CN1517888A - storage unit data protection method and system - Google Patents

Abstract

A data protection method and system for storage unit, make user install a user identification module to a memory cell under the normal operating system of a data processing unit in advance; then the user identification module encodes and encrypts the identification code set by the user and stores the encoded and encrypted identification code in a storage unit; secondly, the user identification module encodes and encrypts the partition table data and stores the partition table data to a specified storage unit position; then, the user identification module deletes the partition table data; finally, when the user turns on the power supply of the data processing device again, the user identification module judges whether the identification code input by the user is correct, if so, the partition table data encrypted by the codes are decoded and restored and covered to the correct distribution table position, and normal starting operation is carried out; if not, the normal starting operation program is stopped.

Description

Storage unit data protection method and system

technical field

The present invention relates to a storage unit data protection method and system, in particular to a method and system applied to a data processing device of a hard disk storage unit.

Background technique

Due to the rapid development of electronic information technology, data processing devices such as personal computers or notebook computers have become an indispensable part of our daily life. In addition to writing programs and performing simple data processing through the data processing device, the user can also use the powerful computing function as a communication medium for multimedia data such as sound, video or a combination of sound and video. In other words, the user can Works such as editing, making and playing of multimedia are performed by the data processing device. On the other hand, due to the growing maturity of the wired and wireless network communication environment, coupled with the fact that the volume of the data processing device is becoming thinner and smaller, it is convenient for users to obtain information while moving. Based on the aforementioned various objective environmental factors, users are more willing to search and obtain information through the data processing device with network connection and data transmission functions subjectively.

As mentioned above, although we can enjoy the convenience of fast information circulation through this data processing device, on the other hand, users are worried about the issue of data security. Users must further consider the confidentiality of information, because in the past, paper The data in the last working period are all recorded in writing. Today’s data processing devices have storage devices in the form of hard disks, etc., which can already provide users with a large number of text, image or audio-visual files in them. The volume of the file, but it is relatively easier to steal and copy the data. For example, a third party can copy or transmit the required data through simple methods such as floppy disk, CD burning or even network transmission.

The data protection technology of the existing data processing device is nothing more than the following several types: through the security (Security) function provided in the basic input/output system (BIOS), the identification code (password) is set, and the user executes the data processing During the power-on process of the device, the BIOS will require the user to input an identification code, and judge whether the user has the right to use the data processing device based on the content of the identification code. If so, the BIOS will Continue to execute subsequent boot procedures. Another form is that after the user enters the operating system, he defines an identification code according to the operating environment set by the individual or the stored data, and the operating system opens the operating environment or operating environment corresponding to the identification code according to the identification codes input by different users. Store data for use by users.

Through the above-mentioned BIOS protection method, the third party only needs to short-circuit a BIOS Reset Jumper on the main board, or remove the battery on the main board and then connect it, all are safe. The purpose of invading the setting content of the basic input and output system can be achieved. The latter is protected by the operating system, and the data in the hard disk can still be read after the user boots up by other means, such as booting with a floppy disk or CD. All can't reach ideal protection purpose for the user.

Contents of the invention

In order to solve the above-mentioned shortcomings of the prior art, the main purpose of the present invention is to provide a storage unit data protection method and system, by encrypting and hiding the partition table, preventing illegal users from accessing the operating system to access data.

Another object of the present invention is to provide a storage unit data protection method and system, which can achieve the purpose of protecting the storage unit data through the program control mechanism of software or firmware.

In order to achieve the above-mentioned purpose, the storage unit data protection system of the present invention includes: a central processing unit for providing the storage unit data protection system with the functions of extracting signals, compiling and decoding, and executing instructions; The memory unit of the input and output system and other software routines; used to provide the data processing device to store the storage unit including the operating system program and other programs or data; resident in the memory unit to identify the user settings The code is encoded and encrypted, and stored in a specific location in the storage unit; in addition, the partition table data can also be encoded and encrypted, stored in a specific location of the storage unit, and when the user restarts the machine and enters the correct identification code, it will automatically The data of the partition table is taken out from the storage unit, decoded and restored, and overwritten to the correct position of the partition table, so that the data processing device can continue to perform the normal boot operation procedure of the user identification module.

Through the above-mentioned storage unit data protection system, the implementation of the storage unit data protection method is to install the user identification module into the memory unit in advance, and then perform the following steps: first, let the user identification module set the user After encoding and encrypting the identification code, store it in a specific location of the storage unit; secondly, make the user identification module encode and encrypt the partition table data, and store it in a designated storage unit location; furthermore, make the user identification module The user identification module deletes the partition table data; finally, the user identification module judges whether the identification code input by the user is correct when the user turns on the power of the data processing device again, and if so, then encrypts the coded partition table The data is decoded and restored, and overwritten to the correct allocation table position, and the normal boot operation is performed; if not, the normal boot operation procedure is terminated.

Compared with the existing storage unit data protection method and system, the storage unit data protection method and system of the present invention are used to provide the user with a user identification mechanism executed in the boot process to prevent unauthorized access The user opens the data processing device arbitrarily and accesses the data in the storage unit.

Description of drawings

FIG. 1 is a schematic diagram of an application architecture, which is used to show the system architecture of implementing the storage unit data protection system of the present invention applied to a personal computer;

Fig. 2 is a schematic block diagram for showing the interrelationship between units and modules in the storage unit data protection system of the present invention; and

FIG. 3(A) and FIG. 3(B) are flowcharts for illustrating the steps of executing the method for protecting storage unit data of the present invention.

Detailed ways

Example

Please refer to FIG. 1. In the following embodiments, the storage unit data protection method and system 100 of the present invention are applied to the existing personal computer 200 architecture, and the following are only related to the storage unit data protection method and system 100 of the present invention. Relevant units and modules are described, and other input units such as keyboard or mouse and display units such as screen are not described again.

Please refer to FIG. 2 , the storage unit data protection system 100 includes: a central processing unit 110 , a memory unit 120 , a storage unit 130 and a user identification module 140 .

The central processing unit 110 is used to provide the storage unit data protection system 100 with the functions of extracting signals, compiling and decoding, and executing instructions, and can transmit and receive data from other resources through a data transmission path such as a bus.

The memory unit 120 is used to provide the storage unit for the data protection system 100 to store BIOS and other software programs and/or routines. Its property belongs to a non-volatile memory unit, that is, after the working power of the personal computer 200 is cut off, the data stored in the memory unit will not disappear, and when the user activates the working power of the personal computer 200, it can Executing such as the basic input/output system to complete the booting procedure of the personal computer 200 . Furthermore, the memory unit 120 can be an Electrically Erasable Programmable Read Only Memory (EEPROM) or a flash memory (FlashMemory). Since the above-mentioned memories are all rewritable by programs, it is possible for the user to update the contents of the program data such as the basic input/output system, etc., according to actual needs.

The storage unit 130 is used for the personal computer 200 to store operating system programs and other programs or data. In this embodiment, the storage unit 130 is a hard disk (HardDisk), and the function and structure of the storage unit 130 are in the prior art and will not be described repeatedly.

The user identification module 140 is a software program resident in the memory unit, which is used to encode and encrypt the identification code set by the user through the central processing unit 110 and store it in a specific location in the storage unit 130; In addition, the central processing unit 110 can also encode and encrypt the partition table data and store it in a specific location of the storage unit 130; When the identification code is displayed, the partition table data is taken out from the storage unit 130, decoded and restored by the central processing unit 110, and covered to the correct position of the partition table, so that the personal computer 200 can continue to perform normal booting procedures.

It should be noted that, in this embodiment, the partition table refers to the partition table of the storage unit 130, that is, the hard disk. The existing hard disk is composed of a plurality of magnetic columns (cluster), magnetic heads (head) and sectors ( sector), each sector has a capacity of 512 bytes (byte). Among them, the first sector of the 0th magnetic cylinder and the 0th magnetic head is defined as a split sector. In this sector, the front end is used to store the Master Boot Record (Master Boot Program; MBP); the back end is used to store partitions. table data.

Secondly, the booting procedure of the personal computer 200 is roughly as follows: the execution starts from the memory address 0FFFF0H of the memory unit 120, that is (CS=FFFF, IP=0000). The program content of the basic input-output system of this personal computer on this 0FFFF0H address is:

"FFFF0: JMP START"

After jumping to START, the basic input/output system (ROMBIOS) of the memory unit 120 will firstly do some initial checking work, such as checking random access memory, keyboard, screen, disk drive, etc. Then the master boot record will be read, and the BIOS will pass control to the master boot record to continue execution. In other words, it can be divided into the following steps:

1. When the computer is turned on, the basic input and output system is first executed, and the master boot record (Master Boot Record; MBR) of the first sector of the storage unit 130 is written into the random access memory, and then the control right is transferred to the master boot record program code in .

2. The master boot record program code scans the entire master disk partition table and places a flag on the first partition, marking the partition as bootable. Then write to random access memory, and pass control to the program code in this partition.

3. Load the system files in the disk (such as IO.SYS and MSDOS.SYS of MS-DOS) into the random access memory through the activation program, and then give the control right to the loaded system files.

As mentioned above, in the booting process of the personal computer 200, the partition table data is indispensable. Without the partition table data, the system cannot know the partition status of the storage unit 130, nor can it know The storage location of operating systems such as Windows XP or LINUX, of course, cannot successfully complete the boot process.

Therefore, the user identification module 140 is based on the above-mentioned characteristics of the partition table, by deleting the data of the partition table to prevent users who do not have access rights from completing the boot process, thereby protecting the data stored in the storage unit 130 of the personal computer 200. Purpose.

Please refer to FIG. 3(A), which shows the process steps of the data protection method for the storage unit of the present invention in executing the data protection of the storage unit 130 . The user is preliminarily instructed to install the user identification module 140 into the memory unit 120 under the normal operating system of the personal computer 200, and then proceed to step S301.

In step S301 , the user identification module 140 encodes and encrypts the identification code set by the user, and stores it in a specific location of the storage unit 130 . In this embodiment, after the user identification module 140 is installed in the memory unit 120, the user identification module 140 will require the user to set an identification code for identity identification. The identification code can include any number, A combination of words and symbols. After the user completes the setting of the identification code, the user identification module 140 encrypts and backs up the encoding of the identification code to a specific location in the storage unit 130, and then proceeds to step S302.

In step S302 , the user identification module 140 is instructed to encode and encrypt the partition table data, and store it in a specified location of the storage unit 130 . In this embodiment, the user identification module 140 encodes and encrypts the partition table data in the partitioned sector immediately after executing the step of encrypting and backing up the identification code, and stores the encrypted data after the encoding and encryption is completed. Go to another designated location in the storage unit 130, and then proceed to step S303.

In step S303, the user identification module 140 is instructed to delete the partition table data. In this embodiment, after the user identification module 140 completes the step of encrypting and storing the distribution table data, it immediately deletes the distribution table data from the memory unit 120 . Since the allocation table data has been deleted from the memory unit 120, if the user fails to input the correct identification code during the process of turning on the power supply of the personal computer 200 and executing the boot procedure, the user identification module 140 The allocation table data will not be restored and overwritten on the correct allocation table sector, and the personal computer 200 will not be able to complete the normal boot process, nor will it be able to enter the operating system.

The actual operation steps are as follows. Please refer to FIG. 3(B), which shows that when the personal computer 200 completes the data protection setting procedure, the user restarts the working power to execute the process steps of the verification protection stage.

In step S311, make the user identification module 140 require the user to input an identification code during the boot process, and then proceed to step S312.

In step S312, let the user identification module 140 determine whether the identification code input by the user is the same as the identification code stored in the storage unit 130, if yes, proceed to step S313; otherwise, proceed to step S315.

In step S313, the user identification module 140 is instructed to read out the partition table data stored in the storage unit 130, and overwrite the correct partition table data sector, and then proceed to step S314.

In step S314 , the personal computer 200 is made to enter the operating system according to the normal boot procedure, so that authorized users can access the data in the storage unit 130 .

In step S315, because the user cannot input the correct identification code, the user identification module 140 will not perform the step of overwriting the partition table data. Correspondingly, the sector division and operating system data in the storage unit 130 cannot be overwritten. The program is extracted, so the normal boot operation program cannot be executed, so as to prevent unauthorized users from accessing the data in the storage unit 130 .

To sum up, the storage unit data protection method and system of the present invention are used to provide the user with the user identification mechanism executed in the boot process, which can prevent the user who does not have the right to use the personal computer from arbitrarily opening the personal computer 200 And perform data access in the storage unit 130 . Even if the storage unit 130 is removed by a user who does not know the identification code, the data cannot be accessed through other computer devices, so as to truly achieve the purpose of data protection.

Claims (10)

1. A storage unit data protection method, applied to a data processing device with a storage unit, characterized in that the storage unit data protection method comprises: Make the user identification module encode and encrypt the identification code set by the user, and store it in a specific location of the storage unit; Enabling the user identification module to encode and encrypt the partition table data and store it in a designated storage unit location; cause the user identification module to delete the partition table data stored in the memory unit; and Make the user identification module judge whether the identification code input by the user is correct when the user turns on the power of the data processing device again, and if so, decrypt and restore the encrypted partition table data, and overwrite the correct allocation table position, carry out the normal start-up operation; if not, stop the normal start-up operation procedure. 2. The method according to claim 1, wherein the storage unit is any one of a built-in hard disk, an external hard disk, and a removable hard disk. 3. The method according to claim 1, wherein the data processing device can be any one of a personal computer, a notebook computer, a tablet computer, a liquid crystal computer, a server, and a workstation. 4. The method according to claim 1, wherein the user identification module is a software program, after being installed in the memory unit, it is resident in the memory unit, and is executed when the data processing device executes a boot program. User identification. 5. The method of claim 1, wherein the memory unit is any one of an EEPROM and a flash memory. 6. The method according to claim 1, wherein the identification code can be composed of any one of characters, numbers, symbols, characters and numbers, characters and symbols, symbols and numbers, and characters, symbols and numbers Content. 7. A storage unit data protection system applied to a data processing device with a storage unit, characterized in that the storage unit data protection system includes: The central processing unit is used to provide the data protection system of the storage unit with the functions of extracting signals, compiling and decoding, and executing instructions; a memory unit for storing the BIOS and other software programs of the data processing device; a storage unit for providing the data processing device to store operating system programs and other programs or data; and The user identification module is resident in the memory unit, and is used to encode and encrypt the identification code set by the user and store it in a specific location in the storage unit; in addition, it can also encode and encrypt the partition table data, Stored in a specific location of the storage unit, and when the user restarts the machine and enters the correct identification code, the partition table data is taken out from the storage unit, decoded and restored, and then overwritten to the correct location of the partition table; The user identification module is a software program, which is resident in the memory unit after being installed in the memory unit, and performs user identification work when the data processing device executes a boot program. 8. The system according to claim 7, wherein the storage unit can be any one of a built-in hard disk, an external hard disk, and a removable hard disk. 9. The system according to claim 7, wherein the data processing device can be any one of a personal computer, a notebook computer, a tablet computer, a liquid crystal computer, a server, and a workstation. 10. The system according to claim 7, characterized in that, the identification mark can be composed of any of characters, numbers, symbols, characters and numbers, characters and symbols, symbols and numbers, and characters, symbols and numbers Content.

Images