, since the conventional isolated disk does not have any control mechanism, it cannot provide different users with access flexibility. In addition, since the conventional isolated disk management mechanism cannot identify the host to which the encrypted file belongs, the encrypted file may also be copied to other hosts for use.

Therefore, at the current point in time, there is still a need for further improvements to the existing isolated disk-based information security applications to avoid files on the isolated disk, by physically moving the storage device, or through the source An unknown remote connection uses the isolated disk as a springboard to steal the file data in the isolated disk, causing losses to the enterprise or organization.

In view of this, in order to solve the above-mentioned problems, the objective of the present invention is to establish a Bitlocker disk through the protection policy (protection authority) established in the enterprise or organization, and store it on the Bitlocker disk. The secret-related documents cannot be accessed by terminals without the system of the present invention. The secret-related documents may include, for example, word, excel, autocad, VB files, etc. For example, if the E disk is set as the first bit lock disk, according to the possible protection policy, the confidential files in the E disk cannot be stored on other disks, such as the C disk or the D disk No other content can be written or deleted.

In order to achieve the above goals, the present invention proposes a disk information security system. The system architecture includes: a processing module, processing system computing resources, and coordination and operation among system components; bit-locked disk management module, start bit Metalock authentication manages the secret files stored in the bitlock disk, and manages the number of bitlock disks and the creation of the bitlock disk; the bitlock disk drive module is coupled to the above The bit-lock disk management module, which couples the bit-lock disk to the processing module, so that confidential documents can be accessed by the processing module; the protection drive module, which is coupled to the bit-lock disk drive module , To prevent secret documents stored in bit-locked disks from being stored on disks other than bit-locked disks, or to prevent File Explorer or other applications from storing unauthorized documents and programs in the stated location Meta-lock disks, or copy, preview, delete, and print without permission, and delete the contents of the secret-related files in the memory after the secret-related files are closed for a predetermined period of time; and, bit-lock disks The authentication module, coupled to the bit-lock disk management module, authenticates the protection authority of the bit-lock disk or the secret-related file when the bit-lock disk accesses the secret-related file. Metalock includes the bit-lock disk key, and the hardware key. According to the needs of the application, you can choose to use one of the two for encryption or both of the above for encryption according to the needs of the application. . In addition, each bit-locked disk can contain several secret-related files, so that the bit-locked disk can protect different secret-related files in accordance with the protection authority.

According to the content of the present invention, the disk information security system includes a public library module, coupled to the protection drive module, and stores the path address of the secret file in the bit-lock disk (for example, E:\A.PPTX) , E:\B.PPTX, E:\C.PPTX), for the bit-lock disk management module to access the secret files stored in the bit-lock disk; and a letter to protect the operation of the drive module Style file. Among them, the file format in the above-mentioned public library module can be a dynamic-link library (DLL), which improves the compatibility of the bit-locked disk information security system.

According to an embodiment of the present invention, the above-mentioned bit-lock disk authentication module includes a bit-lock disk authentication unit, which stores a bit-lock disk key, the length of which can be a 32-bit, 64-bit, 128-bit, 256-bit, or 512-bit client identification code (PIN Code) to adjust the security level of the bit lock disk key according to the application environment.

According to the content of the present invention, the above-mentioned bit-lock disk authentication module includes a hardware authentication unit that stores a hardware key to authenticate a specific bit-lock disk corresponding to the bit-lock disk security system , To prevent the physical storage device where the bit-lock disk is located from being physically removed, and install it with a computer device without a hardware authentication unit to access the contents of the secret files in the bit-lock disk. The authentication method of the above-mentioned bit-lock disk key may be a bit-lock (BitLocker)-based authentication method.

According to an embodiment of the present invention, the above-mentioned hardware authentication unit may be a trusted platform module (Trusted Platform Module, TPM), and the encryption algorithm of the bit-locked disk key may be an asymmetric algorithm , Or symmetrical algorithm, so that even if the storage device for storing secret-related documents flows out of the enterprise or organization, the contents of the secret-related documents cannot be accessed by terminals that have not deployed a disk information security system.

According to the content of the present invention, the disk information security system includes a protection authority module coupled to the protection drive module to set the protection authority range of the protection drive module, including: whether to allow storage in the bit-lock disk. Confidential documents are stored on a disk other than the bit-lock disk; whether File Explorer or other applications are allowed to store unauthorized documents and programs on the said bit-lock disk; whether the secret files are in After the end of access, immediately or within a predetermined period of time, delete the contents of the secret-related files in the memory; or a combination of the above functions.

According to the content of the present invention, the disk information security system includes an input source authentication module coupled to the processing module to identify the input source, such as a keyboard, a mouse, a writing pad, or a controller as a local or remote controller. And through the protection scope of the protection drive module, set whether to allow its input source to access confidential documents.

The above is used to explain the purpose, technical means and achievable functions of the present invention Effective, people familiar with this technology in the relevant field can understand the present invention more clearly through the following examples of demonstrations and accompanying schematic descriptions and the scope of patent applications.

A-F‧‧‧Situation

200‧‧‧Disk Information Security System

201‧‧‧Processing Module

209‧‧‧Input source authentication module

210‧‧‧Disk

210A‧‧‧First Bit Lock Disk

210C‧‧‧Second bit lock disk

210N‧‧‧Nth bit lock disk

211‧‧‧Bit Lock Disk Management Module

213‧‧‧Bit Lock Disk Drive Module

215‧‧‧Bit Lock Disk Authentication Module

215A‧‧‧Hardware Certification Unit

215C‧‧‧Bit Lock Disk Authentication Unit

221‧‧‧Protection Authority Module

223‧‧‧Public Library Module

223A‧‧‧Protection drive function unit

225‧‧‧Protection drive module

501‧‧‧Secret Documents

503‧‧‧Hardware Key

505‧‧‧Bit Lock Disk Key

601A‧‧‧plain text

603A‧‧‧Key

605A‧‧‧Ciphertext

601B‧‧‧plain text

603B‧‧‧Key

605B‧‧‧Ciphertext

The detailed description of the present invention and the schematic diagrams of the embodiments described below should make the present invention more fully understood; however, it should be understood that this is only used as a reference for understanding the application of the present invention, and does not limit the present invention to a specific implementation. In the case.

Figure 1 illustrates the specific protection performance that the disk information security system wants to achieve, and the corresponding scenarios that may be attacked or leaked.

Figure 2 shows the component architecture of the disk information security system.

Figure 3 shows the detailed component structure of the disk management module and how the present invention encrypts the disk as a bit-locked disk.

Figure 4 further illustrates the detailed component structure of the public library module and the relationship with surrounding components.

FIG. 5 illustrates how to use a hardware key and a bit-locked disk key to encrypt a secret-related file in an embodiment of the present invention.

Figure 6A illustrates one of the steps of how to encrypt a secret-related file in an embodiment of the present invention.

FIG. 6B illustrates another step of how to encrypt a secret-related file in another embodiment of the present invention.

The present invention will be described in detail with preferred embodiments and viewpoints. The following description provides this Invent specific implementation details so that readers can thoroughly understand how these embodiments are implemented. However, those skilled in the field must understand that the present invention can also be implemented without these details. In addition, the present invention can also be applied and implemented by other specific embodiments. The details described in this specification can also be applied based on different needs, and various modifications or changes can be made without departing from the spirit of the present invention. . The present invention will be described in terms of preferred embodiments and viewpoints. Such description is to explain the structure of the present invention, and is only for illustration and not to limit the scope of patent application of the present invention. The terms used in the following description will be interpreted in the broadest reasonable manner, even if they are used in conjunction with the detailed description of a specific embodiment of the present invention.

In the present invention, the processing module (201) generally includes processing chips, memory, display devices, network communication modules, storage devices, operating systems, firewalls, file managers, and applications, etc. Known methods are interconnected to perform operations, temporary storage, display and data transmission, and provide functions such as near-end or remote terminal operation and management coordination, and the aforementioned access to secret files (501), It can include writing, reading, previewing, copying, deleting, or printing. In addition, in the present invention, in order to explain how to encrypt the secret file (501) required by the algorithm, in different embodiments, the key (603A) and the key (603B) can be used as required. Applied to the hardware key (503), and the bit-lock disk key (505), the same, the plain text (601A), plain text (601B), cipher text (605A), cipher text (605B) , Refers to the state before and after encryption; the first bit lock disk, the second bit lock disk, and the Nth bit lock disk can be collectively referred to as bit lock disks in this field Those skilled in the art can understand that after reading the description, such descriptions are only used for explanation and not for limiting the present invention, which is described here first.

Please refer to FIG. 1, the performance of the disk information security system (200) proposed by the present invention, in addition to improving the lack of conventional technology, is also as described in the scenarios (A)-(E). The efficiency of secret files (501) from internal outflow. In scenario (A), the disk security system (200) can be used to prevent a remote connection, or unknown port, by controlling a local input device, such as a keyboard, mouse, handwriting pad or controller, To access the secret file (501), the access actions include writing, reading, copying, deleting, printing, previewing, etc., for example: by TeamViewer, Anydesk, ShowMyPC, UltraVNC, Splashtop, or Button wizard, controller plug-in program, control the local input device; in scenario (B), prevent the storage device or memory inside the enterprise or organization from being physically removed and installed on another external terminal In-device execution makes the conventional sandbox program (SandBox) based on isolated disks useless; in scenario (C), the local terminal is prevented from being started by the operating system installed on another storage device, bypassing Through the protection mechanism of the present invention, read the secret-related files (501); in scenario (D), prevent the secret-related files (501) from being copied to other storage devices, such as hard disks, flash drives, and CD-ROMs. , Floppy disks, or soft-end terminals, and e-mails; in the context (E), according to different protection rights, prevent unauthorized actions from accessing the confidential files (501), such as writing, reading Actions such as fetching, copying, or deleting; and, in the context (F), prevent the confidential document (501) from being printed without permission.

Please refer to FIG. 2. In order to achieve the above objective, the present invention proposes a disk information security system (200). The system architecture includes the utilization of a processing module (201), processing system computing resources, and coordination and operation among system components; The present invention includes a bit-lock disk management module (211), which activates the authentication of the bit-lock, manages the secret files (501) stored in the bit-lock disk, and manages the number and location of the bit-lock disk Creation of a meta-lock disk; the bit-lock disk drive module (213) is coupled to the above-mentioned bit-lock disk management module (211), and the bit-lock disk is coupled to the processing module (201) , So that the secret files (501) can be accessed by the processing module (201); the protection drive module (225) is coupled to the bit-lock disk drive module (213) to prevent storage on the bit-lock disk The secret-related documents (501) are stored on a disk other than the bit-locked disk, or to prevent File Explorer or other applications from storing unauthorized documents and programs on the said bit-locked disk, Or copy, preview, delete, print without permission, and delete the content of the secret file (501) in the memory after the secret file (501) is closed for a predetermined period of time to prevent side channel attacks from the memory And, the bit-lock disk authentication module (215), coupled to the bit-lock disk management module (211), authenticates the bit when accessing the secret file (501) or the bit-lock disk Meta-lock disks or secret-related files (501) have the protection authority, and the disk security system (200) can be deployed in the near end of any terminal or the remote processing module (201). In addition, the bit lock includes a bit lock disk key (505) and a hardware key (503). According to the needs of the application, you can choose to use one of the two when encrypting confidential documents. One is for encryption, or both are used for encryption.

According to the content of the present invention, the disk information security system (200) includes an input source authentication module (209) coupled to the processing module (201) to identify the input source, such as a keyboard, a mouse, a writing pad, or The controller is either a near-end or a remote-end, and through the protection scope of the protection drive module (225), it sets whether to allow its input source to access the secret file (501), so as to avoid the situation (A), a remote Terminal, or unknown port, by controlling the local input device, such as keyboard, mouse, handwriting pad or controller, to access the disk security system (200), for example: by TeamViewer, Anydesk , ShowMyPC, UltraVNC, Splashtop, or through the button wizard, controller plug-in, control the local input device In addition, the remote terminal screen screenshot function is used to circumvent the protection mechanism in the protection authority module (221).

Please refer to Figure 3, which illustrates how the present invention encrypts the disk (210) into a bit-locked disk. According to the embodiment of the present invention, in the bit-lock disk management module (211), the disk (210) can be encrypted as a bit-lock disk by bit-lock encryption according to the needs of the application, and the application can be managed The required quantity, such as the creation of the first bit lock disk (210A), the second bit lock disk (210C), to the Nth bit lock disk (210N) and other N bit lock disks, each A bit-locked disk can contain one to several secret-related files (501). Among them, the above-mentioned different bit-lock disks can be set to different protection permissions through the protection permission module (211) according to the needs of access. For example, in the first bit-lock disk (210A), because The confidential document (501) is highly sensitive, so the allowed access actions can be set to read and preview, but writing, copying, deleting and printing are not allowed; in addition, the disk is locked in the second position In (210C), because the confidential document (501) is slightly less sensitive, it is allowed to read, preview, and print, but it is not allowed to delete, write, or copy. The protection authority setting can be based on the application Demand adjustment is not limited to it. In addition, because each bit-locked disk can contain several secret files (501).

Please refer to Figure 4. In the public library module (223), the path address of the secret file (501) in the bit-locked disk is stored (for example, E:\A.PPTX, E:\B. PPTX, E:\C.PPTX), only after passing the authentication of the bit-lock disk authentication module (215), can you access the content stored in the bit-lock disk. In addition, in the content of the present invention, the above-mentioned path address, the content of the secret file (501) in the bit-locked disk, or the virtual disk is coupled by the bit-locked disk drive module (213) The actions connected to the processing module (201) can be encrypted by the bitlocker-based method by the bitlock disk authentication module (215). In addition, in an embodiment of the present invention, the public library module (223) includes a protection drive function unit (223A), which records access to read, preview, print, delete, write, copy, etc. The protection authority setting function can be updated as needed, and the protection drive module (255) will be notified to start when the secret file (501) is accessed. Among them, the above-mentioned public library module (223) The file format can be a dynamic link library (Dynamic-Link Library, DLL) to improve the compatibility of the disk information security system (200), so that it can protect confidential files (501) in any format, including Computer programs, design drawings and files.

1 and 5, in the content of the present invention, the bit-lock disk authentication module (215) includes a hardware authentication unit (215A) and a bit-lock disk authentication unit (215C), which respectively have hardware Key (503) and the bit-lock disk key (505) to encrypt the content of the secret-related file (501), and to authenticate the bit-lock disk startup process. Among them, the encryption and authentication method of the hardware key (503) and the bit lock disk key (505) is a bit lock.

In an embodiment of the present invention, if the hardware authentication unit (215A) is a trusted platform module (TPM), the processing module (201), as well as the secret file or the bit-locked disk store a hard disk The physical key (503), so that the processing module (201) can have specificity with the bit-lock disk, so that the storage device or memory of the enterprise or organization storing the bit-lock disk cannot be physically removed And install it in another external terminal for execution. Among them, in the embodiment of the present invention, the above-mentioned trusted platform module can store the hardware key (503) in the processing chip, memory, display device, etc. in the processing module (201) according to the needs of the application. A network communication module, a storage device, or at least two of the above components are used to achieve one of the purposes of the present invention to improve the conventional technology. Among them, the encryption algorithm of the hardware key (503) can be an asymmetric algorithm or a symmetric algorithm. Preferably, it can be RSA, Eigamal, Difei-Halmann key exchange protocol, elliptic curve Encryption algorithm, AES algorithm (Advanced Encryption Standard, or Rijndael), DES (Data Encryption Standard), 3DES (Triple Data Encryption Algorithm), Blowfish, IDEA (International Data Encryption Algorithm), RC5, RC6, etc., and the first One bit lock disk (210A), second bit lock disk (210C), and Nth bit lock disk (210N) can apply different encryption algorithms according to different protection rights.

In another embodiment of the present invention, the bit lock disk key (505) can be a 32-bit, 64-bit, 128-bit, 256-bit, or 512-bit PIN code ), when you want to access a secret file (501) or a bit-locked disk, you can also lock the first bit to the disk (210A) and the second bit to lock the disk (210C) according to the needs of the application. And the Nth bit lock disk (210N), according to different protection rights, apply the above user identification code to different encryption algorithms, such as RSA, EIGamal, Difei-Halman key exchange protocol, elliptic curve Encryption algorithm, AES algorithm (Advanced Encryption Standard, or Rijndael), DES (Data Encryption Standard), 3DES (Triple Data Encryption Algorithm), Blowfish, IDEA (International Data Encryption Algorithm), RC5, RC6, etc.

Please refer to FIG. 6A. In one of the encryption embodiments of the above-mentioned hardware key (503) and the bit-locked disk key (505), the encryption method can be by an encryption method corresponding to the plaintext (601A) The key (603A) encrypts the secret-related document (501) into a ciphertext (605A) through an exclusive OR (XOR) operation. Among them, the above-mentioned plaintext (601A) and key (603A) can each be an NxN matrix according to the needs of the application, each element of which can correspond to mutually exclusive OR operation, for example, in the plaintext (601A) The element a ₄₄ of can correspond to the k _{44 in the key (603A), and form the element b 44} in the ciphertext after mutual exclusion or operation. In addition, in one aspect of the present invention, the above encryption method can be Applied to the hardware key (503) and the bit-lock disk key (505), it can also be encrypted multiple times, not only once, so as to make the secret files stored in the bit-lock disk (501) Avoid leaks caused by outflows from enterprises or organizations as described in scenarios (A)-(E).

Please refer to FIG. 6B. In another encryption embodiment of the above-mentioned hardware key (503) and the bit-locked disk key (505), the encryption method can be achieved by combining the plaintext of an NxN matrix (601B) The key (603B) that generates the column shift or row shift is encrypted. For example, the element b _{11 of the} original plaintext (601B) is shifted to the position of the original plaintext (601B) b _{14 by the key (603B), and the element b 12 of the} original plaintext (601B) is replaced by the key (603B). _{) Is shifted to the position of element b 11} in the original plaintext (601B) to form a ciphertext (605B). Wherein, the encryption of the plaintext (601B) by the key (603B) for column displacement or row displacement is not limited to displacement by only one column or one row. For example, the first column may not be shifted, the second column may be shifted by one column, and the third column may be shifted by two columns. The shifting method can be used to set the key (603B) according to the needs of the application. In another aspect of the present invention Among them, the above encryption method can be applied to the hardware key (503) and the bit-lock disk key (505). It can also be encrypted multiple times, not limited to one time, so that it can be stored in the bit-lock The secret-related files (501) in the disk are prevented from being leaked out by the enterprise or organization as described in the scenarios (A)-(E).

The above description is the preferred embodiment of the present invention. Those skilled in this field should be able to understand that it is used to illustrate the present invention rather than to limit the scope of the claimed patent rights of the present invention. The scope of its patent protection shall be determined by the attached scope of patent application and its equivalent fields. Anyone who is familiar with the art in this field, without departing from the spirit or scope of this patent, makes changes or modifications that are equivalent changes or designs completed under the spirit of the present invention, and should be included in the scope of the following patent applications Inside.

200‧‧‧Disk Information Security System

201‧‧‧Processing Module

209‧‧‧Input source authentication module

210‧‧‧Disk

211‧‧‧Bit Lock Disk Management Module

213‧‧‧Bit Lock Disk Drive Module

215‧‧‧Bit Lock Disk Authentication Module

215A‧‧‧Hardware Certification Unit

215C‧‧‧Bit Lock Disk Authentication Unit

221‧‧‧Protection Authority Module

223‧‧‧Public Library Module

225‧‧‧Protection drive module

Claims (9)

A disk information security system, including: A one-bit lock disk management module, which manages confidential documents stored on at least one-bit lock disks; A bit-lock disk drive module, coupled to the bit-lock disk management module, so that confidential files can be accessed by the processing module; A protective drive module, coupled to the bit-lock disk drive module, to prevent unauthorized access to the secret files stored in the at least one bit-lock disk; and, A one-bit lock disk authentication module, coupled to the bit-lock disk management module, authenticates the at least one-bit lock disk when accessing the at least one-bit lock disk or a secret file, Or the protection authority of confidential documents. The disk information security system described in claim 1, further includes a protection authority module, coupled to the protection drive module, and set the protection authority scope of the protection drive module for confidential documents, including reading, previewing, and Print, delete, write, copy, time in memory, or any combination of the above protection permissions. The disk information security system of claim 2, further comprising a public library module, coupled to the protection drive module, and storing the path address of the secret-related file in the at least one-digit lock disk, The bit-lock disk management module can access the secret files stored in the at least one bit-lock disk. The disk information security system according to claim 3, wherein the file format in the public library module is a dynamic-link library (DLL) to improve the performance of the disk information security system compatibility. For the disk information security system described in claim 4, the public library module includes a protection drive function unit, which records the setting function of the protection authority, and can be updated as needed, and can be accessed in the secret file When the protection drive module is notified to start. The disk information security system as described in claim 1, further comprising an input source authentication module, coupled to the processing module, to identify the near-end or remote input source, and define the protection authority through the protection drive module The range to set whether to allow local or remote access to confidential documents. For the disk information security system described in claim 1, the algorithm for the authentication protection authority of the bit-lock disk authentication module can be, but is not limited to, RSA, EIGamal, Difei-Harman key exchange protocol, Elliptic curve encryption algorithm, AES, DES, 3DES, Blowfish, IDEA, RC5, RC6, or any combination of the above algorithms. The disk information security system according to claim 1, wherein the bit-lock disk authentication module includes a hardware authentication unit that stores a hardware key and authenticates the corresponding one in the disk information security system Specific bit lock disks. The disk information security system according to claim 1, wherein the bit-locked disk authentication module includes a bit-locked disk authentication unit that stores a bit-locked disk key, wherein the bit is locked The length of the disc key can be 32-512 bits.

Images