TW550459B - Computer data protection device - Google Patents

Abstract

The present invention provides a computer data protection device, which includes a processing unit, an encrypter/decrypter, and one or more storage devices, wherein the encrypter/decrypter are connected with the processing unit through a first interface for receiving the control command transmitted from the processing unit to start the encrypter/decrypter. The encrypter/decrypter are connected with the processing unit through a second interface for data transmission, and for data encryption or decryption by the encrypter/decrypter. The encrypter/decrypter are also connected with a third interface having a plurality of output ends. These storage devices are connected wit the output end of the third interface respectively for receiving the encrypted data transmitted by the encrypter/decrypter, or transmitting the encrypted data in the storage device to the encrypter/decrypter for decryption and recovering. Thus, when the processing unit is going to write data into the storage device or read the data in the storage device, it can achieve the data protection effect by the encrypter/decrypter.

Description

550459

[Field of the Invention] The device, in particular, relates to a device that is performed by a user before s ·), and after entering the OS, the input data is encrypted / decrypted. The present invention is a computer data protection computer entering an operating system (hereinafter referred to as Q Set or enter a password, and set to encrypt the computer and these devices will be transferred to prevent theft of data. [Background of the invention] Press, it is important to know that 1 is stored in the computer operation. It is protected by setting a password, which includes setting a boot password in the basic input / output system (hereinafter referred to as M0S) or running an application after entering 0s • to generate a secure password. Password, as long as the position of the jumper is changed to make it short-circuited, the power-on password is cleared, and the software stealer can detect it by entering an additional application program after entering the 0 · S · The password will crack it. In addition, even if the password is not cracked, the thief can also directly disassemble the computer to extract the storage device. The hard disk is taken as an example. As long as the same type of chipset is used on another computer host, it can be transferred directly. If the chipset is different, unless the hard disk is installed with 0 · S · (especially Windows 2 0 Version above 0 0 R), in addition to problems during implementation, only hard disks with data stored or not used as working hard disks can be read smoothly, so the work of data confidentiality can be described as impossible. Yes, the inventors feel that the above-mentioned defects can be improved.

550459

V. Description of the invention (2) A rationally designed and effectively improved research combined with the application of theories, finally presents the above-mentioned missing invention. [Objective of the Invention] The main purpose of the present invention is to provide a computer data protection device. Continued to disable or enable the transmission channel, but to protect the data directly. It is the hardening of data transmission through relays. The body performs the encryption action, making: it ί: material becomes garbled to protect f #, and the rest of the control commands are encrypted, and the timing of password confirmation is entered into the computer by the computer, which effectively prevents people from cracking it. [Inventive Features] In order to achieve the protection of more than one storage device, connect to the order to start the connection to the data pair on the data surface, which has a wheel with three interfaces, or to decompose and restore it. The present invention achieves the above-mentioned object, and the present invention is mainly to provide a package !: processing early a, an encryption / decryptor and one or one shell ::: the 'the encryption' decryptor is through-the first interface: early ... In order to accept the processing unit on both sides of the remote encryption / decryption device, the encryption / decryption device is also used to control the data transmission unit-wide area for encryption or decryption, and the encryption / decryption device is connected again. Several output terminals after the first encryption / decryption; these storages are respectively second output terminals, which are used to accept the encrypted data in the first storage by the encryption / decryption device and send them to the U encryption data and encryption / decryption device. An encryption / decryption device is provided and is provided as a processing unit and 550459. V. Description of the invention (3) Data transfer between discs # 'Include-system management bus interface / decoder and multiple decoders, where the system management is Several connections-the system management bus is in communication with the processing unit. 1 connection = control instructions sent by the unit, and these encoding / decoding are also the "management management bus interface" for receiving the system management bus interface. , Turn into the control instructions to start the editing / demapping Cry ^ / ir drama one by one rude ^ gu gu xi xi encoder / decoder connected to bei huihui and 4 processing unit respectively, is to encode or decode the data transmitted with the 2, the plural = ^, Decode H, the other-end and connect to the processing unit, and then send the hard disk control command to the hard disk for decoding, and then send ^ encoder / decoder for encoding, so that the control command can be obtained. constant. [Detailed Description of the Invention] ^ In order to allow your reviewers to further understand the technology, means and effects adopted by the present invention in order to achieve the following: Please read the following detailed description and drawings of the present invention, I believe Purpose, features, and characteristics: Yes, this has a deep and specific understanding, but the drawings are provided for reference and explanation only, and are not intended to limit the present invention. ^ Please refer to the first figure, which is a circuit block diagram of the present invention, which includes a processing unit 1 and an encryption / decryption device 2 in the telematics system, where / 'The + processing unit 1 can be a general host The south bridge chip of the board circuit, the encryption / decryption device 2 can be an ASIC circuit, which is transparent to the processing unit 1, and the system management bus (system management bus; SM bus) 3 to accept the processing unit i The control instructions sent, and

550459 V. Description of the invention (4) Start the function of encryption or decryption. The encryption / decryption device 2 and the processing unit 1 transmit data through a first IDE interface 4 and the first IDE interface 4 can be divided. It is a primary channel 4 1 and a secondary channel 4 2. The other end of the encryption / decryption device 2 is connected with a second IDE interface 5 which is also divided into a main channel 5 1 and a primary channel 5 2. According to the characteristics of the second IDE " surface 5 ', each channel is The tap has a master output terminal 5 1 a, 52 a and a siave output terminal 5, 52 b, so that the second IDE interface 5 can be externally connected to four storage devices 6, and the storage device 6 can be a hard disk: optical disk drive, burner Storage devices such as recorders or magneto-optical drives (Magnet〇ptical) that support IDE interfaces. The circuit block inside the μ 忒 encryption / decryption device 2 is shown in the first figure A. Its ^, ^ / decode 2 1, * don't connect through a SM buS control • interface 2 2 US 2 and accept the SM The control transmitted by bus 3 ^ = ί =; = device 21 and connected through-data confluence respectively, with the role of Lu Lidan-face 4 master, _ person channel 4 1, 4 2 Stele: "Encode or calcite 1 transmitted data", = master of interface 4 and control to the storage 6 f master, secondary channel 4 2, 4 2 The transmission order is being sent to the Encryption / decryption 17 is used for decoding and then encoding, so that the encryption / decryption device 2 will be controlled, and the process remains unchanged. Based on this, please refer to Article H; the role of encryption protection. The figure does not show the first embodiment of the present invention.

550459 V. Description of the invention (5) The storage device 6 connected to the master output terminal 5 1 a of the second IDE interface 5 is a hard disk, and the slave output terminal 5 1 b of the main channel of the second IDE interface 5 The connected storage device 6 is an optical disc drive. After the general computer hardware is assembled, 0.S. must be installed first. The setting steps are as follows: Step 100: Place the installation disc in the optical disc drive; Step 10 1: Set the BIOS to boot from the drive of the slave output terminal 5 1 b of the main channel; Step 102: After the computer is turned on, the BIOS will perform a self-boot detection (

Power On Self Test (hereinafter referred to as POST) automatically initializes the computer components and peripherals; Step 103: When the B10S detects the hard disk and optical drive, it sends an interrupt request, and displays a message on the screen. A dialog box asks the user whether to enable the encryption / decryptor 2? If yes, go to step 104; if not, return to POST, and go directly to 0. S. after the end, no encryption action 1 0 7; steps 1 0 4: The system asks whether to encrypt the output of the master channel 5 1 a (ie, to encrypt the hard disk)? If yes, set the password 10 8 and proceed to step 105; if not, go directly to step 10 5; step 105: the system asks whether to encrypt the slave output 5 1 b of the main channel. At this time, If the optical disc drive is equipped with a standard installation disc, the user must not set a password.

550459 5. Description of the invention (6) The installation disc that has been encrypted and encrypted with the encryption / decryption device 2 of the same model, the user must enter the password; Step 106: After the setting is completed, the BIOS returns to POST. Continue the unfinished process, and enter the installation process after the end (that is, install data from the optical drive to the hard disk). In the above step 105, if the user inserts a standard installation disc but sets a password by himself, the data sent to the processing unit 1 during the installation is encrypted, the processing unit 1 cannot recognize and cannot perform the installation process. Please refer to the third figure, which is the second embodiment of the present invention. Assume that the user is set to encrypt the master channel output terminal 5 1 a (that is, to encrypt the hard disk), and the slave channel output terminal 5 1 b is not. If it is encrypted (that is, the optical disc drive is not encrypted), the installation procedure is as follows: Step 2 0 0: Read data from the optical disc drive and send it directly to the processing unit 1; Step 2 0 1 ·· The processing unit 1 is processed through Then, the data is sent to the encryption / decryption device 2 through the first ID E interface 4; Step 2 02: After the encryption / decryption device 2 encrypts the data, it encrypts the data through the second ID E interface 5 The data is sent to the hard disk, and steps 200 to 2 02 are repeated until the installation is completed. 3 ° According to this, the data installed on the hard disk is encrypted and protected. After that, to read data from the encrypted hard disk to the processing unit 1, as shown in the fourth figure, it includes the following steps: Step 3 0 0: The hard disk sends the data to be read to The Encryptor / Decryptor

Page 9 550459 V. Description of the invention (7) Step 3 〇 1 After the encryption / decryption device 2 decrypts, it sends data to the processing unit 经由 via the first IDE interface 4 for reading. Please refer to channel s 1 for this step: Step 4 0 0 Refer to the fifth figure. At this time, assuming that the storage device 6 connected to the main ave output terminal 5 1 b of the second ID E interface 5 is a recorder, then When the data of the hard disk is burned to the recorder, the flow includes the following steps: the hard step of the BIOS 1 a: step 4 0: the computer starts the step 4 0 2: when a request is detected, and whether it is enabled, if No, 0. S., no Step 403: The main communication step 4 0 4: The system asks b encryption (if yes, 0 5; if no, step 4 0 5) The completed process is set to the main channel Master output terminal 5 disks boot; After that, the BIOS performs POST; When the hard disk and the burner, an interrupt is issued to display a dialog box on the screen and ask to use the encryption / decryption device 2? Then go to step 4 0 3; then return to POST, and directly enter the encryption action 4 0 9 after the end; enter the password at the master output terminal 5 1 a; whether the master channel slave output terminal 5 1 is to encrypt the burning disc)? Then set the password 4 1 0 and enter step 4 directly to step 4 5; After that, the BIOS will return to POST and continue unfinished ’and enter 〇 · s ·’ after the end

Page 10 550459 V. Description of the invention (8) _ Step 406 The data to be read from the hard disk is sent to the encryption and decryption device. Step 4 0 7

-IDE Step 4 0 8 5 After the encryption / decryption device 2 performs decryption, it is sent to the processing unit through the face 4; After the processing unit 1 is processed, if step 4 0 9 step 4 1 0 m step 409 'if set Encryption = rms recorder to burn, and return to step 4 0, until the burning is completed. 4. Send the data to the encryption / decryptor 2 for encryption. Virtue :: from the second 1 卯The interface 5 is sent to the burner and enters 4 ”: and returns to step 406 until the burn is completed. After the burn is completed, if you want to continue the burn, you can reset the password on the recorder; otherwise, the burn is completed If the light is on the type of computer and knows the setting password, 4 :: ;; can not be read and used on the same computer. Order method is taken, other In addition, the above encryption / decryption device 2 is also a chipset The internal or other storage device is controlled by the processing unit device 6 (but additional control and planning must be added to the encryption / decryption program) or the internal connection between storage and other buses and the processing unit. 2 instructions , Or according to this, the processing unit 1 and the Jiancun are encrypted or decrypted by the encryption / decryption device 2—the transmitted data By setting a password, even if it is stolen to another Taipower by a foreigner; once the user has used it in advance, it cannot be identified 550459 V. Description of the invention (9) 2 邠 shell material 'but only display-pile garbled; In addition, the user The set = code is different. The encryption / decryption method performed by the encryption / decryption device 2 is also different. In addition, devices such as the optical disc drive or recorder can also allow women's drivers under os. The user plans the encryption / decryption device 2 to achieve the function of encryption. In addition, since the timing of inputting the password is before the computer enters 0 · s •, and it is a method of adding hardware, it is necessary to use additional software It is not easy to crack the password by the program, so the present invention has a high degree of data security. In addition, the first IDE interface 4 and the second IDE interface 5 described above can also be replaced by interfaces such as SCSI, IEEE 1394, USB 2.0, and Serial ΑΤΑ. Then, the storage 6 corresponds to a storage device supporting interfaces such as SCSI, IEEE 1394, USB 2.0, Serial AT, etc. In summary, the present invention fully complies with the requirements of a patent application. Therefore, an application is filed according to the patent law. Please check and approve the Huizun patent in advance, and have a sense of virtue to protect the rights of the inventors. If the Bureau ’s expensive review committee has any suspicions, please do not hesitate to write instructions. However, the above-mentioned 'only the most The detailed description and drawings of one of the preferred embodiments, but the features of the present invention are not limited to this, and are not intended to limit the present invention. The full scope of the present invention shall be subject to the scope of the following patent applications. The spirit of the scope of the patent application of the present invention and its similar variations should be included in the scope of the present invention. Anyone skilled in the art can easily think of the changes or modifications in the field of the present invention. The invention description (ίο) is covered by the patent scope of the following case. 550459 on page 13 is a simple illustration. The first diagram is a circuit block of the present invention 丨 FIG. 0 The first diagram A is a block diagram of the internal circuit of the encryption / decryption device of the present invention < The-diagram is the first embodiment of the present invention. Set flow chart. The second figure is an installation flowchart of the second embodiment of the present invention. The fourth diagram is an operation flow chart of reading data from a hard disk to a processing unit in the second embodiment of the present invention. One of the fifth picture and the second of the fifth picture > The flowchart of the operation of burning data from the hard disk to the burner in the second embodiment of the private invention 0 [reference number in the drawing] 1 processing unit 2 plus / Decryptor 2 1 Encoder / decoder 2 2 SM bus control interface 2 3 Data bus 2 4 Control bus 2 5 Decoder 3 System management bus 4 First I DE interface 4 1 Main channel 4 2 Secondary channel 5 Second I DE interface 5 1 main channel 5 1 a main channel mas ter output 5 1 b main channel s 1 ave output 5 2 secondary channel 5 2 a secondary channel mas ter output 5 2 b secondary channel slave output storage 6

Page 14

Claims (1)

550459 6. Scope of Patent Application 1. A computer data protection device comprising: a processing unit; an encryption / decryption device connected to the processing unit through a first interface for receiving control transmitted by the processing unit Instructions to start the encryption / decryption device, the encryption / decryption device is connected to the processing unit through a second interface for data transmission, and the encryption / decryption device encrypts or decrypts the data, the The encryption / decryption device is further connected to a third interface, which has a plurality of output terminals; and one or more storage devices are respectively connected to the output terminals of the third interface for receiving the data transmitted by the encryption / decryption device. Encrypt the data, or send the encrypted data in the storage to the encryption / decryption device for decryption and restoration; by this, when the processing unit wants to write data to the storage or read the data in the storage, The encryption / decryption device achieves data protection. 2. The computer data protection device described in item 1 of the scope of patent application, wherein the processing unit can be a motherboard circuit. 3. The computer data protection device described in item 1 of the scope of patent application, wherein the encryption / decryption device is an A S I C circuit. 4. The computer data protection device described in item 1 of the scope of patent application, wherein the encryption / decryption device is set in the chip set of the processing unit. 5. The computer data protection device described in item 1 of the scope of patent application, wherein the encryption / decryption device is provided on a control chip of another storage device. 6. The computer data protection device described in item 1 of the scope of patent application, which Page 15 550459 6. In the scope of the patent application, the encryption / decryption device is embedded in the storage, and the instructions for controlling and planning the encryption / decryption device must be added, or through other buses and the processing unit.相 连接。 Phase connection. 7. The computer data protection device described in item 1 of the scope of patent application, wherein the first interface is a system management bus (SMtem bus) 〇8, as described in item 1 of the scope of patent application A computer data protection device, wherein the second interface and the third interface are IDE interfaces. 9. The computer data protection device as described in item 1 of the scope of patent application, wherein the first interface and the third interface of the 5H are a SCSI, IEEE 1394, USB 2.0 or Serial ATA interface. 10. The computer data protection device as described in item 1 of the scope of patent application, wherein the storage device is a storage device supporting an IDE interface, which is a hard disk, a compact disc drive, a recorder, or a magneto-optical drive (Magneto Opt i cal). hurt The computer data protection device described in item 1 of the scope of the patent application, wherein the storage device is a hard disk, an optical disc drive, a recorder, or a magneto optical drive that supports SCSI, IEEE 1 3 9 4 USB 2 · 0 or Serial ΑΑΑ interface storage device. -An encryption / decryption device is used as a data system management bus interface between a processing unit and a hard disk, and is connected to a system management bus to communicate with the processing unit for receiving control instructions sent by the processing unit; # 550459 6. Scope of patent application ________ Multiple coders / decoders, 7 ~, used to accept the system management ^ Xuan / Tongguan bus interface order to start the rotation of the code / decoder interface ^ Control refers to a data bus and the processing, and the _ codec / decoder is connected to the data transmitted between the processing unit:] D: will be connected with the hard = decoder, respectively connected to the two solutions, and f = Connected to the processing unit, used to decode the hard disk control command from the other end to the side hard disk, / to send the decoder for encoding 'make the control command = edit / Page 17