TWI506469B - Data security method, electronic device and external storage device - Google Patents

Description

Data security method, electronic device and external storage device

The present invention relates to a data security method, an electronic device, and an external storage device, and more particularly to a data security method for performing security authentication on an electronic device through a hardware and software key of an external storage device.

As the popularity and convenience of computers increase, people often store confidential information on computers. In order to prevent unauthorized access to such information by unauthorized persons, computers generally provide a secure authentication mechanism. In the prior art, data confidentiality can be achieved using software authentication, hardware authentication, or dynamic one-time password authentication.

The software authentication method requires the user to input a password when the computer is turned on, and the computer can be operated only when the password corresponding to the system memory is met. Software authentication is not secure enough. Simple passwords can be easily cracked or guessed by others, and complex passwords are easy to forget.

The hardware authentication method requires the user to insert an external storage device when the computer is turned on, and the computer can be operated only when the password or key of the external storage device memory matches the password or key of the system memory. The hardware authentication method is also not safe enough. If someone steals an external storage device, they can use the computer illegally.

In the dynamic one-time password authentication mode, the user needs to apply for a password generator of the built-in smart card, and the smart card memory key pair can perform the signature and encryption and decryption operations of the public key algorithm. The time difference is used as a synchronization condition between the server and the password generator to generate a one-time password required for the user to log in to the computer. The dynamic one-time password authentication method is more secure. However, if the user loses the password generator or the password generator fails, the user needs to re-apply for a new password generator to the service center, and the computer cannot be used in a short time. In addition, dynamic one-time password authentication requires a significant amount of cost to set up the service center.

The invention provides a data security method, an electronic device and an external storage device. The electronic device includes a specific storage area and a security module. A specific storage area contains a system software. After receiving the activation signal, the security module determines whether an electronic device is inserted into any external storage device; when the electronic device is inserted into a first external storage device, the security module determines whether a password input by a user meets the first a first confirmation password of the external storage device memory, and determining whether the first mark of the first external storage device memory matches a unique identifier of the electronic device; when the password entered by the user matches the first confirmation password and When the first mark conforms to the unique mark, the electronic device executes a system software and updates the password according to an update frequency; the electronic device writes the updated password to the first external storage device as the first confirmation a password; and the electronic device notifying the user of the updated password through at least one contact.

The present invention further provides an electronic device having a unique mark and including a specific storage area carrying a system software and a security module. The security module is configured to determine whether the electronic device is inserted into any external storage device after receiving an activation signal; when the electronic device is inserted into the first confirmation password of the memory and the first external storage device of the first identifier, Determining whether a password input by a user meets the first confirmation password, and determining whether the first token meets the unique token; when the password entered by the user matches the first confirmation password and the first token conforms to the unique identifier When marking, the electronic device executes the system software, and updates the password according to an update frequency; and controls the electronic device to write the updated password to the first external storage device as the first authentic The password is recognized and the updated password is notified to the user via at least one contact.

The present invention further provides an external storage device that is detachably electrically connected to an electronic device. The electronic device has a unique indicia and carries a system software. The external storage device includes a confirmation password and a tag. When the electronic device is inserted into the external storage device, and the electronic device receives an activation signal, it determines whether a password input by a user meets the confirmation password, and determines whether the tag conforms to the unique tag. When the password entered by the user meets the confirmation password and the mark conforms to the unique mark, the electronic device executes the system software, updates the password according to an update frequency, and then updates the password through at least one contact method. Notify the user.

10‧‧‧Electronic devices

12, 14‧‧‧ Connection interface

16‧‧‧Specific storage area

18‧‧‧Security Module

20‧‧‧System Software

22, 24‧‧‧ External storage devices

100‧‧‧ data security system

210~260, 310~390‧‧‧ steps

FIG. 1 is a functional block diagram of a data security system according to an embodiment of the present invention.

FIG. 2 is a flow chart of the data security system in the initial setting according to the embodiment of the present invention.

FIG. 3 is a flow chart of the data security system in the process of starting or waking up the program according to the embodiment of the present invention.

FIG. 1 is a functional block diagram of a data security system 100 in accordance with an embodiment of the present invention. The data security system 100 includes an electronic device 10 and two external storage devices 22, 24. The electronic device 10 includes connection interfaces 12 and 14, a specific storage area 16, and a security module 18.

In an embodiment of the present invention, the electronic device 10 can be a mobile phone, a personal digital assistant (PDA), a handheld computer, a tablet computer, a nettop computer, and a notebook ( Laptop) A computer, server or other device with communication capabilities. A communication component such as a subscriber identity module (SIM) card and/or a network card can be installed in the electronic device 10, so that the mobile phone can be transmitted to the user's mobile phone and connected to the Internet to send an email. Send a text message to the user's mobile phone to the user's e-mail address and/or via the Internet. It should be noted that the type of electronic device 10 does not limit the scope of the present invention.

In the embodiment of the present invention, the external storage devices 22 and 24 can be a universal serial bus (USB) flash drive, a CompactFlash (CF) memory card, a SmartMedia (SM) memory card, and a Memory Stick (MS). Portable storage media such as memory cards, Multi Media Card (MMC) memory cards, optical discs, or mobile hard drives. Connection interfaces 12 and 14 are used to receive external storage devices 22 and 24, respectively. Depending on the type of external storage devices 22 and 24, connection interfaces 12 and 14 can be USB interfaces or CF/SM/MS/MMC slots. The external storage devices 22, 24 can be used as a usage key for the electronic device 10, the function of which will be described in detail in the subsequent sections of the specification. It should be noted that the types of external storage devices 22, 24 and connection interfaces 12, 14 are not intended to limit the scope of the invention.

In the embodiment of the present invention, the specific storage area 16 of the electronic device 10 can be a read-only memory (ROM), a flash memory, and an erasable programmable read-only memory (erasable). Programmable read-only memory (EEPROM), electrically erasable programmable read-only memory (EEPROM) or hard disk. The electronic device 10 can load a system software 20 into a specific storage area 16 to perform a boot process, or perform a wake-up procedure to be in a sleep mode, a hibernate mode, or a standby mode. The operating electronic device 10 is switched back to operate in the normal mode. The system software 20 can be a basic input/output system (BIOS) that performs self-testing of various parts of the system when booting or waking up the program, as well as the necessary code to provide the most basic hardware initialization and peripheral control. It should be noted that the particular storage area 16 and the type of system software 20 are not intended to limit the scope of the invention.

The security module 18 can be used to verify whether the user is a legitimate user of the electronic device 10, and the detailed functions thereof will be described in detail in the subsequent content.

FIG. 2 is a flow chart of the data security system 100 in an initial setting according to an embodiment of the present invention, which includes the following steps: Step 210: The user inputs at least one set of confirmation passwords; and step 220 is performed.

Step 220: The user inputs at least one contact mode; and step 230 is performed.

Step 230: The user sets a password update frequency; step 240 is performed.

Step 240: Insert the external storage devices 22 and 24 into the electronic device 10; and perform step 250.

Step 250: The electronic device 10 writes the confirmation password input by the user and the unique identifier of the electronic device into the external storage devices 22 and 24; step 260 is performed.

Step 260: The electronic device 10 notifies the user of the latest password according to the contact mode input by the user.

In step 210, the electronic device 10 may require the user to enter a set of passwords for the external storage devices 22 and 24, or to input two different sets of passwords for the external storage devices 22 and 24, respectively. The entered confirmation password can be any combination of letters, special symbols or numbers. It should be noted that the form, length or number of passwords does not limit the scope of the invention. The present invention uses two external storage devices 22 and 24 as keys for use of the electronic device 10 to provide a password backup so that if one of the external storage devices is inadvertently lost or data corruption occurs, the user can still use another external storage. The device is used to start the program. The embodiments of Figs. 1 to 3 are illustrated by external storage devices 22 and 24, but the present invention can also be applied to single or more than one external storage device, and the number of external storage devices does not limit the scope of the present invention. .

In step 220, the electronic device 10 may request the user to enter a contact information such as an email address and/or a mobile phone number. It should be noted that the type or number of contact methods does not limit the scope of the present invention. The present invention can use a variety of contact methods, so that if one of the contact methods is invalid for some reason, the electronic device 10 can notify the user through other contact means.

In step 230, the electronic device 10 may request the user to set a password update frequency, for example, after each successful power on/wake up, after a successful power on/wake up a certain number of times, or in daily time/week/ Month/season/year update, etc. It is to be noted that the value of the update frequency does not limit the scope of the invention. The invention updates the password in a manner specified by the user to increase the difficulty of the unauthorized third party to crack the password, thereby improving security.

In step 240, external storage devices 22 and 24 can be inserted into electronic device 10 through connection interfaces 12 and 14, respectively. In the embodiment shown in FIG. 2, the data security system 100 performs steps 210-240 in sequence during initial setup. In other embodiments, the data security system 100 may perform step 240 first in the initial setting, and then perform steps 210-230. Alternatively, the data security system 100 may insert the execution step 240 at any point in time during the initial execution of the steps 210-230. On the other hand, the data security system 100 can perform steps 210, 220, and 230 in any order during initial setup. It should be noted that the order of execution of steps 210-240 does not limit the scope of the present invention.

In step 250, the electronic device 10 can write the confirmation password input by the user and the unique identifier of the electronic device 10 to the external storage devices 22 and 24, wherein the confirmation passwords written to the external storage devices 22 and 24 can be the same group or different. Group password. The unique identifier of the electronic device 10 can be a network card number, an IP address, an international mobile equipment identity (IMEI), a mobile equipment identifier (MEID), and a global unique identifier. A globally unique identifier (GUID), an international mobile subscriber identity (IMSI) of the SIM card, and an integrated circuit card identifier (ICCID), or a central processing unit number. It is to be noted that the type of unique mark does not limit the scope of the invention. As is well known to those skilled in the relevant art, the IMSI/ICCID of the network card number, internet address, IMEI, MEID and SIM card is unique. The recognition, while the 128-bit long GUID generated by the algorithm is extremely low. Therefore, the confirmation password stored in the external storage devices 22 and 24 can be used as the software key of the electronic device 10, and the unique identifier of the memory can be used as the hardware key of the electronic device 10. Through the double protection of the above software and hardware keys, even if an unauthorized third party obtains the password from it, the content of the unique mark is still unknown; even if the unauthorized third party tries to crack the external storage devices 22 and 24 With the password and the unique mark, the electronic device 10 to which the external storage devices 22 and 24 are applied is still not known. Therefore, the present invention can greatly improve the security of the data security system 100.

In addition, the electronic device 10 can write the confirmation password input by the user and the unique mark of the electronic device 10 to a specific address of the external storage devices 22 and 24 in a specific format. This particular address is not a file area of external storage devices 22 and 24, and the particular format is not a file format readable by any third party. For example, the electronic device 10 can write the confirmation password entered by the user and the unique mark of the electronic device 10 directly into the non-file area of the external storage devices 22 and 24 in machine code. As a result, the unauthorized third party cannot easily read the passwords of the external storage devices 22 and 24 even if the external storage devices 22 and 24 are obtained. Therefore, the present invention can greatly improve the security of the data security system 100.

In step 260, the electronic device 10 can notify the user of the latest password according to the contact mode input by the user. For example, the electronic device 10 can notify the user of the latest password by email, transmit the latest password to the user's mobile phone through the short message, or both. It should be noted that the manner in which the electronic device 10 notifies the user of the latest password does not limit the scope of the present invention.

FIG. 3 is a flow chart of the data security system 100 during a boot or wake-up procedure according to an embodiment of the present invention, which includes the following steps:

Step 310: After receiving the startup signal, determine whether the electronic device 10 is inserted into the at least one external storage device; if yes, go to step 320; if no, go to step 390.

Step 320: The user is required to input a password; and step 330 is performed.

Step 330: Determine whether the password input by the user meets the confirmation password currently inserted into the memory of the external storage device; if yes, go to step 340; if no, go to step 390.

Step 340: Determine whether the mark currently inserted into the memory of the external storage device conforms to the unique mark of the electronic device 10; if yes, go to step 350; if no, go to step 390.

Step 350: The electronic device 10 executes the system software 20; step 360 is performed.

Step 360: Determine whether it is necessary to update the confirmation password according to the update frequency input by the user at the initial setting; if yes, go to step 370; if no, go to step 380.

Step 370: The electronic device 10 updates the confirmation password, writes the updated confirmation password to the currently inserted external storage device, and notifies the user of the updated confirmation password through the contact mode input by the user at the initial setting; and step 380 is performed.

Step 380: Perform other operations.

Step 390: Perform a shutdown job.

In step 310, after receiving the activation signal, the electronic device 10 determines whether at least one external storage device is inserted. If the electronic device 10 is not inserted into any external storage device, step 390 is performed to perform a shutdown operation. In an embodiment of the invention, when the electronic device 10 is in the off state, the activation signal may be generated after the user presses the power button of the electronic device 10. In another embodiment of the present invention, when the electronic device 10 is operating in a sleep mode, a sleep mode, or a standby mode, the activation signal may be generated after the user presses any key of the electronic device 10. It should be noted that the manner in which the activation signal is generated does not limit the scope of the present invention.

In step 320, after confirming that the electronic device 10 is plugged into at least one external storage device, the electronic device 10 will ask the user to input a password. For example, the security module 18 is on the electronic device 10 An input interface is displayed on the screen to allow the user to enter a password. It should be noted that the manner in which the user enters the password does not limit the scope of the present invention.

In step 330, the electronic device 10 reads the confirmation password currently inserted into the memory of the external storage device, and then the security module 18 determines whether the password entered by the user in step 320 is met. If the password does not match, step 390 is performed at this time to perform the shutdown operation.

In step 340, after confirming that the password entered by the user at the time of power-on conforms to the confirmation password currently inserted into the memory of the external storage device, the security module 18 determines whether the mark currently inserted into the memory of the external storage device conforms to the unique mark of the electronic device 10. If the unique tag does not match, step 390 is performed to perform the shutdown job. Step 350 is performed to allow the electronic device 10 to execute the system software 20 after confirming that the unique tag is met. In other words, the present invention double-checks the password and the unique mark when booting or waking up, thereby increasing security.

In the embodiment shown in FIG. 3, the data security system 100 performs steps 330-340 in sequence when powering on or waking up. In other embodiments, the data security system 100 may perform step 340 before powering on or waking up, and then perform step 340. It should be noted that the order of execution of steps 330 and 340 does not limit the scope of the invention.

As described above, the present invention can use a single or more external storage device as a usage key for the electronic device 10 to provide a password backup, and in steps 330 and 340, one or more external storages can also be determined. Whether the device is the use key of the electronic device 10. The following chart shows the possible outcomes of performing data steps 330 and 340 for each external storage device by the data security system 100 of the present invention. The status 1 represents the confirmation password of the external storage device memory conforms to the password entered by the user in step 320 and the external storage device memory mark conforms to the unique identifier of the electronic device 10, and the status 2 to the status 4 represents the external storage device memory confirmation password. The indicia that conform to the password entered by the user in step 320 and/or the memory of the external storage device do not conform to the unique indicia of the electronic device 10. In a In the embodiment, if the electronic device 10 is only inserted into the single external storage device 22 when the activation signal is received, only step 360 is performed after determining that the external storage device 22 meets the condition one in steps 330-340. In another embodiment, if the electronic device 10 is simultaneously inserted into the external storage devices 22 and 24 when receiving the activation signal, at this time, as long as it is determined in steps 330-340 that one of the external storage devices 22 and 24 meets the condition, Step 360 is then performed; step 390 is only performed if it is determined that both external storage devices 22 and 24 are not in compliance with the condition one.

In step 360, the electronic device 10 determines whether the password needs to be updated according to the update frequency input by the user at the initial setting. The details of the update frequency are as in the previous step 230, and are not described here.

In step 370, the electronic device 10 updates the password, writes the updated password to the current external storage device, and notifies the user of the updated password through the contact mode entered by the user at the initial setting. The updated password can be any combination of letters, special symbols, or numbers, randomly generated by the electronic device 10 or determined by a particular algorithm. The electronic device 10 can write the updated password in a specific format to a specific address currently inserted into the external storage device. The electronic device 10 can notify the user of the latest password by e-mail, transmit the latest password to the user's mobile phone via the short message, or both. It should be noted that the manner in which the password is updated and the form, length, number or notification manner of the updated password do not limit the scope of the present invention.

After the execution of the system software 20, the electronic device 10 can perform other operations in accordance with the user instructions in step 380.

In an embodiment of the invention, the security module 18 can be implemented by firmware, for example, in a BIOS or an application specific integrated circuit (ASIC). After receiving the activation signal in step 310, the security module 18 in the BIOS or ASIC is started to confirm whether the electronic device 10 is inserted into at least one external storage device (step 310), and whether the password input by the user at the time of power-on is consistent with the current one. A confirmation password inserted into the external storage device memory (step 320), and a flag currently inserted into the external storage device memory conforms to the unique tag of the electronic device 10 (step 330). The electronic device 10 is allowed to execute the system software 20 in step 350 only if the confirmation is completed.

In another embodiment of the present invention, the security module 18 can be implemented by software, for example, a boot protection software included in a kernel of the operating system of the electronic device 10. After receiving the startup signal in step 310, the boot protection software is executed to confirm whether the electronic device 10 is inserted into at least one external storage device (step 310), and whether the password input by the user at the booting time conforms to the current external storage device memory. The confirmation password (step 320), and whether the tag currently inserted into the external storage device memory conforms to the unique tag of the electronic device 10 (step 330). The electronic device 10 is allowed to execute the system software 20 in step 350 only if the confirmation is completed. It should be noted that the implementation of the security module 18 does not limit the scope of the invention.

The present invention uses a plurality of external storage devices as the use key of the electronic device 10 to provide a password backup, so that if one of the external storage devices is accidentally lost or data corruption occurs, the user can immediately use another external storage device. Boot or wake up the program. The invention can write the password and the unique mark to a specific address (for example, a non-archive area) of the external storage device in a specific format (for example, a machine code), update the password according to the manner specified by the user, and notify the user of the latest password, because This can increase the difficulty for others to use the memory of the external storage device to obtain passwords and unique tags. The invention uses the confirmation password in the memory of the external storage device as the software key, and uses the unique mark as the hardware key. Even if others try to obtain the password, the content of the unique mark or the electronic device to which the external storage device is applied cannot be known. Therefore, the present invention can greatly improve the security of the data security system 100.

The above are only the preferred embodiments of the present invention, and all changes and modifications made to the scope of the present invention should be within the scope of the present invention.

310~390‧‧‧Steps

Claims (9)

A data confidentiality method includes: determining whether an electronic device is inserted into any external storage device after receiving an activation signal; and determining, when the electronic device is inserted into a first external storage device, whether a password input by a user meets the a first confirmation password of the first external storage device, and determining whether the first mark of the first external storage device is in conformity with a unique identifier of the electronic device; when the password entered by the user meets the first confirmation When the password and the first mark meet the unique mark, the electronic device executes a system software and updates the password according to an update frequency; the electronic device writes the updated password to the first external storage device as the first And confirming the password; and the electronic device notifying the user of the updated password through at least one contact method. The data privacy method of claim 1, further comprising: when the electronic device is not inserted into any external storage device, when the password input by the user does not comply with the first confirmation password, or when the first token When the unique mark of the electronic device is not met, the electronic device performs a shutdown operation. The data privacy method of claim 1, further comprising: before receiving the activation signal, the electronic device requests the user to input a first password, the at least one contact mode, and the update frequency; and receiving the Before the signal is activated, the electronic device writes the first password to the first external storage device as the first confirmation password, and writes the unique identifier to the first external storage device as the first identifier. The data security method of claim 1, further comprising: when the electronic device is inserted into a second external storage device, determining whether the password input by the user meets a second confirmation password of the second external storage device memory And determining whether the second mark of one of the second external storage devices meets the unique mark of the electronic device; and when the password entered by the user matches the second confirmation password and the second mark conforms to the unique mark The electronic device executes the system software. The data privacy method of claim 4, further comprising: before receiving the activation signal, the electronic device requests the user to input a first password, the at least one contact mode, and the update frequency; and receiving the Before the signal is activated, the electronic device writes the first password to the first external storage device as the first confirmation password, and writes the first password to the second external storage device as the second confirmation password. The unique indicia is written to the first external storage device as the first indicia, and the unique indicia is written to the second external storage device as the second indicia. The data security method of claim 4, further comprising: before receiving the activation signal, the electronic device requests the user to input a first password, a second password, the at least one contact method, and the update frequency; And before receiving the activation signal, the electronic device writes the first password into the first external storage device as the first confirmation password, and writes the second password into the second external storage device as the first And confirming the password, writing the unique mark to the first external storage device as the first mark, and writing the unique mark to the second external storage device as the second mark. The method for securing data according to claim 1, further comprising: when the electronic device is in a power off state, pressing a power button of the electronic device to generate the activation signal; or when the electronic device is in a power saving mode In operation, any key of the electronic device is pressed to generate the activation signal. An electronic device having a unique mark and comprising: a specific storage area carrying a system software; and a security module configured to: after receiving an activation signal, determine whether the electronic device is inserted into any external storage device; When the electronic device inserts a first confirmation password and a first external storage device of the first identifier, determining whether a password input by a user meets the first confirmation password, and determining whether the first marker meets the a unique mark; when the password entered by the user meets the first confirmation password and the first mark conforms to the unique mark, the electronic device executes the system software, and updates the password according to an update frequency; and controls the electronic device The updated password is written to the first external storage device as the first confirmation password, and the updated password is notified to the user through at least one contact method. An external storage device detachably electrically connected to an electronic device, the electronic device having a unique mark and carrying a system software, the external storage device comprising: a confirmation password; a mark; When the electronic device is inserted into the external storage device, and the electronic device receives an activation signal, it determines whether a password input by a user meets the confirmation password, and determines whether the tag conforms to the unique tag; When the password input by the user meets the confirmation password and the mark conforms to the unique mark, the electronic device executes the system software, updates the password according to an update frequency, and notifies the updated password to the password through at least one contact method. The user.