531708 經濟部智慧財產局員工消費合作社印製 A7 五、發明説明（ 本發明係有關一具安全密碼認證之鍵盤裝置及 其方法，尤指一種利用硬體認證通過鍵盤輸入秘密 訊息，且CPU與認證軟體不參與認證過程，能解決 傳統密碼認證系統安全漏洞之設計。 按，傳統的密碼認證系統係由軟體所主導，如 圖一所示，使用者欲啟動密碼認證系統時，由於認 證軟體係由CPU所執行，軟體將依據使用者所設定 之密碼10，透過認證軟體11產生一暗碼圖表12， 之後每一次使用時，認證軟體12均將詢問使用者 密碼10’，使用者透過鍵盤輸入密碼1〇,後，認證 車人m 11將此岔碼與對照原先產生的暗碼圖表丄2， 若正蜂無誤，則使用者即擁有使用系統的權利，能 對儲存I置（如硬碟等）作資料的存取與處理。但整 個涊證的過程中非法入侵者（hacker)能夠看見處 理程序，認證軟體所產生的暗碼圖表12非常容易 被非法入侵者置換、修改，或是對密碼的對照 結果作假，即將結果變更為正確或不工作。 舉例來說··使用者所設定的密碼為n abc "，編 碼後為，編碼過的密碼將送往記憶體中儲存 ，但記憶體内的資料並不受認證軟體1;L所保護，可 以輕易的利用一些軟體（如soft ICE#)查出密碼 儲存在記憶體巾的位置，非法人侵者只要在認證處 理期間，以相同長度的字串（如„cdeπ編碼後為 · 、訂 線 (請先閱讀背面之注意事項再填寫本頁)531708 Printed by the Consumer Cooperative of the Intellectual Property Bureau of the Ministry of Economic Affairs A7 V. Description of the invention (The present invention relates to a keyboard device with a secure password authentication and a method thereof, especially a method for inputting secret information through a keyboard using hardware authentication, and the CPU and authentication The software does not participate in the authentication process, which can solve the design of the security vulnerabilities of the traditional password authentication system. According to the traditional password authentication system is dominated by the software, as shown in Figure 1, when the user wants to start the password authentication system, the authentication software system consists of Executed by the CPU, the software will generate a password chart 12 through the authentication software 11 according to the password 10 set by the user. After each use, the authentication software 12 will ask the user for the password 10 ', and the user enters the password 1 through the keyboard. 〇, Later, the certified rider m 11 compares this fork code with the original code chart 丄 2. If the error is correct, the user has the right to use the system and can store the storage I (such as a hard disk). Data access and processing. However, during the entire process of certification, illegal intruders (hackers) can see the processing procedures and authenticate the software. The password chart 12 is easily replaced or modified by illegal intruders, or the result of the comparison of the password is false, that is, the result is changed to be correct or not working. For example, the password set by the user is n abc ", encoding After that, the encoded password will be sent to the memory for storage, but the data in the memory is not protected by the authentication software 1; L, you can easily use some software (such as soft ICE #) to find out that the password is stored in the memory. The position of the body towel, as long as the illegal invaders, during the authentication process, use the same length of string (such as „cdeπ code is ·, set the thread (please read the precautions on the back before filling in this page)
531708 A7531708 A7
五、發明説明（2 ) 經濟部智慧財產局員工消費合作社印製 3] Χ=Χ”），將”χχχ„取代原有的，如此非法入 知者即能輕易的通過認證。如此—來，非法入 將月b對糸統儲存的資訊予取予求。 在前述的密碼認證過財，不論是使用者或非 /入奴者的密碼輸入，均是透過輸入裝置所達成， 最為普遍的輸入裝置即是鍵盤。傳統的鍵盤包括有 鍵盤陣列及鍵盤控制n (可參考圖三），❿與電腦間 的通信則是通過鍵盤緩衝區完成。因此密碼透過鍵 盤輸入係與一般的字流符相同’都要通過同一個鍵 盤緩衝區進入電腦系統内，再交由cpu執行認證流 程對用戶過濾。 但傳統的流程卻有下列安全上的隱憂： 1. 由於鍵盤緩衝區使用後並無清除步驟，而且是對 所有的用戶開放，任何非法用戶都可能通過非法 手段在鍵盤緩衝區中獲取不被清除的密碼訊息。 2. 認證流程係由CPU所執行，非法入侵者可以侵入 CPU執行程序輕易獲得密碼訊息。 3. 系統内存是不被加密的，認證軟體可能被非法入 侵者攻擊（如前述）。 緣此，本發明有鑑於現有的軟體認證系統所存 在之安全漏洞，及輸入裝置存在的缺點，提供一種 具安全密碼認證之鍵盤裝置及其方法，其係由硬體 所達成，CPU與認證軟體無法介入認證流程，而 本紙張適用中g]g]家榡準（Cns ) ( 21GX297公jg；) 狀衣-------1T------m (請先閱讀背面之注意事項再填寫本頁) 531708 A7 B7 五、發明説明（3) 解決傳統認證系統安全上的漏洞。 (請先閱讀背面之注意事項再填寫本頁) 依據前述，本發明是在鍵盤内設有一不可讀且 具有保護功能的認證緩衝區、一認證控制器及一用 於認證的認證表，認證緩衝區與鍵盤原有的鍵盤緩 衝區共同處理鍵盤輸入的字符流，密碼訊息係送入 認證緩衝區，該認證控制器即自認證緩衝區取得訊 息並與認證表内的訊息比較，認證通過即允許使用 者使用電腦系統並將認證緩衝區清除，而無法自鍵 盤中取得任何殘留的密碼資料。 以下將對本發明之結構設計與技術原理，作一 詳細之說明，並參閱附呈之圖式，將對本發明之特 徵作更進一步之瞭解，其中： 圖式說明： 圖一係為傳統軟體認證之流程示意圖； 圖二係為本發明之系統架構圖； 圖三係為本發明的系統工作流程圖。 經濟部智慧財產局員工消費合作社印製 圖號說明： 10密碼 1 0 ’密碼 11認證軟體 1 2暗碼圖表 20鍵盤裝置 30輸入部份 31鍵盤控制器 32鍵盤陣列 本紙張尺度適用中國國家標準（CNS ) A4現格（210X297公釐） (4)_ 531708 五、發明説明（4 ) 33鍵盤緩衝區 3 4認證緩衝區 4 0認證部份 41 CPU 44認證表 42系統控制器 43認證控制器 45軟體 5〇匯流排 經濟部智慧財產局員工消費合作社印製 如圖二戶斤f1 ^ 、 你為本發明之系統架構圖；本發 :之具安全密碼認證之鍵盤裝i 20主要由輸入部 伤3 U證部份40所組成，其中： /亥輸入部份30包括傳統的鍵盤控制器31、鍵 盤P列3 2與鍵盤緩衝區3 3 (與習用相同，於此+ 作i述）及§忍證緩衝區3 4。 口亥°心证部份40包括有CPIMI、系統控制器 42 ^ °丘控制為43、認證表44及相關軟體45 〇 輸入邛伤3 〇與認證部份$ 〇係透過匯流排5 〇 通k (例如PCI、工SA等）。 2鍵盤控制器31係辨視鍵盤陣列32所輸入資 料，若為一般字符流則將此資料儲存於鍵盤缓衝器 3 3内；若為密碼訊息則儲存於認證缓衝區3 4。 遠系統控制器4 2係自鍵盤緩衝區3 3擷取一般 訊息，並送入CPIMI作進一步處理。 該認證控制器4 3係架構於系統控制器4 2中之 一獨立個體’其係擷取認證緩衝區3 4内的密碼訊 ----------裝-------_訂------線 C請先閱讀背面之注意事項再填寫本頁) (5) 本紙張尺度適用中國國家標準（CNS > A4規格（210X297公釐） 經濟部智慧財產局員工消費合作社印製 531708 A7 —---------B7 五、發明説明（5 ) 息，並與認證表44内預存的密碼資料比對，以核 定用戶是否合法。 該認證表的形成，係於系統第一次使用時 =軟體45所設定’該軟體Μ係引導用戶設定密碼 貝，’並儲存於認證表44内。再一次啟動時，除 非是更新程序（如增加使用者、變更密碼等），認言登 的控制權將永遠轉移至認證控制器4 3。 如圖二所示，係為本發明的系統工作流程圖； 在第一次啟動時，軟體45執行而設定認證表44， 使用者依據軟體45的引導，將密碼設定於認證表 4 4中（步驟a )，作為日後認證之依據，此後認證的 工作即無關於軟體4 5。再一次執行時，使用者透過 鍵，陣列32輸入訊息，該鍵盤控制器31判斷是一 般字符流或是密碼訊息（步驟b)。若為一般字符流， ，此輸入訊息將被鍵盤控制器3丄控制而送入鍵盤 緩衝區3 3内（步驟c)，由系統控制器4 2作常規的 ，理程序（步驟d ;與傳統鍵盤相同）。若為密碼訊 息，則由鍵盤控制器31控制送入認證緩衝34區（步 驟e)，此時用戶或非法入侵者在鍵盤緩衝區33中 ^能讀取到相對應密碼位元數的替代符號字串（如 * * ")’同時鍵盤控制器3 1並將此替代符號字 串透過鍵盤緩衝區3 3、系統控制器4 2傳送至軟體 45與CPU41，如此任何人從認證緩衝區34、CPU41 ⑹ 装 - 訂 線 (請先閱讀背面之注意事項存填寫本X) 經濟部智慧財產局員工消費合作社印製 531708 A7 B7 ------- ' ___________ 五、發明説明（6 ) 及軟體45中只得讀取替代符鱿字串，而無法獲取 密瑪訊息。 該認證控制器43自認證緩衝區34中取得密碼 訊息後，將與透證表4 4内預存的資料做比較（步驟 f)，若相匹配，則認證成功，系統將開放一切資源 供用戶使用。但若不相匹配，即表示認證失敗，系 統將拒絕用戶的任何請求’如此便能嚴密的保護系 統資源’在可能竊取饮碼机息的路徑，截斷非法入 侵者的侵入點。 在認證程序結束後’ $忍證控制器4 3即將認證 緩衝區3 4清除（步驟g)。 由於認證缓衝區3 4不可讀（即讀出為取代位元 訊息），同時採用上述的保護措施，並且在每次認證 完成後即被清除，系統對用戶的密碼訊息提供了嚴 密的保障。且系統的認證係由獨立於系統控制器4 2 的s忍證控制4 3處理’不經由权體4 S與c P U 4 1， 解決了傳統密碼認證系統的隱憂。 綜上所述，本發明所提供之具安全密碼認證之 鍵盤裝置及其方法，密碼認證的執行不經由CPU及 認證軟體，且密碼係由獨立的認證控制器所執行， 並以替代不可讀的字符流取代原輸入密碼，及認證 完畢後清除認證緩衝區’使付非法入侵者無法在鍵 盤緩衝區中讀取任何的秘密机息’對於傳統認證程 (7)_ 本紙張尺度適用中國國家標準（CNS ) A4規格（210X297公釐） ' ----------壯衣----：---*訂------^ (請先閲讀背面之注意事項再填寫本頁} 531708 A7 -------— B7 五、發明説明（7 ) ^ --—-- 式之漏洞提出有效之解決辦法及對策，確實已符合 發明專利之申請要件，懇請肖局詳加審查，並惠賜 准予專利，以嘉惠民生利國利民，實感德便。 、唯以上所敘述之技術、圖說、程式或控制等方 法，僅僅係本發明較佳實施例之一而已；舉凡依本 發明申請專利範圍之技術所作之均|變化或修飾或 擷取部分功能之雷同製作，皆應仍屬本發明專利權 所涵蓋之範圍；當不能依此限定本發明實施之範圍。 ----------批衣----一----訂------0 (請先閱讀背面之注意事項再填寫本頁) 經濟部智慧財產局員工消費合作社印製 本紙張尺度適用中國國家標準（CNS ) A4規格（210X297公釐）V. Description of the invention (2) Printed by the Consumer Cooperatives of the Intellectual Property Bureau of the Ministry of Economic Affairs 3] χ = χ "), replacing" χχχ „" with the original one, so that those who know illegally can easily pass the authentication. So-come, Illegal entry will require the information stored in the system on month b. In the aforementioned password authentication, no matter whether the user or non / slave enters the password, it is achieved through the input device. The most common input device is Keyboard. The traditional keyboard includes a keyboard array and keyboard control (see Figure 3), and communication between the computer and the computer is completed through the keyboard buffer. Therefore, the password input through the keyboard is the same as the general word stream characters. Enter the computer system through the same keyboard buffer, and then let the CPU execute the authentication process to filter the users. However, the traditional process has the following security concerns: 1. There is no clearing step after using the keyboard buffer, and it is correct. All users are open, and any illegal user may obtain uncleared password information in the keyboard buffer by illegal means. 2. The authentication process is performed by the CPU When executed, illegal intruders can invade the CPU to execute programs to easily obtain password information. 3. The system memory is not encrypted, and the authentication software may be attacked by illegal intruders (as mentioned above). Therefore, the present invention takes into account existing software authentication systems. The existing security loopholes and the shortcomings of the input device provide a keyboard device and method with secure password authentication, which is achieved by hardware. The CPU and the authentication software cannot intervene in the authentication process, and this paper is applicable.] g] Family standard (Cns) (21GX297 male jg;) clothing ------- 1T ------ m (Please read the precautions on the back before filling this page) 531708 A7 B7 V. Invention Note (3) Solve the security loopholes in traditional authentication systems. (Please read the precautions on the back before filling this page.) According to the foregoing, the present invention provides an unreadable and protective authentication buffer in the keyboard, an authentication The controller and an authentication table for authentication. The authentication buffer and the original keyboard buffer of the keyboard jointly process the character stream input by the keyboard. The password information is sent to the authentication buffer. The authentication control That is, the information is obtained from the authentication buffer and compared with the information in the authentication table. Passing the authentication allows the user to use the computer system and clear the authentication buffer, without being able to obtain any remaining password data from the keyboard. The structure of the present invention will be described below. Design and technical principles, a detailed description, and refer to the attached drawings, will further understand the characteristics of the present invention, of which: Schematic description: Figure 1 is a schematic diagram of the traditional software certification process; Figure 2 is Figure 3 is a system architecture diagram of the present invention; Figure 3 is a flowchart of the system working process of the present invention. Printed by the Intellectual Property Bureau Staff Consumer Cooperatives of the Ministry of Economic Affairs print the drawing number description: 10 password 1 0 'password 11 authentication software 1 2 password chart 20 keyboard device 30 input part 31 keyboard controller 32 keyboard array This paper size is applicable to Chinese National Standard (CNS) A4 now (210X297 mm) (4) _ 531708 5. Description of the invention (4) 33 keyboard buffer 3 4 authentication buffer 4 0 certification part 41 CPU 44 certification form 42 system controller 43 certification controller 45 software 50 bus staff intellectual property bureau The cooperative prints the system structure diagram of the present invention as shown in Figure 2. You are the keyboard device with security password authentication. The i 20 is mainly composed of the input unit injury 3 U certificate part 40, of which: / The input part 30 includes a traditional keyboard controller 31, a keyboard P column 3 2 and a keyboard buffer 3 3 (the same as the conventional one, and is described herein), and § forbearance buffer 3 4. The mouth card part 40 includes CPIMI, the system controller 42, the control unit 43, the authentication table 44 and related software 45 〇 Input injury 3 〇 and the authentication part $ 〇 through the bus 5 〇 pass k (Such as PCI, Industrial SA, etc.). 2 The keyboard controller 31 recognizes the input data of the keyboard array 32. If it is a general character stream, it stores this data in the keyboard buffer 33; if it is a password message, it stores it in the authentication buffer 34. The remote system controller 4 2 captures general information from the keyboard buffer 3 3 and sends it to CPIMI for further processing. The authentication controller 4 3 is an independent entity structured in the system controller 4 2 'It retrieves the password information in the authentication buffer 3 4 ---------- install ------ -_Order ------ Line C, please read the notes on the back before filling in this page) (5) This paper size applies to Chinese national standards (CNS > A4 size (210X297 mm) Employees of Intellectual Property Bureau, Ministry of Economic Affairs Consumption cooperative prints 531708 A7 —--------- B7 V. Description of the invention (5) and compare it with the pre-stored password data in the authentication form 44 to verify whether the user is legal. The formation of the authentication form When the system is used for the first time = set by software 45, 'The software M guides the user to set a password,' and is stored in the authentication form 44. When it is started again, unless it is an update process (such as adding users, changing Password, etc.), the control of the testimonial will always be transferred to the authentication controller 43. As shown in Figure 2, it is a flowchart of the system work of the present invention; at the first startup, the software 45 executes to set the authentication table 44. According to the guidance of the software 45, the user sets the password in the authentication table 44 (step a) as the date. The basis of the authentication, since the authentication is not related to the software 4 5. When it is executed again, the user inputs a message through the key, the array 32, and the keyboard controller 31 determines whether it is a general character stream or a password message (step b). This is a general character stream. This input message will be controlled by the keyboard controller 3 丄 and sent to the keyboard buffer 33 (step c), and the system controller 42 will perform a regular, logical procedure (step d; with a traditional keyboard). Same). If it is a password message, it is controlled by the keyboard controller 31 and sent to the authentication buffer area 34 (step e). At this time, the user or an illegal intruder can read the corresponding number of password bits in the keyboard buffer 33. Alternative symbol string (such as * * ") 'while the keyboard controller 3 1 transmits this alternate symbol string through the keyboard buffer 3 3, the system controller 4 2 to the software 45 and CPU41, so that anyone from the certification Buffer 34, CPU41 ⑹ Installation-Threading (please read the precautions on the back and save and fill in this X) Printed by the Intellectual Property Bureau Employee Consumer Cooperative of the Ministry of Economic Affairs 531708 A7 B7 ------- '___________ V. Description of the invention ( 6) and software 45 It is necessary to read the substitute character string, but cannot obtain the Mima message. After the authentication controller 43 obtains the password message from the authentication buffer 34, it compares it with the pre-stored data in the transparent table 44 (step f), If they match, the authentication is successful, and the system will open all resources for users to use. However, if they do not match, it means that the authentication has failed, and the system will reject any request from the user 'so that the system resources can be tightly protected.' The path of opportunity to intercept the entry point of illegal intruders. After the authentication procedure is completed, the $ tolerance card controller 4 3 will clear the authentication buffer 3 4 (step g). Since the authentication buffer 34 is unreadable (that is, read as a replacement bit message), the protection measures mentioned above are adopted at the same time, and it is cleared after each authentication is completed. The system provides strict protection for the user's password information. In addition, the authentication of the system is processed by the s forbearance control 4 3 independent of the system controller 4 2 ′ without passing through the authority 4 S and c P U 4 1, which solves the hidden problems of the traditional password authentication system. In summary, in the keyboard device and method provided by the present invention with secure password authentication, password authentication is performed without a CPU and authentication software, and the password is executed by an independent authentication controller, and replaces the unreadable The character stream replaces the original input password, and the authentication buffer is cleared after authentication is completed “to prevent illegal intruders from reading any secret information in the keyboard buffer” For the traditional authentication process (7) _ This paper standard applies Chinese national standards (CNS) A4 size (210X297 mm) '---------- Zhuang Yi ----: --- * Order ------ ^ (Please read the notes on the back before filling This page} 531708 A7 --------- B7 V. Explanation of the invention (7) ^ --- --- Put forward effective solutions and countermeasures for the loopholes of the type, which have indeed met the application requirements for invention patents. Examine carefully and grant patents to benefit the people and benefit the country and the people. It is a matter of good deeds. Only the methods, techniques, diagrams, procedures or controls described above are just one of the preferred embodiments of the present invention. That's it; all things that are done in accordance with the patented technology of the present invention | change The same productions that modify or extract part of the functions should still fall within the scope of the patent right of the present invention; when the scope of implementation of the present invention cannot be limited according to this. -一 ---- Order ------ 0 (Please read the precautions on the back before filling out this page) The paper size printed by the Consumer Cooperatives of the Intellectual Property Bureau of the Ministry of Economic Affairs applies this Chinese paper standard (CNS) A4 specification ( 210X297 mm)