200928739 九、發明說明： 【發明所屬之技術領域】 本發明是有關於一種儲存裝置的使用權限管理系統及其 方法’且特別是有關於一種隨插即用之儲存裝置及其之使用權 限管理系統及方法。 【先前技術】 Ο200928739 IX. Description of the Invention: [Technical Field] The present invention relates to a usage right management system for a storage device and a method thereof, and in particular to a plug-and-play storage device and a usage rights management system thereof And methods. [Prior Art] Ο
由於通用序列匯流排(Universai seriai Bus，USB)具有高傳 輸速度之優異特性與隨插即用之便利性，目前已被使用於各種 外接裝，之連接介面。啊仙為快閃記雜的製程不斷進 步，使得快閃記憶體的體積日趨縮小，且容量更大而成本變 低所以近年來有許多廠商相繼推出通用序列匯流排搭配快閃 ^憶體的隨料接式儲存裝置(即-般通稱的USB隨身碟），已 =費者廣泛接受，逐漸取代傳統的軟碟片、光等。但也 ，為這些USB外_存裝置使験來實在太過方便了，只要 ΞίΤΠΓ的電腦，就可以馬上將電腦中的資料備份到 資;長多企_ 裝置時，卿何做適^長權期限困/控：：^*對員工使用這類 企，爲了提昇卫作效率，通常只想要准 者可以使用USB外接儲存裝置 =疋97作 :=資料存取的動作。二 果’透過USB外接料裝置，帶回研發之 、=析與研究；市場人貞可⑽企業 訊，藉由USB外接儲存裝置，帶 ：：：，身 2可以將客戶所需之㈣内部之相_料m 2 館存装置，直接請批戶手巾。由魏衫 5 200928739 而 料外茂的風險又是科—個門題，#存於其巾的機密資 制，便：：合待 【發明内容】 在梦ί發甘明▲出—種儲存裝置之使用權限管理系統，句人. ❹ ❹ 驗二程犬、具有第—連接介面與内建有終端裝置名稱表=身， 7及終端裝置，具有第二連 執行介連麟，身份驗證 述的终以比對此終端裝置名稱表是否具有上 、k裝置名稱’並在終端襄置名稱表具有此終端 時，開放儲存裝置於此終端裝置之使用權限。 稱 再提出—種儲存裝置之使用權限管理方法，其提供 端儲存裝置，此儲存裝置内建具有-個終 你裝f名稱表之身份驗證程式，此外也提供具有第二連接介面 :一固終端裝置名稱之終端裝置。當儲存裝置之第—連接 、終鳊装置的第二連接介面相連接時，身份驗證程式就會執行 一個終端裝置認證程序，關此比麟端裝置名稱表中是否具 有此終端裝置名稱。最後再根據比對的結果決定儲存裝置是否 可在此終端装置上使用。 本發明$提出一種儲存裝置，至少包含具有終端裝置名稱 表之身分驗_程式之光碟區以及被設定為隱藏狀態之明文 區。當身分蜂證程式執行並得到預定結果之後，此明文區就會 被取消其隱藜狀態。 本發明P提出之儲存裝置的使用權限管理系統及其方 法’使得儲;^裝置對於各終端裝置之使用權限可以做適當的管 200928739 理，同時也可以降低當使用者不慎遺失儲存裝置時，產生機密 資料外洩之風險。 為讓本發明之上述和其他目的、特徵和優點能更明顯易 懂，下文特舉較佳實施例，並配合所附圖式，作詳細說明如下。 【實施方式】 ❹Since the universal serial bus (Universal seriai Bus, USB) has excellent transmission speed and convenience of plug-and-play, it has been used in various external connection interfaces. The process of flashing and flashing is constantly improving, making the volume of flash memory shrinking day by day, and the capacity is larger and the cost is lower. So in recent years, many manufacturers have successively introduced the universal serial bus with the flashing Connected storage devices (that is, commonly known as USB flash drives) have been widely accepted by consumers, gradually replacing traditional floppy disks, light, and the like. But also, it is too convenient for these USB external storage devices to be used. As long as the computer is ΞίΤΠΓ, you can immediately back up the data in the computer to the capital. When the long-term enterprise _ device, how to do the right Deadline/Control::^* Use this type of enterprise for employees. In order to improve the efficiency of the security, it is usually only possible to use USB external storage device = 疋97 for: = data access action. The second fruit 'via the USB external device, bring back the research and development, analysis and research; market people can (10) enterprise news, with USB external storage device, with :::, body 2 can be used by customers (4) internal Phase _ material m 2 library storage device, please directly approve the hand towel. From Wei Bing 5 200928739, the risk of being out of the house is also a subject--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The use of rights management system, sentence person. ❹ 验 test two-way dog, with the first connection interface and built-in terminal device name table = body, 7 and terminal device, with the second connection implementation of Lin Lin, identity verification Finally, when the terminal device name table has the upper, k device name 'and the terminal device name table has the terminal, the storage device is used to use the terminal device. Said to re-propose a storage device usage rights management method, which provides an end storage device, the storage device has an identity verification program with a final name list, and a second connection interface: a solid terminal Terminal device of the device name. When the first connection interface of the first connection and the final device of the storage device is connected, the authentication program executes a terminal device authentication program to determine whether the terminal device name is present in the name list of the device. Finally, based on the result of the comparison, it is determined whether the storage device can be used on the terminal device. The present invention proposes a storage device comprising at least a disc area having an identification device of a terminal device name table and a plaintext area set to a hidden state. After the identity certification program is executed and the predetermined result is obtained, the plaintext area is cancelled. The usage right management system and method of the storage device proposed by the invention P can make the storage device have the appropriate authority for each terminal device, and can also reduce the loss of the storage device when the user accidentally loses the storage device. Risk of leakage of confidential information. The above and other objects, features and advantages of the present invention will become more <RTIgt; [Embodiment] ❹
本發明主要是提供一種儲存裝置的使用權限管理系統及 其方法’使得儲存裝置在各終端裝置之使用權限可以做適當的 =理’同時也可崎低當使用者不慎遺失儲存裝置時，產生機 密資料外洩之風險。相關之實施例說明如下。 布固兩不贫明第一實施例之示意圖。其包含儲存裝置 γ多個終端裝置2G (如第—終端裝置2卜第二終端裝置 20、八裝置23等）；且儲存裝置10與這些終端裝置 有―互通性的連接介面丨9、219、229、239等， 些終端裝置2〇可以藉由連接介面19、 置必定且纟魏山疋成資料傳遞之任務。其中’每個終端裝 裝置= 置名稱’因為終端装置名稱是每個終端 終端裝置22之第二終端裝置名^财置名稱為A、第二 三終端裝置名稱為C。二存裝、第二終端裝置23之第 證程式⑴，且身份驗證程式^内具有一個身份驗 置10之所有終端裝置清單的終端允許使用健存裝 置ω之連接介面19插入任—終tT U2。當儲存裝 動執行身份驗證程式Ul，進置之連接介面時，便會自 份驗證程式m會去讀取其:用麵_驗證工作；此身 稱，並與身份驗證程式lu、 2之終端裝置的終端裝置名 的、、、端裝置名稱表U2進行比 200928739 的終端名稱表112令具有與其所插入之終端裝置相同 插人使用；但若終端裝置名稱表112中不具有與其所 於此終端聚的終端裝置名稱’則不開放儲存裝置10 端裝置舉名H儲存裝置1G之終端裝置名稱表112，具有終 稱為A)時，身二入第-終端裝置21(終端裝置名 終端震置名稱表112，1會自行比對儲存裝置10中之 端裝置名稱表m確實於此時終 存裝置ίο之使用權n裝置名稱A’於疋便會開放此儲 裝置22 (終㈣署Jl’r述之健存裝置10插入第二終端 對儲存裝置10中B)時，身份驗證程S111同樣自動 =裝置10中之終端裝置名稱表112進行比對。 之;找到終端裝置名稱B’因此將不開放儲存裝置1: 10中身份^3\即ill终端褒置認證程序。透過上述儲存裝置 Ο 效對儲存裝Γ的細_=的=裝=，，可以有 特定終端裝置上之使的權限f理，·特定儲存裝置於 請同時參照第2A圖與第犯圖，其中 月第二實施例之示意圖，第一 …本發 作方法的施行步驟流㈣。其彡置I =之一種操 包含儲存裝置H)以及多齡端裝統=如:第—實施例所述， 置1〇中之身份驗唯一不同的是儲存裝 外、爭I身 式113，除了具有終端裝置名稱表114 預設密碼115，且其執行驗證程序錢兩步驟。第 了為終端裝置認證程序包含步驟S細與_，同J 實施例所述，在此不再贅述。坌-半 同第 8 200928739 得身份驗證程式113可以進行預設密碼115與所使用者密碼之 比對若相符則開放儲存裝置1〇於之所插入之終端裝置的使 用權限（步驟S230);若不符則關閉儲存裝置10的使用權限 (步驟S24G)。透過上述之終端裝置認證程序，可以 =存裝置對於終端裝置之使用觀；更進―步密嗎認證 程序，可以確認儲存裝置為使用者本人所使用，預防 ===存裝置時’可以透過密碼認證程序’防止他人使 ❹ 意的是，前述執行驗練相兩録職沒有絕對的 = 時，可以先進行第一步驟，待第一步： 步驟，或者，也可以先進行第二步驟，待第二 步驟進行第—步驟；或者，可以讓第—步驟與第二 為本請Γ參照第3A圖與第犯圖，其中，第3A圖 〇 二操:r的施行步称流程圖。其系統』 =裝==10以及多個終端裝置2。;唯-不= 除了 么 辨識裝置18，且身份驗證程式m， 含執第;T為,裝置認證程序’其包 會被要杯儲序（步驟_，此時使用者 圖案讀取，完成後身份驗證程=6識蔣裝置18進行使用者指紋 用者指紋圖案進行1斜3116將預設指紋圖案118與使 限（步驟S3301 · 4 士 Μ右目符則開放儲存裝置10的使用權 ’右不目符則關閉儲存裝110的使用權限（步 9 200928739 L經由此雙重的驗證方式，不但可以利用終端裝置 有效管理儲存裝置對終端裝置之使用權限;更進一 =====置為使用者本人所使用，預 防止他人使用此存裝置時，可以透過指紋認證程序， ❹ ❹ 關係同樣的’前述執行驗證程序的兩個步驟並沒有絕對的先後 第4^明2供一種具有權限管理功能之儲存裝置30，如 相通之連接介面49的二裝置30與具有 區32及隱藏區33 ;其中，光碟區31是存 置30之自動執行程式的位置；明文區32是提供ϋ 藏區是—般使用者無法看見及^作 Γ二ίΐΐ 之製造商所提供之原始密碼，並 ^理定=，是將市售儲存裝置，透過系 驗證程式311更具有儲存裝置 =其中身伤 扣，此時身份驗證程式 ==之終端裝糊與:份驗證^ 轉魏置40之之^端 裝置名稱表312具有其所插入 此時便授_#^ 稱，義麟轉置紐程序。 之隱臧Μ，職給使用者自*存取資料於明文 200928739 使用權限 並差ί,ΐίΓ實施例之儲存裝置’係如前—實施例所述， 其差異疋身純證程式311之設計。換言之，身分驗證程式 311可以疋具有終端裝置認證程序及密碼認證程序之雙重驗^ 模式；或具有終端裝置紐程序及指紋紐程序之雙重驗證^The invention mainly provides a usage right management system for a storage device and a method thereof, so that the usage authority of the storage device in each terminal device can be appropriately determined and can also be low when the user accidentally loses the storage device. The risk of leakage of confidential information. Related embodiments are described below. A schematic diagram of the first embodiment in which the two embodiments are not poor. The storage device γ includes a plurality of terminal devices 2G (such as the first terminal device 2, the second terminal device 20, the eight devices 23, etc.); and the storage device 10 has an interoperability connection interface 丨9, 219 with the terminal devices. 229, 239, etc., some of the terminal devices 2 can be connected by the interface 19, and must be transferred to Weishan. Here, 'each terminal device=name' is because the terminal device name is the second terminal device name of each terminal terminal device 22, and the second terminal device name is C. The second storage device, the second terminal device 23's certificate program (1), and the terminal having the list of all terminal devices having the identity verification device 10 in the authentication program ^ allows the connection interface 19 of the health device ω to be inserted into the terminal tT U2 . When the storage device executes the authentication program U1 and enters the connection interface, the self-certification program m will read it: use the face_verification work; this body name, and the terminal with the authentication program lu, 2 The terminal device name table U2 of the terminal device name of the device is the same as the terminal device table of the 200928739 having the same terminal device as the terminal device inserted therein; however, if the terminal device name table 112 does not have the terminal device therewith The terminal device name of the cluster is not opened. The terminal device name table 112 of the H device 1G, which has a final name of A), is connected to the terminal device 21 (the terminal device name is shocked) The name table 112, 1 will automatically compare the end device name table m in the storage device 10, and the device name A' will be opened at this time. The device name A' will open the storage device 22 (final (four) department Jl' When the storage device 10 is inserted into the second terminal pair storage device 10 B), the authentication process S111 is also automatically = the terminal device name table 112 in the device 10 is compared. The terminal device name B' is found. Not open for storage Set 1: 10 identities ^ 3 \ ill terminal 认证 authentication program. Through the above storage device to verify the storage device _ = = =, you can have the permissions on the specific terminal device, · For specific storage devices, please refer to FIG. 2A and the first map at the same time, wherein the second embodiment of the month is a schematic diagram, the first...the execution step of the attack method is flown (4). The device of the setting I = includes the storage device H) And the multi-aged end-mounted system = as described in the first embodiment, the only difference between the identification and the identification is that the storage device is out of the box, except for having the terminal device name table 114 preset password 115, and It performs two steps of verifying the program money. The first terminal device authentication program includes the steps S and _, which are described in the same manner as the J embodiment, and are not described herein again.坌- 半同8th 200928739 The authentication program 113 can perform the comparison between the preset password 115 and the user password to open the usage right of the terminal device inserted by the storage device 1 (step S230); If not, the usage right of the storage device 10 is turned off (step S24G). Through the above-mentioned terminal device authentication program, it is possible to use the device to view the use of the terminal device; further, the step-by-step authentication program can confirm that the storage device is used by the user himself, and the prevention can be used when the device is prevented. The certification procedure 'prevents others from making sense is that when there is no absolute = for the two executions of the above-mentioned execution temptation, the first step can be performed first, and the first step is: Step, or, the second step can be performed first. The second step performs the first step; or, the first step and the second step can refer to the 3A map and the first map, wherein the 3A diagram is the second step: the execution step of the r is called a flowchart. Its system』 = installed == 10 and a plurality of terminal devices 2. ;only - no = except for the identification device 18, and the authentication program m, including the implementation; T is, the device authentication program 'the package will be the cup storage order (step _, the user pattern is read at this time, after completion) The authentication process=6 recognizes the Chiang device 18 to perform the user fingerprint user fingerprint pattern 1 oblique 3116 to preset the fingerprint pattern 118 and the limit (step S3301 · 4 Μ Μ right eye then open the storage device 10 use right right) The object is to close the use permission of the storage device 110 (step 9 200928739 L through this dual verification mode, not only can the terminal device be used to effectively manage the storage device to use the terminal device; further ===== is set to the user himself When used, pre-preventing others from using this device, you can use the fingerprint authentication program, ❹ ❹ the same 'the two steps of the above-mentioned execution verification program are not absolutely sequential. 4^明2 for a storage with rights management function The device 30, such as the two devices 30 of the connection interface 49, has a zone 32 and a hidden zone 33; wherein the optical zone 31 is the location of the automatic execution program of the storage 30; the plaintext zone 32 provides the storage zone. The original user can't see and use the original password provided by the manufacturer, and it is determined that the commercially available storage device has a storage device through the system verification program 311. When the authentication program == terminal paste and: copy verification ^ turn Wei set 40 ^ end device name table 312 has its inserted at this time will be granted _ # ^ said, Yilin transferred to the new program. Μ, the user gives the user access to the data in plain text 200928739. The permission and the difference between the storage device of the embodiment are as described in the previous embodiment. The difference is the design of the pure certificate program 311. In other words, the identity The verification program 311 can have a dual verification mode with a terminal device authentication program and a password authentication program; or a dual verification with a terminal device new program and a fingerprint button program^
❹ 式。其中，終端裝置驗證程序、密瑪驗證程序及指紋驗證程序， 如上述實施射之綱’不加贅述。經由上述兩種雙重之驗證 方式，不僅可以有效管理儲存裝置對終端裝置之朗權限；更 可以進-步的確職存裝置為使用者本人所使用，明防當使 用者不慎遺失此儲存裝置時，防止他人使用此儲存裝置。 紅上所述，本發明之儲存裝置1〇、3〇可以是具有儲存資 料功能之裝置，例如快閃記憶體（FlashMem〇ry)、磁性記憶 體等。連接介面19、39、219、229、239、39、49等，可以是 任何具有隨插即用（Plug-anci-piay)功能的連接介面，例如通 用序列匯流排（USB)或IEEE1394等。而終端裝置2〇、21、 22、23、40等，則可以是任何具有儲存資料功能的電子裝置， 例如個人電腦（PC )、工作站（Work Station)或伺服器（Server) 等。指紋辨識裝置18，是具有讀取指紋圖案功能之裝置，例 如是按壓式紋辨識裝置或掃描式紋辨識裝置。再者，本發明之 另一實施例，是將指紋辨識裝置18設置於終端裝置上，而非 儲存裝置上。 雖然本發明已以較佳實施例揭露如上，然其並非用以限定 本發明，任何熟習此技藝者，在不脫離本發明之精神和範圍 内’當可作些許之更動與潤飾，因此本發明之保護範圍當視後 附之申請專利範圍所界定者為準。 11 200928739 【圖式簡單說明】 第1圖為本發明之第一實施例之示意圖。 第2A圖為本發明之第二實施例之示意圖。 第2B圖為第二實施例之一種操作方法的施行步驟流程 圖。 第3A圖為本發明之第三實施例之示意圖。 第3B圖為第三實施例之一種操作方法的施行步驟流程 圖。 第4圖為本發明之第四實施例之示意圖。 【主要元件符號說明】 10、30 :儲存裝置 20、40 :終端裝置 18 :指紋辨識裝置 21 :第一終端裝置 22 :第二終端裝置 23 :第三終端裝置 19、219、229、239、39、49 :連接介面 111、 113、116、311 :身份驗證程式 118 :預設指紋圖案 32 :明文區 35 :本體 112、 114、117、312 :終端裝置名稱表 115 :預設密碼 31 :光碟區 33 :隱藏區 S200〜S240 :本發明一實施例之施行步驟 S300〜S340 ·本發明一實施例之施行步驟 12❹ style. Among them, the terminal device verification program, the MME verification program, and the fingerprint verification program are as described above. Through the above two dual verification methods, not only can the storage device be able to manage the remote device's remote authority, but the user can also use the user's own device to prevent the user from accidentally losing the storage device. To prevent others from using this storage device. As described above, the storage device 1〇, 3〇 of the present invention may be a device having a storage function, such as a flash memory (FlashMem〇ry), a magnetic memory, or the like. The connection interface 19, 39, 219, 229, 239, 39, 49, etc., may be any connection interface having a plug-and-play (Plug-anci-piay) function, such as a general-purpose serial bus (USB) or IEEE1394. The terminal devices 2, 21, 22, 23, 40, etc., may be any electronic device having a data storage function, such as a personal computer (PC), a workstation (Work Station), or a server (Server). The fingerprint recognition device 18 is a device having a function of reading a fingerprint pattern, such as a push pattern recognition device or a scanning pattern recognition device. Furthermore, another embodiment of the present invention is to place the fingerprint recognition device 18 on the terminal device instead of the storage device. While the invention has been described above by way of a preferred embodiment, it is not intended to limit the invention, and the invention may be modified and modified without departing from the spirit and scope of the invention. The scope of protection is subject to the definition of the scope of the patent application. 11 200928739 [Simple description of the drawings] Fig. 1 is a schematic view showing a first embodiment of the present invention. Fig. 2A is a schematic view showing a second embodiment of the present invention. Fig. 2B is a flow chart showing the execution steps of an operation method of the second embodiment. Figure 3A is a schematic view of a third embodiment of the present invention. Fig. 3B is a flow chart showing the execution steps of an operation method of the third embodiment. Figure 4 is a schematic view of a fourth embodiment of the present invention. [Description of main component symbols] 10, 30: storage device 20, 40: terminal device 18: fingerprint identification device 21: first terminal device 22: second terminal device 23: third terminal device 19, 219, 229, 239, 39 49: connection interface 111, 113, 116, 311: authentication program 118: preset fingerprint pattern 32: plaintext area 35: body 112, 114, 117, 312: terminal device name table 115: preset password 31: optical disc area 33: hidden area S200~S240: performing steps S300 to S340 according to an embodiment of the present invention · Step 12 of an embodiment of the present invention