CN102375958B - Ways to Restrict File Access - Google Patents

Abstract

A method for limiting file access is carried out by a controller in a storage medium, the storage medium includes a physical storage area for storing one or more files, the controller receives a special command and executes a step of judging a file to be limited, a step of establishing a logic table of limiting conditions corresponding to each file to be limited, and a step of judging whether the limiting conditions are reached, wherein at least one limiting condition for limiting file access is stored in the logic table of limiting conditions. When the limit condition is reached, the controller deletes the content of the file corresponding to the limited access in the logical table of the limit condition and the physical storage area.

Description

Ways to Restrict File Access

technical field

The invention relates to a method for restricting file access, in particular to a method for setting access restriction conditions for an access-restricted file by using a storage medium controller to execute a special command.

Background technique

Due to the continuous development of traditional hard drives and solid-state drives, their speed and capacity have been continuously improved, and their prices have been continuously reduced. The solid-state hard drive can broadly include portable non-volatile memory, also known as a flash drive, and the capacity of the flash drive is also sufficient to accommodate a large amount of data. Therefore, the development of storage media has helped the storage, carrying and transmission of digital data.

Known storage technology such as China Taiwan Patent Announcement No. 374161 "Hard Disk Drive with File Configuration Table Memory", the hard disk drive disclosed in this previous case includes many sectors, and each sector sequentially includes a boot area, A directory area and a data area. And the hard disk drive is characterized in comprising: a read/write head for writing data to a hard disk drive and reading data from the hard drive, a non-electrical file configuration for storing information in a file configuration table Table memory, and a controller used to control the movement of the read-write head, the rotation of the hard disk drive, and data read-write actions.

It can be known from the above-mentioned previous cases that the conventional hard disk includes a controller and divides the accessible space of the hard disk into a data storage area and an address storage area. Wherein the data storage area is partitioned into many data storage blocks, and each data storage block has a fixed address, and the address storage area stores the address of each data storage. When the controller stores or reads data, it needs to obtain the address corresponding to the data through the address storage area to find the corresponding data storage block from the data storage area.

However, because digital data is too easy to copy, transmit and carry, it damages the confidentiality from the perspective of protecting data content, and even anyone can directly copy and store copyrighted data content through a portable hard disk, which infringes intellectual property rights. property.

For the existing data security technology, please refer to Taiwan Patent Certificate No. I317502 "Real-time Data Security Method". The method disclosed in this previous case operates in an operating system where a data folder is mounted as a security partition. The method includes: receiving a storage instruction of a file, and receiving the storage instruction of the file by the file system of the operating system; executing an encryption program; adding a real-time encryption and decryption control item to the attribute of the file, and establishing according to the security partition Add the real-time encryption and decryption control item when adding the real-time encryption and decryption control item to the file; and execute the storage operation. Furthermore, the specification of the prior case discloses that the encryption program can be encrypted using a symmetric key or an asymmetric key, and decrypted by the corresponding key. Furthermore, the method may also include performing an additional process of identity identification, and the decryption can only be performed after the identity is confirmed. Through the above method, the file folder selected to be encrypted needs to pass at least one verification before it can be opened.

However, the confidentiality through key and identity verification may still cause the encrypted file to be copied and leaked after opening, so there is still room for continuous improvement and innovation in the confidentiality mechanism.

Contents of the invention

In order to improve the prior art, files are easily copied and outflowed. Therefore, the object of the present invention is to provide a technology for limiting the number of reads and writes or time of a file by the controller in the memory, and delete the file after reaching the limited number of reads and writes or time, so as to limit the outflow of the file.

The present invention is a method of restricting file access, the method is executed by a controller in a storage medium, and the storage medium includes a physical storage area for storing one or more files, and the controller receives a special command Then execute a step of judging a restricted access file specified by the special command, a step of establishing a restriction logic table to correspond to each restricted access file, and a step of judging whether the restriction condition is reached, wherein the restriction condition At least one restriction condition for restricting the access of the access file is stored in the logic table. When the restriction condition is reached, the controller deletes the content corresponding to the access-restricted file in the restriction condition logic table and the physical storage area.

Through the above method, the access times or the access time of the file can be limited, and deleted when the access times or the access time exceeds, so as to limit the outflow of the file.

Description of drawings

Fig. 1 is a schematic block diagram of the storage medium and the information processing system;

Figure 2 is a block diagram of the implementation process of the method.

Detailed ways

The present invention is a method for restricting file access, and the technology of the present invention will be described below with reference to the accompanying drawings. Please refer to FIG. 1 and FIG. 2 . FIG. 1 shows a storage medium 1 electrically connected to an information processing system 2 . The storage medium 1 can be a hard disk, a solid state disk, or a non-volatile memory; the information processing system 2 can be a desktop computer, a notebook computer, or a mobile communication device. The storage medium 1 includes a physical storage area 14 for storing one or more files, and the storage medium 1 has a controller therein. The information processing system 2 connected to the storage medium 1 has an application program to output access commands compatible with the controller, and the application program can also generate a special command supported by the controller. After the controller receives the special command, it first executes a step of judging an access-restricted file designated by the special command. Then execute the step of establishing a restriction logic table 11 to correspond to the restricted access file, so that the files specified by the special command all have a restriction logic table 11 corresponding, and the restriction logic table 11 stores at least one restriction to restrict access to the restricted access file. Then execute a step of judging whether the limiting condition is met, wherein, when the controller receives the access command for the restricted access file, it needs to obtain the file stored in the physical storage area 14 through the limiting condition logic table 11 . If the limited condition is not reached, the controller accesses the restricted access file from the physical storage area 14; Get the contents of the file. The above-mentioned limiting condition is the access times limit of the restricted access file, or the time limit for storing the restricted access file in the storage medium 1. Get the time limit for storing the file in the storage medium 1. The specific implementation state of this storage medium 1 is shown in Figure 1, this storage medium 1 also stores a logical address table 10, a logic-to-physical address table 12, a physical address table 13, and the controller receives external access commands or special commands so that the logical address table 11 provides the logical addresses of the files specified by these commands. When the requested access of the access command is not a restricted access file, the physical address can be obtained by directly mapping (mapping) the logical address to the physical address table 12 by accessing the general file path 101, and then passing the physical address The address table 13 is mapped to the location of the designated file in the physical storage area 14 , so as to access the content of the designated file from the physical storage area 14 . When the requested access of the access command is an access restricted file, the logical address provided by the logical address table 10 will be mapped to the restricted condition logic table 11 by an access restricted access file path 100, and At this time, the controller judges whether the access-restricted file meets the limit condition defined in the limit condition logic table 11 . If the restriction condition is not reached, the logical address will be remapped (mapped) from the restriction condition logic table 11 to the logical transfer entity address table 12 to obtain the entity address, and then mapped to the specified file by the entity address table 13 (mapping) A location in the physical storage area 14 from which to access the contents of the specified file. If the controller judges that the limiting condition is reached, the controller will delete all contents of the access-restricted file in the storage medium 1, including the logical address table 10, the limiting condition logical table 11, and the logical-to-physical address table 12. , the physical address table 13, and the contents of the physical storage area 14 that map the access-restricted file will all be deleted by the controller. Since the information processing system 2 may output special commands for multiple files, the storage medium 1 establishes multiple restrictive condition logic tables 11 corresponding to each restricted access file. As shown in FIG. 1 , it is assumed that the storage medium 1 has two access-restricted files, so the storage medium 1 has two restriction logic tables 11 corresponding to each restricted-access file. Moreover, the two restriction logic tables 11 may have different restriction conditions, and the content of the restriction conditions may be determined when the operator issues a special order through the information processing system 2 . The implementation flow of the controller is shown in FIG. 2 . First, an input command is received from the information processing system 2 (such as step block 31 ), and whether it is a special command is first judged (such as step block 32 ). If yes, create a restriction logic table corresponding to the restricted access file (such as step block 33). If not, then the command that represents this input is an access command, further judge this moment whether the specified file of this command is a restricted access file (as step square 34), if the specified file of this command is not a restricted access file, then you can Direct access to the file is allowed (eg step block 35). If the file specified by the command is a limited access file, the controller will judge whether the limited condition is met through the limited condition logic table 11 (such as step block 36). If the limiting condition is not met, then allow access to the restricted access file (such as step block 37). If the limiting condition is reached, the controller deletes the content corresponding to the access-restricted file (such as step block 38).

Through the above method, the access times or the access time of the file can be limited, and deleted when the access times or the access time exceeds, so as to limit the outflow of the file, and a mechanism is added to ensure that the secret will not be leaked. The above-mentioned controller can also restrict that the information processing system 2 must install compatible software to access the restricted-access file.

Although the present invention has been disclosed above with preferred embodiments, it is not intended to limit the present invention, and any changes and modifications made by those skilled in the art without departing from the spirit and scope of the present invention should be covered by this present invention. Invention, therefore, the protection scope of the present invention should be defined by the scope of the appended patent application.

Claims (9)

1. A method for restricting file access, said method defines a storage medium (1) and an information processing system (2) connected to said storage medium (1), said storage medium (1) comprising a logical address table (10), a logic transfer physical address table (12), a physical address table (13), a controller and a physical storage area (14) for storing one or more files, and it is characterized in that the restriction The method of file access includes the following steps: inputting a special command designating a restricted-access file from the information handling system to the controller; The controller judges the restricted access file specified by the special command; The controller establishes a restrictive condition logic table (11) corresponding to the restricted access file, and the restricted condition logical table (11) stores at least one restrictive condition restricting access to the restricted access file; inputting an access command to access the restricted-access file from the information processing system to the controller; When the controller receives the access command, the logical address table (10) provides a logical address of the restricted-access file, and maps to the restricted-access file path (100) A conditional logic table (11), where the controller judges whether the access-restricted file meets the limiting condition; If the limiting condition is not met, the controller maps the logical address to the logical-to-physical address table (12) through the limiting condition logic table (11) to obtain a physical address, and then passes the physical address The table (13) maps the physical address to the location of the restricted access file in the physical storage area (14), and accesses the restricted access file from the physical storage area (14); If the limiting condition is reached, the controller deletes the logical address table (10), the limiting condition logic table (11), the logic-to-entity address table (12), and the entity address table (13) And the content corresponding to the access-restricted file in the entity storage area (14). 2 . The method for restricting file access according to claim 1 , characterized in that the limiting condition is a limit on the number of access times of the restricted access file. 3 . 3 . The method for restricting file access according to claim 1 , wherein the restricting condition is a time limit for restricting access to files stored in the storage medium ( 1 ). 4 . 4. The method for restricting file access according to claim 1, characterized in that, the limiting conditions include the limit on the number of accesses of the restricted access file and the number of times the restricted access file is stored in the storage medium (1). time limit. 5. The method for restricting file access according to claim 1, characterized in that the storage medium (1) is connected to an information processing system (2) to receive the access generated by the information processing system (2) commands or special commands. 6. The method for restricting file access according to claim 5, characterized in that the information processing system (2) is a desktop computer, or a notebook computer, or a mobile communication device. 7. The method for restricting file access according to claim 5, characterized in that the information processing system (2) has an application program to output access commands or special commands compatible with the controller. 8. The method for restricting file access according to claim 1, characterized in that the storage medium (1) is a non-volatile memory. 9. The method for restricting file access according to claim 8, characterized in that, the storage medium (1) is a magnetic disk hard disk or a solid state hard disk.