TW201828186A - Mobile device with built-in access control mechanism comprises an access control unit including a control module and a storage module; a memory unit storing an application program; and a processing unit - Google Patents

Abstract

A mobile device with built-in access control mechanism is disclosed, which comprises: an access control unit including a control module and a storage module; a memory unit storing an application program; and a processing unit. The processing unit transmits a certification information to the access control unit through the application program. When the control module determines that the application program is legal based on the certification information, it allows the processing unit to establish connection with it. The processing unit transmits a user identification code and an user password to the control module through the application program. The control module inquires the access right of a user identification code based on an access control data table, and when the user password is determined to match with the user password recorded in a password table, it allows the processing unit to use the storage module in the range of access right.

Description

Mobile device with built-in permission control mechanism

The invention relates to a mobile device, in particular to a mobile device with a built-in permission control mechanism.

The existing mobile device, such as a smart phone, allows the user to perform an action payment by externally inserting an SD card and using the smart phone to verify and authorize the SD card, using the transaction voucher information stored in the SD card. For example, Taiwan Patent No. I537851.

Accordingly, it is an object of the present invention to provide a mobile device having a built-in access control mechanism for authenticating and controlling rights of a user by the mobile device itself.

Therefore, the mobile device of the built-in authority control mechanism of the present invention comprises an authority control unit, a memory unit and a processing unit. The privilege control unit comprises a control module and a storage module, the control module has an privilege control data table and a password table, the privilege control data table records a user identification code and uses the storage module a usage permission of the group, the password table records the user identifier and a corresponding user password; the memory unit stores an application; the processing unit is electrically connected to the rights control unit and the memory unit, When the processing unit executes the application, the application transmits an authentication information to the permission control unit, and the control module allows the processing unit to establish a connection with the application when the application is legal according to the authentication information, and The processing unit transmits a user identification code and a user password to the control module through the application, and the control module queries a usage right of the user identification code according to the permission control data table, and determines the use. When the password is consistent with the user password recorded in the password table, the processing unit is allowed to use the storage module within the scope of the usage authority.

In some implementations of the present invention, the control module records an identification code and a password of the application, and the control module determines an identification code and a password included in the authentication information and the control module. When the recorded identification code and password are the same, it is determined that the application is legal.

In some implementations of the present invention, the control module can plan a hidden data area for the storage module, and the control module determines that the usage right allows access to the hidden data area of the storage module. The processing unit is allowed to access the hidden data area of the storage module.

In some implementations of the present invention, the control module determines that the usage permission allows setting and updating the rights control data table and/or the password table, allowing the processing unit to control the data table and/or The password table is set and updated.

In some implementations of the present invention, the control module determines that the usage right permission allows the privacy data area to be planned, and the processing unit can plan a plurality of private spaces for the hidden data area through the control module, and the When the control module determines that the usage right allows access to at least one of the private spaces, the processing unit is allowed to access the private space, and the data transmitted by the processing unit is encrypted and then stored in the private space, or The data required by the processing unit is read from the private space and decrypted, and then transmitted to the processing unit.

In some embodiments of the invention, the mobile device includes an input unit that accepts the user identification code and the user password and transmits it to the processing unit.

In some embodiments of the present invention, the control module further includes a financial chip, wherein a key and a code program are stored, and the control module determines that the usage right allows the processing unit to access the financial chip. Transmitting, by the processing unit, a data to be debited to the financial chip, causing the execution of the code program, and by using the key to code the data to be debited to generate a transaction code, and The transaction code is returned to the processing unit.

In some implementations of the present invention, the secret data area stores a key, the control module has a code execution program, and the control module determines that the usage right allows the processing unit to access the hidden data area. And reading the key stored in the secret data area, and accepting a data to be debited from the processing unit, and executing the code execution program, and the key to be coded The data is coded to generate a transaction code, and the transaction code is returned to the processing unit.

In some implementations of the present invention, the control module further includes a financial chip storing a code program, the secret data area storing a key, and the control module determining that the usage right allows the processing unit to save When the financial chip and the hidden data area are taken, the control module reads the key stored in the hidden data area, and provides the key and a data to be hacked from the processing unit. And the financial chip is executed to execute the code program, and the data of the code to be hacked is coded by the key to generate a transaction code, and the transaction code is returned to the processing unit.

In some embodiments of the present invention, the mobile device has a motherboard, the processing unit is disposed on the motherboard, and the rights control unit is a chip disposed on the motherboard; or The control module of the tube unit is a first chip disposed on the motherboard, and the storage module of the rights control unit is a second chip disposed on the motherboard.

In some embodiments of the present invention, the mobile device has a motherboard and a circuit board electrically connected to the motherboard, the processing unit is disposed on the motherboard, and the permission control unit is disposed on the circuit Or the control module of the privilege control unit is disposed on the circuit board, and the storage module of the privilege control unit is disposed on the motherboard.

The effect of the present invention is that the storage module in the privilege control unit can be accessed by the processing unit by the privilege control unit built in the mobile device, in particular, the implicit in the storage module. The dense data area controls the access authority and allows the rights control unit to be disposed on the same or a different circuit board as the single wafer or two independent wafers, thereby achieving the object of the present invention.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are denoted by the same reference numerals.

Referring to FIG. 1 , an embodiment of a mobile device with a built-in privilege control mechanism is provided. The mobile device 1 of the present embodiment may be a portable electronic device such as a smart phone, a tablet computer, or a notebook computer, but This is limited to a memory unit 10, an input unit 11, a display unit 18, a processing unit 12 and a processing unit 12 electrically connected to the memory unit 10, the display unit 18, and the input unit 11. The authority control unit 13 is electrically connected.

In this embodiment, the input unit 1 can be a keyboard or a touch panel. The memory unit 10 stores at least one application, and the processing unit 12 can be an application processor (AP) or a central processing unit. The privilege control unit 13 mainly includes a control module 14 and a storage module 15. The control module 14 has a password table 16 and an privilege control data table 17. The permission control data table 17 records at least one user identification code and a usage right using the storage module 15, and the password table 16 records the user identification code and a corresponding user password. Therefore, when the processing unit 12 executes an application for accessing the data in the storage module 15, the application first transmits an authentication information to the permission control unit 13, and the control module is When the application is legal according to the authentication information, the processing unit 12 is allowed to establish a connection with the processing unit 12, and then the processing unit 12 transmits a user identifier and a user password to the control module 14 through the application. The control module 14 queries a usage right of the user identification code according to the permission control data table 17, and determines whether the user password matches the user password recorded in the password table 16, and if so, allows the The processing unit 12 uses the storage module 15 within the scope of the usage rights. Thereby, the purpose of authenticating and controlling the rights of the user who wants to access the storage module 15 is achieved.

Specifically, as shown in FIG. 2, the control module 14 of the present embodiment mainly includes a controller chip 141 and a control firmware 142 programmed in the controller chip 141 and an application program interface; API) 143, and the password table 16 and the rights control data table 17 are burned and stored in the control firmware 142. As shown in Table 1 below, the password table 16 stores the user identification code (such as ID1, ID2, ID3, etc.) of the user of the mobile device and the user password (for example, CODE1, CODE2, CODE3, etc.) for checking the user. identity of. And the password actually stored in the password table 16 is a password that is encrypted and stored in a garbled manner to ensure that the password is not illegally stolen. In addition, the password table 16 also stores an identification code of the application approved by the rights control unit 13 and a corresponding one of the passwords. Table 1

The storage module 15 includes a system portion 151 and a storage portion 152. The system portion 151 has built-in basic operation information. The storage portion 152 includes a hidden data area 153 and a visible area 154. The viewable area 154 is allowed to be accessed by the processing unit 12 (i.e., the operating system (OS)) of the mobile device 1, and is equivalent to the use of the mobile disc. For example, the Android® system can be used by the file management program (file management). Program) access. However, the secret data area 153 cannot be accessed by the processing unit 12 (the operating system), that is, the processing unit 12 cannot read, write or modify the file stored in the hidden data area 153. In contrast, the processing unit 12 can access the hidden material area 153 through the control firmware 142 in the controller chip 141 only after the specific verification and authorization sequence is completed. Therefore, the processing unit 12 cannot display the hidden data area 153 to the user, and the user can access the hidden data area 153 through the processing unit 12 only when the user passes the verification and authorization sequence by the processing unit 12.

Therefore, as shown in Table 2 below, the privilege control data table 17 mainly stores the user identification code (for example, ID1, ID2, ID3, etc.) of the user and a corresponding usage right thereof, for example, the user identification code ID1 is used. The readable and writeable secret data area 153, the user identification code ID2 usage right is the readable secret data area 153, the user identification code ID3 usage right is readable, written and deleted, the hidden data area 153, etc. It is used to verify whether the user has the right to read, update, and delete the data in the secret data area 153. Table 2

For example, assuming that the secret data area 153 stores a key corresponding to a virtual account for mobile payment, when the mobile device 1 wants to use the key to perform an action payment, the processing unit 12 will execute an application (such as a payment software) and output a message to a display unit 18 of the mobile device 1, requesting the user to input their user identification code and/or user password from the input unit 11 (of course, the application is also The previously recorded user ID and user password can be used directly without user input). Then, the application unit of the processing unit 12 transmits the authentication information including the identification code and a password, and the user password and the data to be debited related to the mobile payment to the application interface 143 of the control module 14, The application interface 143 first performs a connection establishment function, and according to the password table 16, determines whether the identification code and password provided by the application are recorded in the password table 16, and if so, determines that the application is legal. The application interface 143 then performs an privilege management function, and confirms the user identification code provided by the application according to the privilege control data table 17, for example, the usage right of the ID2 is read, and the user password provided by the application is determined. (ID2) conforming to a user password recorded in the password table 16, allowing the application to read the key stored in the secret data area 153 through the control firmware 142, and the control firmware 142 is based on the key. And the data to be debited generates a transaction code and is transmitted back to the processing unit 12, so that the processing unit 12 performs the subsequent action payment operation.

In addition, the control module 14 of the embodiment may further include a financial chip 140 in which a key of a financial institution that issues the financial chip 140 and a code program are stored. Therefore, when the processing unit 12 of the mobile device 1 wants to use the key and is authenticated by the identity and authority described above, the control firmware 142 of the control module 14 will pass the processing unit 12 through the application. The data of the code is transmitted to the financial chip 140, so that the code execution program is executed, and the transaction code is generated by using the key to the code of the code to be hacked, and is transmitted back to the processing unit 12 through the application to make the processing unit 12 Based on the subsequent action payment operations. For details on the application of the financial chip of the present embodiment to the mobile payment, refer to Taiwan Patent No. I537851.

Therefore, it can be seen that the control module 14 of the embodiment, whether or not the financial chip 140 is included, is verified by the above identity and authority if the key to be used for the mobile payment by the mobile device 1 is stored in the secret data area 153. Thereafter, the key stored in the secret data area 153 is read by the control firmware 142, and the code program stored in the control module 14 is executed to be provided according to the key and the processing unit 12. The data of the pledge code generates a transaction code. For details of the payment of this action, refer to the Taiwan Patent No. I509542; or, when the control module 14 includes the financial chip 140, and the mobile device 1 is to be used for the payment of the key ( When the financial institution of the non-issued financial chip 140 is provided in the secret data area 153, the key stored in the secret data area 153 is read by the control firmware 142 after the identity and authority verification described above. Transmitting the key and the data to be hacked to the financial chip 140, and executing the plucking program by the financial chip 140, and using the key to slap the data of the code to be hacked to generate a transaction code; Or if the mobile device 1 wants When the key of the action payment is stored in the financial chip 140, after the identity and authority verification is performed, the control firmware 142 of the control module 14 transmits the data to be hacked to the financial chip 140. The financial chip 140 executes the charge code program, and generates a transaction code by using the key to code the data to be coded. Therefore, the financial chip 140 can be included in the control module 14 or omitted as needed for practical applications.

Furthermore, the embodiment has at least four functions of identity recognition, rights control, private space, and personal protection. For the identification function, the secret data area 153 of the storage module 15 can record an identification data of a user, which is automatically provided by the processing unit 12 to execute an application to read the identification data or by the input unit 11 When a user identification code and its user password are input to the authority control unit 13, the application interface 143 determines that the user identification code has access according to the authority control data table 17 after verifying that the application is legal as described above. When the password of the hidden data area 153 of the storage module 15 is determined, and the user password is determined to match the user password recorded by the password table 16, the processing unit 12 is allowed to read and store the hidden secret through the control firmware 142. The identification data of the data area 153 is used by the mobile device 1 for subsequent identification.

For the privilege control function, the pre-established cipher table 16 and the privilege control data table 17 are burned in the control firmware 142 through the application interface 143, wherein the password table 16 is used before the user obtains the mobile device 1. The user identification code of each user of the mobile device 1 and its corresponding user password are mainly recorded, and the authority control data table 17 mainly records each user identification code and the hidden data area of the storage module 15 153, the data read, update and delete permissions, so different users will have different access rights to the hidden data area 153.

In addition to the above-mentioned connection connection function and the rights management management function, the application interface 143 also has an online personalization (Preso) management function, which enables the processing unit 12 to execute an application to establish a connection with the application interface 143. After the above-mentioned identity and authority verification, the user is allowed to set and update the password table 16 and the authority control data table 17 according to the actual application, and can plan the storage module 15 according to the actual application. (Cut) into a plurality of different blocks for storing different types of data, such as the visible area 154 of the storage portion 152 and the hidden data area 153.

For the private space function, an application executed by the processing unit 12 and the application interface 143 of the control module 14 are connected, and the application interface of the control module 14 is verified and authorized by the above-mentioned authority management management function. 143 can use the online personalization (Preso) management function to cut the hidden data area 153 into a plurality of private spaces according to the instructions issued by the application executed by the processing unit 12, for storing different kinds of private information, such as mobile payment. Relevant information, personal medical (medical) information, various vouchers, etc. And the control module 14 can set the access rights of the private space to different user identifiers (ie different users) in the rights control data table.

For the privilege protection function, the application interface 143 of the control module 14 can implement an encryption and decryption function, and can use algorithms such as 3DES (Triple Data Encryption Algorithm symmetric-key block cipher), AES (Advanced Encryption Standard) or RSA. Encrypt or decrypt the data. For example, when an application executed by the processing unit 12 is connected to the application interface 143 of the control module 14, and the verification of the function is managed by the above-mentioned authority, the application must write a resource to the hidden data. When a protected area of the area 153 (a private space planned by the above-mentioned online personalization operation (Preso) management function, not shown), the application interface 143 encrypts the information by using the encryption and decryption function. The encrypted resource information is further written into the protection block of the secret data area 153 through the control firmware 142. If the application executed by the processing unit 12 is to read the data of the protected area stored in the hidden data area 153, the control firmware 142 reads and transmits the data from the protected area to the protected area. The application interface 143 causes the application encryption/decryption function to decrypt the data, and then transmits the decrypted data to the processing unit 12 through the control firmware 142.

In addition, in this embodiment, as shown in FIG. 3, the mobile device 1 has a motherboard 100, the processing unit 12 and the privilege control unit 13 are disposed on the motherboard 100, and the privilege control unit 13 It is implemented in the form of a wafer.

Alternatively, in this embodiment, as shown in FIG. 4, the control module 14 and the storage module 15 of the privilege control unit 13 can be independently disposed on the motherboard 100, and the control module 14 is A type of first wafer is implemented, and the memory module 15 is implemented in the form of a second wafer.

Alternatively, in the embodiment, as shown in FIG. 5, the mobile device 1 further has a circuit board 20 electrically connected to the motherboard 100. The processing unit 12 is disposed on the motherboard 100, and the permission control is provided. The unit 13 is disposed on the circuit board 20 and implemented in the form of a wafer.

Alternatively, in the embodiment, as shown in FIG. 6, the processing unit 12 and the storage module 15 of the privilege control unit 13 are disposed on the motherboard 100, and the storage module 15 is of a wafer type. The state is implemented, and the control module 14 of the privilege control unit 13 is disposed on the circuit board 20 and implemented in a wafer type.

In summary, the present invention performs the privilege control on the storage module 15 in the access control unit 13 by the privilege control unit 13 built in the mobile device 1, in particular, The access rights of the hidden data area 153 in the storage module 15 are controlled, and the rights control unit 13 can be disposed on the same or different circuit boards as the processing unit 12 with a single wafer or two independent wafers. The efficacy and purpose of the present invention are achieved.

However, the above is only the embodiment of the present invention, and the scope of the invention is not limited thereto, and all the simple equivalent changes and modifications according to the scope of the patent application and the patent specification of the present invention are still Within the scope of the invention patent.

1‧‧‧Mobile Phone
10‧‧‧AMOLED display panel
11‧‧‧Central processor
12‧‧‧Drive Circuit (DDI Chip)
13‧‧‧Transport interface
14‧‧‧Access controller
15‧‧‧Image memory
16‧‧‧Sequence Controller
17‧‧‧Digital/Analog Converter
2‧‧‧Mobile devices
20‧‧‧AMOLED display panel
21‧‧‧Central Processing Unit
22‧‧‧Drive Circuit (DDI Chip)
23‧‧‧Image memory
24‧‧‧Access Control Module
25‧‧‧Digital/Analog Converter
241‧‧‧Write unit
242‧‧‧Reading unit
243, 244, 245‧‧ ‧ encoder
246‧‧‧Transport interface
247‧‧‧Selector
248‧‧‧ Timing Controller
I1, I2, I3‧‧‧ input
O1, O2, O3‧‧‧ output

Other features and advantages of the present invention will be apparent from the embodiments of the present invention. FIG. 1 is a circuit block diagram illustrating a circuit block mainly included in an embodiment of the mobile device of the present invention; FIG. 3 is a schematic diagram showing the privilege control unit of the embodiment is disposed on the motherboard; FIG. 4 is a schematic diagram illustrating the implementation of the circuit block of the privilege control unit of the embodiment; FIG. The control module and the storage module of the privilege control unit are respectively independently disposed on the motherboard; FIG. 5 is a schematic diagram showing that the privilege control unit of the embodiment is disposed on a circuit board electrically connected to the motherboard FIG. 6 is a schematic diagram showing that the storage module of the privilege control unit of the embodiment is disposed on the motherboard, and the control module of the privilege control unit is disposed on a circuit board electrically connected to the motherboard.

Claims (14)

A mobile device with a built-in privilege control mechanism includes: an privilege control unit, comprising a control module and a storage module, the control module having an privilege control data table and a password table, the privilege control The data sheet records a user identification code and a usage right of using the storage module, the password table records the user identification code and a corresponding user password; and a memory unit stores an application; a processing unit electrically connected to the privilege control unit and the memory unit, and when the processing unit executes the application, the application transmits an authentication information to the privilege control unit, and the control module is based on the authentication When the information is judged to be legal, the processing unit is allowed to establish a connection with the processing unit, and the processing unit transmits a user identification code and a user password to the control module through the application, and the control module controls the control module according to the authority. The pipe data table queries a usage right of the user identification code, and determines that the user password matches the user password recorded in the password table, The processing unit uses the storage module within the purview use. The mobile device of the built-in privilege control mechanism of claim 1, wherein the control module records an identification code and a password of the application, and the control module determines an identification code included in the authentication information and When a password is the same as the identification code and password recorded by the control module, the application is determined to be legal. The mobile device of the built-in privilege control mechanism of claim 1, wherein the control module can plan a hidden data area for the storage module, and the control module determines that the use permission allows access to the storage module The hidden data area allows the processing unit to access the hidden data area of the storage module. The action device of the built-in permission control mechanism according to claim 1, wherein the control module determines that the use permission allows setting and updating the permission control data table and/or the password table, and allows the processing unit to access the permission The control data sheet and/or the password table are set and updated. The action device of the built-in permission control mechanism according to claim 3, wherein the control module determines that the use permission allows the hidden data area to be planned, and the processing unit can plan the hidden data area through the control module a plurality of private spaces, and the control module determines that the usage permission allows access to at least one of the private spaces, allows the processing unit to access the private space, and encrypts the data transmitted by the processing unit and then stores the data. The private space is entered, or the data required by the processing unit is read out from the private space and decrypted, and then transmitted to the processing unit. The mobile device of the built-in privilege control mechanism of claim 1, wherein the mobile device comprises an input unit that accepts the user identification code and the user password and transmits the same to the processing unit. The mobile device of the built-in permission control mechanism of claim 1, wherein the control module further comprises a financial chip, wherein a key and a code program are stored, and the control module determines that the use permission allows the process When the unit accesses the financial chip, the data to be debited from the processing unit is transmitted to the financial chip, so that the code execution program is executed, and the data to be hacked is coded by the key. A transaction code is generated, and the transaction code is returned to the processing unit. The mobile device of the built-in permission control mechanism of claim 3, wherein the secret data area has a key, the control module has a code execution program, and the control module determines that the use permission allows the processing unit When accessing the hidden data area, reading the key stored in the hidden data area, accepting a data to be hacked from the processing unit, and executing the riddling code to use the key A bet code is generated for the data to be debited, and the transaction code is returned to the processing unit. The mobile device of the built-in permission control mechanism of claim 3, wherein the control module further comprises a financial chip storing a code program, wherein the secret data area stores a key, and the control module determines the When the usage permission allows the processing unit to access the financial chip and the hidden data area, the control module reads the key stored in the hidden data area, and transmits the key and the processing unit The data to be escorted is provided to the financial chip, so that the escrow code program is executed, and the data of the code to be plucked is coded by the key to generate a transaction code, and the transaction code is returned to the processing. unit. The mobile device of the built-in privilege control mechanism of claim 1, wherein the mobile device has a motherboard, the processing unit is disposed on the motherboard, and the privilege control unit is disposed on the motherboard Wafer. The mobile device of the built-in privilege control mechanism of claim 1, wherein the mobile device has a motherboard, the processing unit is disposed on the motherboard, and the control module is a first set on the motherboard A wafer, the storage module is a second wafer disposed on the motherboard. The mobile device of the built-in privilege control mechanism of claim 1, wherein the mobile device has a motherboard and a circuit board electrically connected to the motherboard, the processing unit is disposed on the motherboard, and the authority controls The tube unit is disposed on the circuit board. The mobile device of the built-in privilege control mechanism of claim 1, wherein the mobile device has a motherboard and a circuit board electrically connected to the motherboard, the processing unit is disposed on the motherboard, and the control module is The group is disposed on the circuit board, and the storage module is disposed on the motherboard. The mobile device of the built-in rights control mechanism according to any one of claims 1 to 13, wherein the mobile device is a smart phone, a tablet computer or a notebook computer.