CN100476764C - Storage device and protection method of storage data thereof - Google Patents

Abstract

A storage device and a method for protecting the stored data are disclosed, the storage device basically comprises a control module connected to a terminal host, a biosensor connected to the control module and a storage module. The terminal host executes a biological identification application program to inform the control module to control the biological sensor to read a biological data to be identified of the user and compare whether the biological data to be identified is matched with the template biological data in the storage device. After the comparison is matched, the host executes a host random code generating program to generate and transmit a group of host random codes back to the control module. The control module generates a set of device random codes by utilizing a device random code generating program stored in the control module, compares whether the device random codes are matched with the host computer random codes or not, and enables the host computer to access a data protection unit of the storage device according to a matching result. The invention not only captures the advantages of the independent device, but also can prevent the device from being cracked, and does not need to increase the cost.

Description

A storage device and method for protecting data stored therein

technical field

The invention relates to a storage device and a protection method for storing data thereof, in particular to a storage device containing a fingerprint sensor and a protection method for storing data thereof. The present invention is also related to the following patents of some inventors: (a) Chinese invention patent application number 200310116995.X, the application date is December 5, 2003, and the title of the invention is "memory storage device with fingerprint sensor and its storage (b) China Invention Patent Application No. 200410038204.0, the application date is May 13, 2004, and the title of the invention is "portable encrypted storage device with biometric identification and protection method for its stored data"; And (c) China Taiwan Invention Patent Application No. 094101590, the application date is January 19, 2005, and the title of the invention is "a storage device and its storage data protection method".

Background technique

Traditionally, the simplest way to represent a person's identity is a document, such as an ID card, a driver's license, etc., with personal photos and text and digital records attached to it. However, the counterfeiting of identity documents is too easy, and thus causes many crimes.

A further improvement method is to use magnetic stripe cards to record personal data. Similarly, the advancement of technology makes magnetic stripe cards easy to crack.

The latest approach is to protect personal data in a secure way using chip cards. Basically, regarding the confidentiality of personal data by memory chips, the most commonly used method is password protection. However, using passwords to protect personal data not only has the trouble of users forgetting passwords, but also has the danger of passwords being cracked.

At the same time, the above-mentioned devices representing personal identity (except the chip card) can only perform a single function, and cannot integrate multiple applications into a single device.

Therefore, U.S. Patent Publication No. 2003/0110389 A1 discloses a personal identification electronic device similar to a solid-state memory flash drive, which contains encrypted personal data and can be directly connected to a computer system for use. However, this personal identification electronic device also needs a password setting to open it, which faces the aforementioned problems. The best way to solve this problem is to use unique personal biometrics, such as fingerprints, voiceprints, handwriting, iris and other biometric methods to provide a more complete and effective data protection method. Its advantage is that the biometric feature is portable and does not need to be memorized, and it cannot be stolen. In particular, the biometric feature protection method combined with fingerprints is not only strict, but also very convenient to use.

In recent years, thanks to the invention of the chip-type fingerprint sensor, it is no longer an unfeasible technology to integrate a fingerprint reading device into a thin, light and small electronic product. For related technical content, please refer to the following patents of Zhou Zhengsan, one of the inventors in this case: 1. China Invention Patent Application No. 02105960.8, the application date is April 10, 2002, the invention name is "capacitive fingerprint reading chip", the publication number is 1450489; 2. China Invention Patent Application No. 02123058.7, the application date is On June 13, 2002, the name of the invention was "Pressure-type fingerprint reading chip and its manufacturing method", and the publication number was 1464471; It is "Temperature Sensor and Its Fingerprint Recognition Chip Using the Temperature Sensor", the publication number is 1463674; and 4. The Chinese Invention Patent Application No. 02132054.3, the application date is September 10, 2002, and the invention name is "capacitive pressure micro Sensor Element and Its Application Fingerprint Reading Chip Structure", the publication number is 1482440. This also opens up a new way of protecting personal storage media.

As early as 20 years ago, US Patent No. 4,582,985 disclosed a storage medium protection method, wherein fingerprint authentication was used to protect the personal data stored in the personal identification card device. After the fingerprint identification procedure is passed, the protected data stored in the card device can be output for subsequent processing or authentication procedures. The size of this device is the same as that of a current general-purpose credit card, and it mainly includes a fingerprint sensor, an image processing and identification module, and a storage memory, and becomes a completely independent fingerprint identification device (that is, fingerprint capture and identification are all in the executed on the same device).

Chinese patent CN1302018A discloses a method for controlling the read and write rights of a data storage device through fingerprint identification. However, this patent does not explicitly disclose the format and interface of the storage device.

Similarly, European Patent EP124079A1 also discloses the same data protection concept as the above-mentioned US Patent No. 4,582,985, but the difference is that its communication interface is a golden finger design for SD card interface. In addition, the memory device of the EP124079A1 patent has a fingerprint identification module, and its data protection concept is the same as that of the CN1302018A patent, except that the communication interface of the EP124079A1 patent is a golden finger structure for the SD card interface. Similarly, US Patent Publication No. US2001/0023375 A1 also discloses a method for protecting data stored in a hard disk or a flash disk through fingerprint identification.

World Patent WO 02/42887A2 discloses a data protection concept similar to the aforementioned US Patent No. 4,582,985 and European Patent EP124079A1, but the difference is that the communication with the terminal system is performed through the USB interface. This device is similar to the current market The difference is that it contains an independent fingerprint processing and identification module.

U.S. Patent Publication No. 2003/005337 discloses the same data protection concept as the aforementioned U.S. Patent No. 4,582,985 and European Patent EP124079A1, and also uses USB as a communication interface as disclosed in World Patent WO 02/42887A2. However, it is also a stand-alone fingerprint recognition device.

British Patent No. GB2387933 also discloses an almost identical concept and device design to WO 02/42887A2 and U.S. Patent Publication No. 2003/005337, which is an independent fingerprint identification device.

So far, the above-mentioned inventions containing fingerprint recognition devices are only used for data protection, except that the US Patent No. 4,582,985 discloses that they are applied to representatives of personal identity documents, and do not cover this application and function.

In addition, the basic requirement of the above-mentioned portable storage device including the fingerprint identification device is to enable the user to connect the storage device to different computer systems for use. However, even if the USB interface is used for the above-mentioned storage device design with fingerprint identification function in the prior art, it is still necessary to install a fingerprint application program on the computer system in advance, so that the computer system can provide a man-machine interface for the user to use conveniently. The traditional method is to provide a CD for the user to install the fingerprint application program, so that the entire storage device can be used conveniently. In this case, in the first setting of each computer system, in addition to carrying the portable storage device, the user also needs to carry a CD to use the storage device in other computer systems.

In summary, the purpose of the above known technologies is to provide a storage device for protecting stored data through fingerprint identification. When using this device, the user must install the fingerprint application software in the terminal system in advance. Therefore, the fingerprint application program in the storage device cannot be easily plugged and played in various computers.

So far, the aforementioned known technologies have a common feature, that is, to provide an independent fingerprint identification device, which includes a fingerprint sensor, fingerprint image processing and identification IC. The advantage of such a design is that it may not need to install the fingerprint application program on the terminal system side and provide the convenience of hot plugging, but it leads to another important problem, that is, it is expensive, because a fingerprint image processing and fingerprint processing must be added. The cost of identifying IC and its supporting design, usually the IC is a 32-bit Reduced Instruction Set Computer (Reduced Instruction Set Computer, RISC) or Digital Signal Processor (Digital Signal Processor, DSP), in order to quickly perform fingerprint identification. Therefore, the conventional portable storage device with a fingerprint sensor has the disadvantage of high cost.

In order to solve the problem of high cost, the best way is to use the microprocessor of the terminal system to perform fingerprint image processing and identification, which can effectively reduce the cost. However, the currently known technology does not clearly disclose and propose a solution to this method.

Because if the work of fingerprint image processing and identification is to be transferred from the storage device to the microprocessor of the terminal system, the inventive device must have automatic downloading of fingerprint application programs (comprising fingerprint image processing, identification and encryption and decryption functions, etc.) etc.) in the function of the terminal system, in order to achieve the function of hot plugging, and the convenience that can be used in any terminal system. Such a solution is also not provided by the known techniques described above.

For this reason, the inventor of this case discloses a design of automatic execution (AutoRun) fingerprint identification and application program in the terminal system in the above-mentioned patents (a) to (c), the storage device is cut into several areas, and the One area is simulated as a CD-ROM (let the terminal system recognize the CD-ROM device), and the fingerprint identification and application programs stored in this area can be automatically executed. The method solves the high cost of the known technology (requiring an independent identification device) or the need to install fingerprint identification software on the computer in advance.

In these inventions, the processing and comparison of fingerprint images are all carried out in the terminal system, and after the comparison is completed, the storage device is notified to open read and write permissions through a special command.

Such a design still has some disadvantages, that is, if someone can intercept the special command at the terminal host, the security of the storage device may be cracked without fingerprint comparison.

Continuing the above-mentioned invention, the inventor of this case will further provide a protection method for stored data, which can completely protect the storage device of the present invention from being retrieved from the key to open the storage device when the terminal system is operating.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a storage device and a method for protecting data stored therein. The storage device is connected to a terminal host, and by cooperating with the terminal host, the storage device can be saved without greatly increasing the storage capacity. Provide an effective data protection method for a storage device including a fingerprint sensor at a low cost.

Another object of the present invention is to provide a storage device and a method for protecting stored data thereof, which can prevent the special command of the terminal host to control the opening of the storage device from being intercepted and lose the function of data protection.

To achieve the above object, the present invention provides a storage device used to connect with a terminal host, and the terminal host is used to execute a biometric identification application program and a host garbled code generation program. The storage device basically includes: a host interface for connecting with the terminal host; a control module connected to the host interface and including a microprocessor, a random access memory (RAM) and a Read-only memory (ROM), the RAM is used as a working memory during data processing, and the ROM stores firmware that makes the storage device work and a device garbled code generation program; a biosensor, which is connected to the control module, A biometric data to be identified for sensing a user; a data protection unit, which is connected to the control module, and used to store a data to be protected; and a storage module, which is connected to the control module, for A template biological data is stored. The template biological data is uploaded to the terminal host through the microprocessor of the control module. Under the guidance of the biological identification application program, the control module controls the biological sensor to read the biological data to be identified of the user, and transmit the biological data to be identified to the terminal host. The terminal host uses the biometric application program to process and compare the biometric data to be identified with the template biometric data, and judges whether the two are consistent, and uses the host garbled code generation program to generate a garbled code program key that is updated at any time when they match. The group host is garbled, and the host is garbled and returned to the microprocessor. The microprocessor utilizes the device garbled code generation program to generate a group of device garbled codes according to the garbled code program key updated at any time, and when comparing the device garbled codes with the host machine garbled codes, the data protection unit is enabled (enable) to Access by the terminal host, otherwise the data protection unit is disabled to prevent the terminal host from accessing.

To achieve the above object, the present invention also provides a method for protecting data stored in a storage device, which basically includes the following steps: connecting the storage device with a terminal host; executing a biometric application program on the terminal host; A template biometric data is sent to the terminal host; a user is guided to use a biosensor of the storage device, so that the biosensor captures a biometric data of the user to be identified, and the biometric data to be identified is transmitted to the terminal host; Use the biometric application program to process and compare the biological data to be identified and the template biological data, and judge whether the two match, and use a host random code generation program to generate a set of host random codes according to a random code program key updated at any time, And return the garbled code of the host to the storage device; and use a device garbled code generating program in the storage device to generate a group of device garbled codes according to the garbled code program key updated at any time, and compare this group of device garbled codes with this group of hosts When the garbled codes match, a data protection unit of the storage device is enabled to be accessed by the terminal host, otherwise, the data protection unit is disabled to prevent the terminal host from accessing.

Through the above-mentioned device and method of the present invention, since the comparison of complex biological data is performed in the terminal host, the storage device itself does not need a high-end microprocessor. In addition, after the biological data comparison is successful, the signal sent by the terminal host is not simply a signal to open the data to be protected, but a set of varied signals. Even if it is intercepted, the data to be protected will not be exposed. This is because the enabling and disabling of the final data protection unit is carried out in the control module, and the comparison data of the control module is two sets of variable garbled codes. Only after the two sets of garbled codes are compared successfully can the data security unit be turned on. management authority, so it can effectively prevent it from being cracked. The comparison of garbled characters is quite simple and can be processed by a microprocessor such as an 8051 processor, so that the present invention captures the advantages of an independent device without increasing the cost.

Description of drawings

FIG. 1 shows a schematic diagram of a connection state between a storage device and a terminal host according to a first embodiment of the present invention.

FIG. 2 is a schematic diagram showing a connection state between a storage device and a terminal host according to a second embodiment of the present invention.

FIG. 3 is a schematic diagram showing a connection state between a storage device and a terminal host according to a third embodiment of the present invention.

FIG. 4 shows a flowchart of a method for protecting a storage device according to a fourth embodiment of the present invention.

Description of main component symbols:

1～storage device 2～terminal host

10～control module 10A～microprocessor

10B～Random Access Memory (RAM) 10C～Read Only Memory (ROM)

12～host interface 16～storage interface

20～storage module 21～application block

22～Public block 24～Confidential block/data protection unit

26～Hide block 30～Biosensor

40～memory expansion slot 50～external memory/data protection unit

60～encryption/decryption chip 70～storage interface expansion slot

80～mass storage unit/data protection unit 210-310～method steps

Detailed ways

FIG. 1 shows a schematic diagram of a connection state between a storage device and a terminal host according to a first embodiment of the present invention. As shown in FIG. 1 , a storage device 1 of this embodiment is used to connect with a terminal host 2 . The terminal host 2 is used to execute a biometric identification application program and a host garbled code generation program. The biometric application program and the host garbled code generation program can be pre-stored in the storage device 1, and then the terminal host 2 can be automatically executed by means of Auto Run.

The storage device 1 basically includes a host interface 12 , a control module 10 , a biosensor 30 , a storage module 20 and a data protection unit 24 . The host interface 12 is used to connect with the terminal host 2 . The host interface 12 can be a Universal Serial Bus (USB) interface, a PCMCIA interface, a SATA interface, a PCI high-speed (PCI EXPRESS) interface or an IEEE 1394 interface or other standard interfaces. The control module 10 is connected to the host interface 12 and includes a microprocessor 10A, a random access memory (RAM) 10B and a read only memory (ROM) 10C. The RAM 10B is used as a working memory for data processing, and the ROM 10C stores firmware (firmware) that enables the storage device 1 to work and a device garbled code generation program. The microprocessor 10A, RAM 10B and ROM 10C can be integrated in a single chip to form a single chip design. Therefore, the task of the control module 10 is to communicate with the terminal host 2 and manage the storage module 20 and the biosensor 30 at the same time.

The biosensor 30 is connected to the control module 10 for sensing a biometric data of a user to be identified. The biological sensor 30 can sense the user's biological data, such as fingerprints, iris, voice, handwriting or other biological data, and the biological sensor 30 can be an area type fingerprint sensor, a sliding fingerprint sensor, a voiceprint sensor, a An iris sensor or a face sensor or other types of biometric sensors, the following will only be described with a fingerprint sensor.

The storage module 20 is connected to the control module 10, and is used to store a template biometric data and a garbled code program key updated at any time (the garbled code program key can also be generated by the fingerprint application program every time it is used, without prior storage in the storage module 20). The so-called template biological data is the first biological data left by the owner of the storage device 1 when using the device for the first time. This fingerprint data is used as a benchmark for comparison with subsequent fingerprint data. The storage module 20 can be a memory module or a hard disk device, and the memory module is selected from a non-volatile memory, such as a flash memory, a programmable read-only memory (PROM), a read-only memory, or an electrically erasable In addition to read-only memory (EEPROM) and so on. Hard drive units have the same cut. In this embodiment, the storage module 20 is divided into an application block 21 , a public block 22 , a security block 24 and a hidden block 26 . The security block 24 is used as a data protection unit, so it is also connected to the control module 10 and used to store a data to be protected. In the case that the terminal host 2 is to automatically execute the biometric identification application program and the host garbled code generation program, the biometric identification application program and the host garbled code generation program can be stored in the application program block 21 . In addition, the application block 21 is simulated as an optical disk storage device, so that the terminal host 2 connected to the storage device 1 automatically executes the biometric application program and the host garbled code generation program. The garbled code generation program of the host computer and the garbled code generator program of the device have the same program logic, that is, the same garbled codes can be generated according to the same garbled code program key. The public block 22 (which can be selectively designed to exist or not) can store public programs and data, so that users can use the public programs and data without going through the biometric authentication process. In one embodiment, the biometric data of the template and the garbled program key updated at any time are stored in the hidden block 26 . In another embodiment, the garbled program key is not pre-stored in the hidden block 26, but is generated by the fingerprint application program according to the fingerprint characteristics (taken from the biological data to be identified) each time it is used, or combined with the fingerprint characteristics and a Mathematical operations are generated. The so-called garbled program key updated at any time refers to the initial value of the garbled code generation program supplied to the host and the device. The garbled program key updated at any time will be updated after each successful comparison between the host garbled code and the device garbled code to ensure this storage. The device cannot be easily hacked.

When the storage device 1 is connected to the terminal host 2 , the template biometric data and the garbled program key updated at any time are uploaded to the terminal host 2 through the microprocessor 10A of the control module 10 . Then, under the guidance of the biometric application program executed by the terminal host 2 , the control module 10 controls the biosensor 30 to read the user's biometric data to be identified, and transmit the biometric data to be identified to the terminal host 2 . Next, the terminal host 2 uses the biometrics application program to process, and compares the biological data to be identified with the template biological data, and judges whether the two are substantially consistent, and when they are substantially consistent, use the host garbled code generation program based on the garbled code program updated at any time Key to generate a group of host computer garbled codes, and send the host computer garbled codes back to the microprocessor 10A. The host computer garbled codes can be sent back directly, or encrypted and then sent back (in the microprocessor 10A, it must be decrypted first and then comparison), or combined with a communication protocol (such as a communication protocol for communicating with a USB controller). If the garbled program key is generated by the fingerprint application program every time it is used, its return method can also be the same as the return method of the above-mentioned host garbled code. It is worth noting that the comparison method of biological data can be in the form of graphic comparison, feature point comparison, etc. Then, the microprocessor 10A uses the device garbled code generation program to generate a set of device garbled codes according to the garbled code program key updated at any time, and when the set of device garbled codes is substantially consistent with the set of host garbled codes, the data protection unit 24 is enabled. for the terminal host 2 to access, otherwise the data protection unit 24 is disabled to prevent the terminal host 2 from accessing.

FIG. 2 is a schematic diagram showing a connection state between a storage device and a terminal host according to a second embodiment of the present invention. As shown in Figure 2, this embodiment is similar to the first embodiment, the difference is that the storage device 1 of this embodiment further includes a memory expansion slot 40, which is electrically connected with the control module 10, and is used for connecting with an external memory 50 to increase the memory capacity of the storage device 1 . The storage expansion slot 40 is used to expand the capacity of the memory of the device of the present invention in essence, or by treating the device as a reader (memory reader) of an external storage 50, the external storage is such as a CF card, an intelligent medium ( smart media), memory stick (memory stick) or other external memory with standard interface, or hard disk (especially hard disk of one inch or smaller, also known as microdrive). The external memory 50 is enabled for the terminal host 2 to access when the set of device garbled codes substantially matches the set of host garbled codes. After the external memory 50 is inserted into the memory expansion slot 40, the control module 10 plans the external memory into a single expanded security block for storing additional data to be protected.

In addition, the external memory 50 in FIG. 2 can also be used as a data protection unit alone, which is connected to the control module 10 through the memory expansion slot 40 . In this case, the security block 24 of the storage module 20 can be omitted. After the external memory 50 is inserted into the memory expansion slot 40, the control module 10 plans the external memory into a single expanded security block for storing data to be protected.

FIG. 3 is a schematic diagram showing a connection state between a storage device and a terminal host according to a third embodiment of the present invention. As shown in Figure 3, this embodiment is similar to the first embodiment, the difference is that the storage device 1 of this embodiment further includes a storage interface expansion slot 70, which is used to electrically connect a large-capacity storage unit 80 to the The control module 10 provides a storage capacity for the storage device 1 . The encryption/decryption chip 60 is connected to the control module 10 through a storage interface 16 . The storage interface expansion slot 70 is connected to the encryption/decryption chip 60 . The mass storage unit 80 is connected to the control module 10 through the storage interface expansion slot 70 and the encryption/decryption chip 60 . The mass storage unit 80 is enabled for the terminal host 2 to access when the device garbled code substantially matches the host garbled code. The data in and out of the mass storage unit 80 can be encrypted/decrypted by the encryption/decryption chip 60 . One embodiment of the mass storage unit 80 is a magnetic hard disk, especially a hard disk of 3.5 inches, 2.5 inches or other sizes; another embodiment of the mass storage unit 80 is CD-R/RW and DVD-R/RW And any size of optical disc device. Storage interface 16 and storage interface expansion slot 70 are IDE interface in the present embodiment, but also can be the interface of SCSI interface, Serial ATA interface, a Compact Flash (CF) interface, a PCMCIA interface or IEEE 1284 interface or other standards .

In addition, the mass storage unit 80 in FIG. 3 can also be used as a data protection unit alone. In this case, the security block 24 of the storage module 20 can be omitted. The data protection unit is connected to the control module 10 through the storage interface expansion slot 70 . In addition, the mass storage unit 80 is further connected to the control module 10 through the encryption/decryption chip 60 for encrypting/decrypting the data in and out of the mass storage unit 80 .

FIG. 4 shows a flowchart of a method for protecting a storage device according to a fourth embodiment of the present invention. As shown in FIG. 4 , the storage device protection method of the storage device 1 of the present invention includes the following steps.

First, after the storage device 1 is inserted into the terminal host 2 , the storage device 1 and the terminal host 2 are connected through the host interface 12 of the storage device 1 . Then, the terminal host 2 executes the biometric identification application, as shown in step 210 . Then the biometric application automatically determines whether the storage device 1 is used for the first time, and if so, asks the user whether to register his fingerprint data, as shown in step 220 . If the user chooses to register data, the fingerprint registration starts in step 225 . In this case, the biometric sensor 30 senses the fingerprint data of the user, as shown in step 235 , and then extracts a fingerprint template, as shown in step 245 , and then encrypts the template with a key, as shown in step 255 . Then, the fingerprint template data is stored in the hidden block 26 .

When the biometric application detects that there is fingerprint template data stored in the hidden block 26, the storage device 1 transmits a template biometric data stored in the storage device 1 and a garbled program key updated at any time to the terminal host 2 , as shown in steps 230 and 240. Then, the biometric application guides the user to use a biometric sensor 30 of the storage device 1, so that the biometric sensor 30 captures a biometric data of the user to be identified, and transmits the biometric data to be identified to the terminal host 2 , as shown in step 250. Next, use the biological identification application to process and compare the biological data to be identified and the template biological data, and determine whether the two are substantially consistent, as shown in step 260 . If the two do not match substantially, the user is asked whether to continue the comparison, as shown in step 270 . If the user does not continue the comparison, the entire process ends. If the user wants to continue the comparison, go back to step 250 . If the two are substantially consistent, use the host garbled code generation program to generate a set of host garbled codes according to the garbled program key updated at any time, and send the host garbled codes back to the storage device 1 , as shown in step 280 .

Then, a device garbled code generation program is used in the storage device 1 to generate a set of device garbled codes according to the garbled program key updated at any time, as shown in step 290 . Next, compare whether the random codes of the device and the random codes of the host are substantially consistent, as shown in step 300 . When the device garbled codes substantially match the host garbled codes, a data protection unit 24/50/80 of the storage device 1 is enabled for access by the terminal host 2, as shown in step 310 . Otherwise disabling the data protection unit 24/50/80 to prevent access by the end host 2 ends.

It should be noted that this method can be applied to the above three embodiments, so the details will not be described here.

Through the above-mentioned device and method of the present invention, since the comparison of complex biological data is performed in the terminal host, the storage device itself does not need a high-end microprocessor. In addition, after the biological data comparison is successful, the signal sent by the terminal host is not simply a signal to open the data to be protected, but a set of varied signals. Even if it is intercepted, the data to be protected will not be exposed. This is because the enabling and disabling of the final data protection unit is carried out in the control module, and the comparison data of the control module is two sets of variable garbled codes. Only after the two sets of garbled codes are compared successfully can the data security unit be turned on. management authority, so it can effectively prevent it from being cracked. The comparison of garbled characters is quite simple and can be processed by a microprocessor such as an 8051 processor, so that the present invention captures the advantages of an independent device without increasing the cost.

The specific embodiments proposed in the detailed description of the preferred embodiments are only used to facilitate the description of the technical content of the present invention, rather than restricting the present invention to the above-mentioned embodiments in a narrow sense, without departing from the spirit of the present invention and the scope of the patent application The situation, the implementation of various changes, all belong to the scope of the present invention.

Claims (20)

1. A storage device, used to connect with a terminal host, the terminal host is used to execute a biometric application program and a host garbled code generation program, characterized in that the storage device includes: a host interface, used to connect with the terminal host; A control module, which is connected to the host interface, and includes a microprocessor, a random access memory and a read-only memory, the random access memory is used as a working memory for data processing, and the read-only memory Firmware for making the storage device work and a device garbled code generation program are stored; a biological sensor connected to the control module for sensing a user's biological data to be identified; a data protection unit, which is connected to the control module and used to store a data to be protected; and a storage module connected to the control module for storing a template biological data; in: The template biological data is uploaded to the terminal host through the microprocessor of the control module; Under the guidance of the biometric application program, the control module controls the biometric sensor to read the biometric data to be identified of the user, and transmit the biometric data to be identified to the terminal host; The terminal host utilizes a biometric application program to process and compare the biological data to be identified with the template biological data, and judge whether the two match, and use the host garbled code generation program to generate a set of garbled code program keys that are updated at any time when they match. The host is garbled, and the host is garbled and returned to the microprocessor; and The microprocessor utilizes the device garbled code generation program to generate a set of device garbled codes according to the garbled code program key updated at any time, and when comparing the set of device garbled codes with the host machine garbled codes, the data protection unit is enabled to for the terminal host to access, otherwise the data protection unit is disabled to prevent the terminal host from accessing. 2. The storage device according to claim 1, wherein the data protection unit is a security block in the storage module. 3. The storage device according to claim 1, wherein the data protection unit is an external memory connected to the control module through a memory expansion slot. 4. The storage device according to claim 3, wherein after the external memory is inserted into the memory expansion slot, the control module plans the external memory into a single expanded security block for storing Protect data. 5. The storage device according to claim 1, wherein the data protection unit is a large-capacity storage unit connected to the control module through a storage interface expansion slot. 6. The storage device according to claim 5, wherein the large-capacity storage unit is also connected to the control module through an encryption/decryption chip for encrypting/decrypting data entering and exiting the large-capacity storage unit . 7. The storage device according to claim 1, wherein the biometric identification application program and the host garbled code generation program are stored in an application program block of the storage module. 8. The storage device according to claim 7, wherein the application program block is simulated as an optical disc storage device, so that the terminal host connected to the storage device automatically executes the biometric application program and host garbled codes are generated program. 9. The storage device according to claim 1, wherein the program for generating garbled characters of the host has the same program logic as the program for generating garbled characters of the device. 10. The storage device according to claim 1, wherein the template biometric data and the garbled program key updated at any time are stored in a hidden block of the storage module. 11. The storage device according to claim 1, characterized in that, the garbled program key which is updated at any time is stored in the storage module, and the garbled program key which is updated at any time is passed through the microcomputer of the control module. The processor is uploaded to the end host. 12 . The storage device according to claim 1 , wherein the garbled program key updated at any time is generated by the biometric application. 13 . 13. The storage device according to claim 1, wherein the garbled program key updated at any time is generated by the biometric application program according to the biometric data to be identified. 14. The storage device according to claim 1, wherein the garbled program key updated at any time is generated by the biometric application program according to the biometric data to be identified and a mathematical operation. 15. A method for protecting stored data of a storage device, comprising the following steps: connecting the storage device to a terminal host; executing a biometric application on the terminal host; transmitting a template biometric data stored in the storage device to the terminal host; guiding a user to use a biometric sensor of the storage device, so that the biometric sensor captures biometric data of the user to be identified, and transmits the biometric data to be identified to the terminal host; Process and compare the biometric data to be identified with the template biometric data with a biometric application program, and judge whether the two match, and use a host garbled code generation program to generate a garbled code program key that is updated at any time when they match. The group host is garbled, and the host is garbled and returned to the storage device; and In the storage device, a device garbled code generation program is used to generate a set of device garbled codes according to the garbled code program key updated at any time, and when the set of device garbled codes matches the set of host garbled codes, the storage device A data protection unit is enabled for the end host to access, otherwise the data protection unit is disabled to prevent the end host from accessing. 16. The method for protecting data stored in a storage device according to claim 15, wherein an application program block of the storage module is simulated as an optical disc storage device, and the biometric application program and The host garbled code generating program is used to make the terminal host connected to the storage device automatically execute the biometric application program and the host garbled code generating program. 17 . The method for protecting data stored in a storage device according to claim 15 , further comprising the step of: transmitting the garbled program key updated at any time stored in the storage device to the terminal host. 18. The method for protecting data stored in a storage device according to claim 15, further comprising the step of: using the biometric identification application program to generate a garbled program key that can be updated at any time. 19. The method for protecting stored data of a storage device according to claim 15, further comprising the step of: using the biometric identification application program to generate a garbled program key updated at any time according to the biometric data to be identified. 20. The method for protecting stored data in a storage device according to claim 15, further comprising the step of: using the biometric application program to generate a garbled program gold updated at any time according to the biometric data to be identified and a mathematical operation key.

Images