TWI741294B - Control system and method for executing access device - Google Patents

Abstract

The present invention aims to disclose a control system and method for executing an access device, which connects a server with a program from a host, and detects and obtains an identification code of at least one access device electrically connected to the host Then, send it to the server. The server queries an access authority of the access device according to the identification code, and correspondingly sends a control command to the host, and the host sets the access authority of the access device to the host according to the control command. This way, the flow of data stored and retrieved by the access device on the host can be controlled to enhance information security.

Description

Control system and method for executing access device

The present invention relates to a control system, and particularly refers to a system and method for managing and controlling an access device connected to a host to perform operations of storing and fetching data.

An access device (such as a flash drive) that is generally used to store and retrieve data. Its operation mode is connected to a host (such as a computer) with a port (such as a USB port) and used as a plug-and-play device . Once the access device and the host complete the electrical connection relationship, the data stored in the access device can be stored in the host, or the data can be read from the host and stored in the access device, which has considerable convenience.

However, given that the affairs handled by some agencies are subject to highly confidential information, if a complete control system is not established in management, it is easy to cause any person to obtain sensitive information through the access device, and there are security concerns. problem.

Therefore, if there is a complete control system that can be established to classify the confidentiality and importance of each data at different levels, and supplemented with the authorization to grant access to the device in accordance with the data level, the information can be effectively controlled. The utility of safety.

For this reason, the inventor of the present invention has made improvements in view of the above-derived problems, and started to develop solutions with the idea of inventing improvements. After many years of thinking, the present invention is used to implement the control system of the access device and The method is produced to serve the public and promote the development of this industry.

The purpose of the present invention is to provide a control system and method for executing an access device, which uses the electrical connection relationship between the host and the server, supplemented by programs and control instructions. To exchange information such as commands, identification codes, etc., to set the access authority of the access device on the host, and to obtain the flow of data access between the two components, thereby enhancing information security.

In order to achieve the aforementioned objectives and effects, the present invention discloses a method for executing an access device, which includes: a host and a program are connected to a server; when it is detected that at least one access device is connected to the When the host is the host, obtain an identification code of the access device and send it to the server through the program; the server queries an access authority of the access device according to the identification code; the server correspondingly sends a control command to The host; and the host sets the access authority of the access device on the host according to the control command.

In addition, the present invention discloses a control system for executing an access device, which includes: a server; a host provided with a program, the host is connected to the server via the program; and at least one access device is electrically connected The host, the host detects and obtains an identification code of the access device, and the host sends the identification code to the server through the program; wherein, the server queries one of the access devices according to the identification code. Obtain the authority, and correspondingly send a control command to the host via the server, and the host sets the access authority of the access device to the host according to the control command.

1: server

10: Control instructions

3: host

30: program

32: file system

5: Access device

50: identification code

7: Database

S11: steps

S13: steps

S132: Step

S134: Step

S136: Step

S15: steps

S152: Step

S154: Step

S156: Step

S17: steps

S19: steps

The first figure: it is the flow chart of the first embodiment of the present invention; the second figure: it is the schematic diagram of the control system of the first embodiment of the present invention; the third figure A: it is the detection of the first embodiment of the present invention The operation diagram of the access device; the third diagram B: it is the operation diagram of the access authority of the first embodiment of the present invention; and the fourth diagram: it is the schematic diagram of the control system of the second embodiment of the present invention.

In order to enable your reviewer to have a further understanding and understanding of the features of the present invention and the effects achieved, only examples and detailed descriptions are provided. The embodiments are used to describe the present invention in detail; however, the concept of the present invention may be embodied in many different forms and should not be construed as being limited to the exemplary embodiments set forth herein.

Here, the flow steps executed by the method for executing the access device of the first embodiment of the present invention are described. Please refer to the first figure, which is a flowchart of the first embodiment of the present invention. As shown in the figure, the method for executing the access device of this embodiment includes the following steps: Step S11: a program of a host is connected to a server; Step S13: When it is detected that at least one access device is connected to the When the host is the host, obtain an identification code of the access device and send it to the server via the program; Step S15: The server queries an access authority of the access device according to the identification code; Step S17: The server Correspondingly, a control command is sent to the host; and step S19: the host sets the access authority of the access device to the host according to the control command.

Next, the structure and composition required by the method for executing the access device of the first embodiment of the present invention will be explained. Please refer to the second figure, which is a schematic diagram of the control system for executing the access device according to the first embodiment of the present invention. As shown in the figure, the control system for executing the access device of this embodiment includes: a server 1; a host 3 with a program 30, and the host 3 is connected to the server 1 via the program 30; and at least one access device 5. The host 3 is electrically connected, and the host 3 detects and obtains an identification code 50 of the access device 5. The host 3 sends the identification code 50 to the server 1 through the program 30; wherein, the server 1 queries the storage according to the identification code 50 Take one of the access rights of the device 5, and send a corresponding control command 10 to the host 3 via the server 1, and the host 3 sets the access rights of the access device 5 to the host 3 according to the control command 10.

The aforementioned host 3 is a computer, or an electronic computer, which has a built-in file system 32 that can obtain the identification code 50 of the access device 5, and when the access device 5 is electrically connected When the host 3 is used, the file system 32 can obtain the identification code 50 of the access device 5 (such as the resident program of a universal serial bus controller) in real time, and then send it to the server 1 by the program 30; among them, the file system 32 can be a computer Execute an operating system (such as Windows, Macintosh), or as a subsystem of the operating system.

The aforementioned access device 5 is a flash drive, such as a USB flash drive (USB flash drive), also known as flash drive, U disk, flash memory, etc.; the access device 5 can also be a mobile hard drive (Portable storage device). ), also known as a portable storage device.

The above-mentioned identification code 50 is a unique identification code (Unique Identifier, abbreviated UID). When each access device 5 is factory preset, there is an identification code 50 that belongs to the special identification access device 5, which is a unique identification. code.

Please refer to Fig. 3A and Fig. 3B together, which are the action diagrams of the access detection device and the action diagrams of the access authority of the first embodiment of the present invention. The method flow of the first embodiment of the present invention will be described below. First, before the host 3 and the access device 5 are electrically connected to obtain the identification code 50, step S11 is performed: a program of a host is connected to a server. As shown in Figure 3A, in step S13, step S132 is first performed to determine whether at least one access device 5 has access to data. When at least one access device 5 is directly plugged into the connection port of the host 3 ( Not shown), indirectly connected to the host 3 through a transmission line (not shown), or connected to the host 3 in a wireless transmission mode to complete the electrical connection relationship. The file system 32 detects that the host 3 has an access device 5 Link, you can get the identification code 50 of the access device 5, and then send the obtained identification code 50 to the server 3 via the program 30 (step S134); if the host 3 does not detect the access data of the access device 5 The operation is continuously detected whether there is an operation of accessing data of the access device 5 (such as step S136).

Following the above, after the server 1 obtains the identification code 50, it queries the access authority of the access device 5 on the host 3 according to the identification code 50 (as in step S15), and then sends a control command 10 to the host 3 (as in step S17), where As shown in Figure 3B, the server 1 queries the access authority of the access device 5 according to the identification code 50, and determines whether to activate the access action of the access device 5. When the access authority of the access device 5 is When there is no restriction, step S154 is executed. When the access of the access device 5 is When the permission is locked, step S156 (such as step S152) is executed. When it is determined that the access permission of the access device 5 is unlimited, the server 1 generates a control command corresponding to the activation of the access device 5 so that the access device 5 can Perform the operation of accessing data (such as step S154). When determining that the access device is locked, the server 1 generates a control command corresponding to the locked access device 5 to deny the access device 5 to perform the operation of accessing the data (such as step S156). ). After that, the host 3 judges that the access device 5 can be granted the permission to store/retrieve data according to the control command 10, and then determines the execution mode of the access device 5 for storing or/and fetching data in the host 3 (such as step S19).

In detail, the data of the host 3 can be defined by the user with a plurality of confidential levels within the host 3, or after the server 1 is electrically connected to the host 3, the confidentiality level of the data is determined, and the authority is assigned through the control command 10; Among them, the confidentiality level classification of the data, for example, can be defined as the first-level data as ordinary data, the second-level data as the important data, and the third-level data as the extremely important data, and so on. In other words, once the server 1 queries the identification code 50 of the access device 5, it continuously monitors the data flow between the host 3 and the access device 5 according to the control command 10.

The host 3 can set the file system 32 according to the control command 10 to set the access authority of the access device 5 in the host 3; or the host 3 receives the control command 10 to the file system 32, and the file system 32 sets the access device according to the control command 10 5Access permissions on host 3. It can also be that when the access device 5 is detected, it is determined whether the access device 5 accesses the data according to the security according to the setting, and the permission of the access device 5 to execute/lock the access action is determined.

The reverse is also true. Once the user receives a message from the host 1, and determines that the access device 5 cannot be given access to the file/data D, the host 1 can operate the lock access device 5 and refuse the access device 5 to execute Any access actions. Or when the host 3 receives the refusal command from the person holding the mobile device, the access device 5 is locked to perform the storage and retrieval operations, so that the access device 5 cannot store and read files/data at any time like a normal flash drive. It is also possible that the host 3 determines that the access device 5 stores and retrieves data according to the setting of the control command 10 that does not comply with the security, that is, the access device 5 is immediately locked.

In addition, when an action is detected and the data pre-accessed by the access device 5 is judged to be the first level, the access device 5 can directly execute the data saving or/and fetching action, and there is no need to send a warning message notification at this time. Only monitor and detect actions. When it is judged that the data D pre-stored and retrieved by the access device 5 is above the first level, that is, the second level of important data, or the third level of extremely important data and other confidential data, the actions described above can be performed. Therefore, the file system 32 can be set according to the control command 30, and the operation of the access device 5 can be determined based on the importance of the confidentiality of the data. Furthermore, the server 1 can be electrically connected to a plurality of hosts 3, and correspondingly provide a plurality of control commands 10 to each host 3, so as to control the access device 5 connected to each host 3, and perform data storage and retrieval. Flow direction.

Here, any access device 5 that is electrically connected to the host 3 has its own identification code 50, and after the host 3 is electrically connected to the access device 5, the corresponding connection port location, path, etc. News. After querying the identification code 50 through the server 1, you can send a control command 10 to the host 3 to monitor, detect, grant permissions and other actions for the storage and read file/data actions of the access device 5 on the host 3. In order to ensure the security of the data flow, to prevent interested persons from stealing important data or maliciously spreading viruses, which can effectively improve information security.

Here, the structure and composition required by the method for executing the access device of the second embodiment of the present invention will be described. Please refer to Figure 4, which is a schematic diagram of the control system for executing the access device according to the second embodiment of the present invention. As shown in the figure, the difference between the second embodiment of the present invention and the first embodiment is that it further includes a database 7, which is electrically connected to the server 1, receives the identification code 50 sent by the server 1 for storage, and provides a server The device 1 consults related records such as the past identification code 50 and the newly added identification code 50; among them, the database 7 can be a hard disk with a hardware architecture, or a network storage space with a software architecture.

The similarities and differences between the second embodiment of the present invention and the first embodiment are that in step S15: the server queries an access authority of the access device according to the identification code, the server determines that the identification code is the first in a database The control command is generated for the second acquisition; or the server determines that the identification code is not acquired for the first time in a database and generates the control command. When program 30 transmits identification After the code 50 arrives at the server 1, the server 1 compares the database 7 to determine whether the identification code 50 has been received before, and further determines the permission level assigned to the access device 5 to generate the control command 10. That is, after querying the identification code 50 in the database 7 through the server 1, it is further determined that the control command 10 grants the access device 5 the authority to store and retrieve data from the host 3. If it is the ID 50 information obtained for the first time, it is granted the most basic usage rights, and if it is the ID 50 information obtained for the first time, it can be judged as a trusted device, and the basic usage rights are granted. .

In summary, the present invention has indeed achieved the intended purpose and effect of use, and is more ideal and practical than conventional techniques; however, the above-mentioned embodiments are only detailed descriptions of the preferred embodiments of the present invention, and are not intended to To limit the scope of patent application of the present invention, all other equivalent changes and modifications completed without departing from the technical means disclosed in the present invention shall be included in the scope of patent application covered by the present invention.

S11: steps

S13: steps

S15: steps

S17: steps

S19: steps

Claims (9)

A method for executing an access device, comprising: a program of a host is connected to a server; when it is detected that at least one access device is connected to the host, an identification code of the access device is obtained, and Send to the server through the program; the server queries an access authority of the access device according to the identification code; the server determines that the identification code is obtained for the first time in a database and generates the control command; the The server correspondingly sends a control command to the host; and the host sets the access authority of the access device to the host according to the control command. The method for executing an access device as described in item 1 of the scope of patent application, wherein in the step in which the server queries an access authority of the access device according to the identification code, the server determines in a database The identification code is not obtained for the first time to generate the control command. The method for executing an access device as described in item 1 of the scope of patent application, wherein in the step of setting the access device to the access authority of the host according to the control command by the host, the host according to the control command Set up a file system to set the access authority of the access device on the host. The method for executing an access device as described in item 1 of the scope of patent application, wherein in the step of setting the access device to the access authority of the host according to the control command by the host, the host receives the control command To a file system, the file system sets the access authority of the access device on the host according to the control command. A control system for executing an access device, comprising: a server; a host provided with a program, the host is connected to the server via the program; and at least one access device is electrically connected to the host, the host Detect and obtain an identification code of the access device, and the host sends the identification code to the server through the program; Wherein, the server queries an access authority of the access device according to the identification code, and correspondingly sends a control command to the host via the server, and the host sets the access device to the host according to the control command. Access rights. For example, the control system for executing the access device described in item 5 of the scope of patent application further includes a database, connected to the server, and the server determines that the identification code is obtained for the first time from the database and generates the Control instruction. For example, the control system for executing the access device described in item 5 of the scope of patent application further includes a database, which is connected to the server, and the server determines that the identification code is not obtained for the first time based on the database. Generate the control command. For example, the control system for executing an access device as described in item 5 of the scope of patent application, wherein the host sets a file system according to the control command to set the access authority of the access device on the host. For example, the control system for executing an access device as described in item 5 of the scope of patent application, wherein the host receives the control command to a file system, and the file system sets the access device to the storage of the host according to the control command. Take permissions.

Images