CN100390699C - Authority identification method using plug-and-play device and system applying method - Google Patents

Abstract

A permission identification method using plug-and-play device and system using the method are used to judge whether the plug-and-play storage device electrically connected with the plug-and-play port of a data processing device is a legal device, the method includes the following steps: A) detecting whether at least one electronic certificate exists in one of the plug-and-play storage device and the data processing device; B) if yes, requesting to input a user private key; C) checking the user-specific key; D) if the check is correct, the data is allowed to be written into the plug-and-play storage device.

Description

Authorization identification method using plug-and-play device and system applying the method

technical field

The present invention relates to a method for identifying use rights, in particular to a method for judging whether a plug-and-play storage device electrically connected to a plug-and-play port of a data processing device is a legal device using a plug-and-play device A permission identification method and a system for applying the method.

Background technique

In recent years, due to the popularity of portable plug-and-play storage devices such as flash drives, digital cameras, and Apple iPods, the circulation of electronic data has become more convenient. Since the storage capacity of this type of device ranges from 64MB to 1GB, and most of them use USB or 1394 with a very high transmission rate as the transmission interface, when it is plugged into the computer, it will be very fast. Although the data in the computer brings great convenience to users, it also relatively increases the difficulty in the management of such electronic data managers.

In order to prevent the user from using the plug-and-play storage device to arbitrarily copy the electronic data stored in any computer, resulting in the outflow of the electronic data, currently, there are generally two types of methods that can be controlled. One is that a remote console can issue a command to close or open a plug-and-play port, such as USB port and 1394 port, to the managed terminal computer, and the terminal computer can decide whether to remove it according to this command. The devices on these plug-and-play ports register (registry) on the operating system of the terminal computer, thereby prohibiting or allowing the use of plug-and-play storage devices. But this is only locked for the computer, and can only decide to open or close these plug-and-play ports, and it is impossible to flexibly give different permissions according to the identity of the user.

Another method is to determine the opening and closing of the connection ports of the computer peripherals according to the accounts of the users who have accounts on the terminal computer, so as to limit their use rights. Although this kind of practice can confirm the function of using authority according to the identity of the user, it is only limited to the user who has an account on this personal computer, which will greatly reduce the convenience of the plug-and-play storage device, and when After the user opens the connection port of the computer peripheral with his account, the computer will no longer control the opening and closing of the connection port. Therefore, if someone else electrically connects a plug-and-play storage device to the computer at this time, the open The use authority of the user of this computer will form a huge loophole in the control and control of the data stored in this computer.

Contents of the invention

Therefore, the object of the present invention is to provide a method for judging the electrical connection-data processing based on the identification of the user identity of the plug-and-play storage device and without affecting the convenience of the plug-and-play storage device. A method for identifying whether the plug-and-play storage device on the plug-and-play port of the device is a legitimate device and the system for using the plug-and-play device.

Therefore, the present invention discloses a method for identifying the authority of a plug-and-play device, which is used to determine whether a plug-and-play storage device electrically connected to a plug-and-play port of a data processing device is a legitimate device. The method comprises the following steps: A) detecting whether there is at least one electronic certificate in one of the plug-and-play storage device and the data processing device; B) if so, requiring input of a user-specific key; C) checking the user-specific Key; D) If the verification is correct, data is allowed to be written into the plug-and-play storage device.

The present invention also discloses a permission identification method using a plug-and-play device, which is applied to a control terminal and a user terminal, and the control terminal and the user terminal are connected to each other through a network, wherein the control terminal There is a server, the user end has at least one data processing device, the method includes the following steps: A) detecting whether at least one electronic certificate exists in one of the plug-and-play storage device and the data processing device; B) if Yes, it is required to input a user-specific key; C) check the user-specific key; D) if the verification is correct, allow data to be written into the plug-and-play storage device.

In addition, the present invention also discloses a computer-readable recording medium, which can be loaded on a data processor, so as to determine the electrical connection to a plug-and-play port on the data processor plug-and-play port. Whether the storage device is a legal device, a program code that can drive the data processor to act is recorded in the recording medium, and the program code can perform the following steps in the data processor: A) detect the plug-and-play storage device and one of the data processing devices, whether there is at least one electronic certificate; B) if there is, request to input a user-specific key; C) check the user-specific key; D) if the check is correct, allow data to be written into the random Plug and play storage.

The present invention further discloses a permission identification system using a plug-and-play device to determine whether a plug-and-play storage device electrically connected to a plug-and-play port of a data processing device is a legitimate device. It includes a plug-and-play storage device, a server, and at least one data processor. The server is used to issue an electronic certificate exclusive to an applicant; the data processor is connected to the server with a network, has at least one plug-and-play port, and installs an application program, and detects the electrical performance of the plug-and-play port When the plug-and-play storage device is connected, it is judged whether the electronic certificate exists, and if so, a user-specific key is required to be input, and when the verification is correct, data is allowed to be written into the plug-and-play storage device.

Description of drawings

Fig. 1 is a schematic diagram illustrating a preferred embodiment of the authority identification system using a plug-and-play device of the present invention;

Figure 2 is a block diagram illustrating a remote management program;

Fig. 3 is a flowchart illustrating an electronic voucher application method;

Figure 4 is a block diagram illustrating an agent program;

Fig. 5 is a flow chart illustrating the partial action flow of the authority identification method using the plug-and-play device of the present invention;

FIG. 6 is a flow chart illustrating the flow of the remaining operations following FIG. 5 .

Description of reference symbols

1- Identification system

11-Remote Management Center

12-terminal

13-Terminal

2- Remote management program

21- Credential Management Module

22-Security level management module

23-File record maintenance module

3- Agent procedure

31-Credential Verification Module

32-Authority retrieval module

501-504-step

701-717-step

Detailed ways

The aforementioned and other technical contents, features and advantages of the present invention will be clearly understood in the following detailed description of a preferred embodiment with reference to the accompanying drawings.

Please refer to Fig. 1 at first, the present invention uses the authorization identification system 1 of plug-and-play device, in order to judge whether the plug-and-play storage device on the plug-and-play port that is electrically connected to a data processing device is a legitimate device, It is to effectively monitor the electronic files owned by the company to prevent these files from being arbitrarily copied and downloaded to Plug-and-Play storage devices by unapproved users. Users, according to their use rights, limit and record their use of these documents, so as to completely and detailedly confirm the flow of these documents, so as to achieve the most reliable protection of the company's documents.

The identification system 1 includes a control terminal and a user terminal, and is constructed on a local area network (Intranet), or on an Internet (Internet), wherein, the control terminal has a server 11, and the user terminal has at least one Internet-capable Data processing means 12. And a remote management program 2 is installed on the server 11 , and an agent program 3 and a file system driver 4 are installed on the data processing device 12 . In this embodiment, the data processing device 12 is a terminal with at least one plug-and-play port (not shown), but it can also be a PDA or other electronic equipment with at least one plug-and-play port, This should not be the limit. And for the convenience of description, hereinafter, the server 11 will be referred to as the remote management center, and the data processing device 12 will be referred to as the terminal.

Referring to FIGS. 2 and 3 , the remote management program 2 is installed on the remote management center 11 and has a credential management module 21 and a security level management module 22 . The credential management module 21 has a set of administrator's public key and administrator's private key that match each other, and is used to establish a secure and rigorous authentication mechanism to manage the issuance, renewal, and revocation of electronic certificates, etc. . . . This electronic certificate issuing mechanism is based on the X.509 international standard defined by ITU-T (CCITT). The issuing process is shown in Figure 3 and briefly described as follows. Step 501, the certificate management module 21 receives the certificate application data sent by the user through a terminal 13 with a certificate application program (Certificate Issue Agent), and a password as a user-specific key. Among them, according to the X.509 standard, such data should include the user's name, department and unit, and country etc. . . .

In steps 502 and 503, the certificate management module 21 generates a user public key corresponding to the user's private key, and uses the administrator's private key to encrypt the certificate application data sent by the user and the user's public key to form a private key. The electronic certificate belonging to the user, step 504, is then sent to the terminal or the peripheral storage device according to the user's designation. After the user receives the electronic certificate issued by the remote management center 11, it can be stored in a plug-and-play storage device 6 or a terminal machine 12, which is used for the terminal machine 12 to do when the plug-and-play storage device 6 is used. verify.

Wherein, the user's public key is paired with the user's private key, that is, the information encrypted by one of the keys needs to be decrypted by the other key. Since the technology of the public-key cryptography is a method commonly used in cryptography at present, and is not the focus of the present invention, it will not be repeated here.

Referring to Fig. 2, the security level management module 22 has a list of usage rights, and this list of usage rights is made by the management personnel of the remote management center 11, and it sets different plug-and-play devices according to the identity of the user. permission to use. In this embodiment, the usage rights are divided into two levels: only read data stored in the plug-and-play device, and read/write data to the plug-and-play device. Of course, this kind of permission division can also be used to classify electronic files. Different files have different levels. Users can only read and write files that meet the scope of permissions according to their own level of use permissions, and should not It is limited to those disclosed in this embodiment.

Referring to Figures 1 and 4, the terminal machine 12 is equipped with an agent program 3, the agent program 3 has a certificate verification module 31, and a use authorization retrieval module 32, when the plug-and-play storage device 6 is inserted into the terminal machine 12 When the plug-and-play port is used, the certificate verification module 31 immediately searches for the electronic certificates of the plug-and-play storage device 6 and the terminal machine 12, because each terminal machine 12 and the plug-and-play storage device 6 have no limit to the electronic certificates that can be stored Therefore, it may store a plurality of electronic certificates. In this embodiment, the certificate verification module 31 will list the searched electronic certificates on the display of the terminal 12 for users to select personal electronic certificates. certificate. Of course, the way to select the electronic certificate is that the user can also directly input the storage address of the electronic certificate for use by the certificate verification module 31 .

Wherein, the credential verification module 31 has a function to regularly download and update the administrator's public key to the remote management center 12. After the credential verification module 31 obtains the electronic certificate, it will use the administrator's public key to verify the electronic certificate, as mentioned above. As mentioned above, since the electronic certificate is encrypted by the certificate management module 21 with the administrator's private key, if the electronic certificate is generated by the certificate management module 21, it will be successfully verified to obtain the user's certificate application data and the user's certificate. public key. On the contrary, this electronic certificate will be regarded as illegal. If the credential verification module 31 confirms that it is an invalid credential, then a request will be sent to request the terminal 12 to stop supplying the required power of the plug-and-play storage device 6, so that the plug-and-play storage device 6 will not be available.

When the credential verification module 31 confirms the legitimacy of the electronic certificate with the manager's public key, a group of random numbers (random numbers) will be generated, and the user's public key obtained after verifying the electronic certificate is used to match the group of random numbers. Encrypt to generate a ciphertext. At this time, the credential verification module 31 will request the user to input the user-specific key to decrypt the ciphertext, so as to verify whether the decrypted data is equal to the random number generated by the credential verification module 31 originally.

If it is the same, then it can be confirmed that the user is a legal user, and then it can be handed over to the use authority retrieval module 32 to limit the user's permitted usage behavior according to the user's use authority. As an illegal user, it will send a request, requesting the terminal machine 12 to stop supplying the power required by the plug-and-play storage device 6 .

The use authority retrieval module 32 regularly downloads and updates the use authority list by the terminal machine 12. When the credential verification module 31 uses the use authority list to compare the user's identity to confirm the user's use authority, it will determine whether it can be used according to its use authority. Read/write plug-and-play storage device 6, or only read the data stored in plug-and-play storage device 6, if there is no user name on the usage permission list, it will also be regarded as an illegal For the user, the terminal 12 will also stop supplying the power required by the plug-and-play storage device 6 . In this way, after the terminal 12 is electrically connected to a plug-and-play storage device 6, it can use an authentication mechanism to identify the user's identity and confirm its use authority, and limit the user's access according to its use authority. This will effectively retain the convenience of the plug-and-play storage device 6 and be more reliable in data control.

In addition, in order to make the data management more rigorous, the administrator can use the security level management module 22 of the remote management program 2 to set a terminal security level list and download it to the use authority retrieval module 32 of each terminal 12 for targeting Different terminal machines 12 set high, medium, and low security levels for the terminal machines 12 they belong to according to the different functions and powers of the users they set, so as to limit whether each terminal machine 12 can use this plug-in Ready-to-use storage device6. Among them, if the security level is high, the terminal machine 12 is prohibited from using the plug-and-play storage device 6, that is, the terminal machine 12 does not supply the power required by the plug-and-play storage device 6, and if the security level is medium, the terminal machine 12 will be prohibited. Only users on the usage authority list are allowed to use the plug-and-play storage device 6 , and those whose security level is low, the terminal 12 will not impose any restrictions on the plug-and-play storage device 6 .

Therefore, when the terminal machine 12 is turned on, the usage authority retrieval module 32 will first check the security level to which the terminal machine 12 belongs. In this way, the identification system 1 adds a restriction on the security level of the terminal machine 12 in addition to the original identification of the user's identity.

In addition, the remote management program 2 also has a file record maintenance module 23 , and the terminal 12 also has a file system driver 4 . After confirming the identity of the user, the use authority retrieval module 32 will send a signal to drive the file system driver 4 to record the user's usage behavior, and regularly send this data to the file record maintenance module 23 of the remote management program 2, It is used when the administrator needs to verify the records. In this way, data management will be more rigorous.

Referring to Fig. 1, Fig. 5 and Fig. 6, according to the identification method of the authority identification system 1 using the plug-and-play device described above, the identification method is as follows. First, as in step 701, the terminal 12 detects that the user is connected to a plug-and-play storage device 6 To the plug-and-play port, step 702, the use authority retrieval module 32 judges the security level of the terminal 12, when the level is high, execute step 703, and when the level is medium, execute step 704. Step 703, if the security level is high, then stop supplying power to the plug-and-play storage device 6, step 704, if the security level is medium, the certificate verification module 31 will search for an electronic certificate, and enter when an electronic certificate is found Step 706, otherwise, go to step 705.

Step 705, if no electronic certificate is found, the user is restricted to only read the data in the plug-and-play storage device 6 . In steps 706 and 707, the certificate verification module 31 uses the administrator's public key to verify the electronic certificate (authentication) to identify the authenticity of the electronic certificate. If the verification result shows that the electronic certificate is valid, it will obtain the user's public key. The key (k1) and certificate application data represent that the electronic certificate is issued by an approved certificate management module 21 and is a legal electronic certificate, that is, go to step 708, otherwise, go to step 703.

In step 708, the credential verification module 31 generates a set of random numbers (R). In step 709, the set of random numbers is encrypted with the user's public key obtained after verification to generate a cipher. This encryption step can be accomplished by the following equation:

C = E _k1 (R),

Among them, E represents the encryption function (encrypt), k1 represents the user's public key, R represents a random number (random number), and C represents the ciphertext (cipher) obtained by encrypting the random number R with the user's public key k1. Next in steps 710, 711, the credential verification module 31 requests the user to input a set of passwords, that is, the user's private key (k2) to decrypt the ciphertext. This decryption step can be accomplished by the following equation:

R' = D _k2 (C),

Among them, D represents the decryption function (decrypt), k2 represents the user's private key, C represents the ciphertext (cipher) obtained by encrypting the random number R with the user's public key k1, and R' represents the random number obtained after decryption data. Next in step 712, determine whether the data obtained after decryption is equal to the random number generated by the original certificate verification module 31, if different, then go to step 703, if the same, then it can be confirmed that this user is a legal use Or, go to step 713. Step 713 , the use right retrieval module 32 searches the use right list according to the identity of the user, so as to limit the allowed use behaviors according to the user's use right.

Wherein, if the user authority is to read/write the plug-and-play storage device 6, then enter step 714, if only the data stored in the plug-and-play storage device 6 can be read, then enter step 705, if the use authority list If there is no user's name above, then it will be regarded as an illegal user, that is, enter step 703. Steps 714-716, after confirming the identity of the user, the use authority retrieval module 32 will send a signal to drive the file system driver 4 to record the user's usage behavior, and periodically send this record to the file record maintenance of the remote management center 12 Module 23 is stored for use when the administrator needs to verify records.

To sum up the above, the present invention uses a plug-and-play device authority identification method and a system applying this method. After the user electrically connects a plug-and-play storage device 6 to the terminal 12, an electronic certificate and the user's re-entry Enter the user's private key to carry out the control of identity identification and authority confirmation, and use a file system driver 4 to record the user's usage behavior, and regularly send this record to the remote management center 12 for the administrator It is used when checking records, and can effectively manage and monitor the flow of data to protect the company's rights and interests, so it can indeed achieve the purpose of its invention.

But the above are only preferred embodiments of the present invention, and should not limit the scope of the present invention with this, that is, all simple equivalent changes and modifications made according to the patent scope of the present invention and the content of the description of the invention, All should still belong to the scope that the patent of the present invention covers.

Claims (8)

1. A permission identification method for using a plug-and-play storage device, for judging whether the plug-and-play storage device electrically connected to a plug-and-play port of a data processing device is a legitimate device, the method comprising Follow the steps below: A) detecting whether at least one electronic certificate exists in one of the plug-and-play storage device and the data processing device; B) If so, require a user to enter a user-specific key; C) check the user's private key; D) If the verification is correct, allow data to be written into the plug-and-play storage device, Wherein, the electronic certificate is generated by encrypting with an administrator's private key, and there is a user public key in the electronic certificate, and the step B) further has the following sub-steps: B1) Verify the electronic certificate using a manager's public key corresponding to the manager's private key, so as to obtain the user's public key; B2) generating a random number, and encrypting the random number with the user's public key to form a ciphertext; and B3) request to input the user's private key; Wherein, the step C) is to use the user-specific key to decrypt the ciphertext, and check whether the decrypted data is equal to the random number; Wherein, the step D) has the following sub-steps: D1) If it is checked that the decrypted data is equal to the random number, then the user authority is read; D2) If the user has the permission to write data into the plug-and-play storage device, allow data to be written into the plug-and-play storage device. 2. The authorization identification method according to claim 1, wherein, the step A) further has the following sub-steps: A1) requesting input of address data for searching the electronic certificate; and A2) Search for the electronic certificate according to the address data. 3. A permission identification method using a plug-and-play storage device, used to judge whether a plug-and-play storage device electrically connected to a plug-and-play port of a data processing device is a legal device, and is applied to A control terminal and a user terminal, the control terminal and the user terminal are connected to each other through a network, wherein the control terminal has a server, the user terminal has at least one data processing device, and the data processing device Storing an electronic certificate sent by the server, the method includes the following steps: A) detecting whether the electronic certificate exists in one of the plug-and-play storage device and the data processing device; B) If so, require a user to enter a user-specific key; C) check the user's private key; D) If the verification is correct, allow data to be written into the plug-and-play storage device, Wherein, the electronic certificate is generated by encrypting with an administrator's private key, and there is a user public key in the electronic certificate, and the step B) further has the following sub-steps: B1) Verify the electronic certificate using a manager's public key corresponding to the manager's private key, so as to obtain the user's public key; B2) generating a random number, and encrypting the random number with the user's public key to form a ciphertext; and B3) request to input the user's private key; Wherein, the step C) is to use the user-specific key to decrypt the ciphertext, and check whether the decrypted data is equal to the random number; Wherein, the step D) has the following sub-steps: D1) If it is checked that the decrypted data is equal to the random number, then the user authority is read; D2) If the user has the permission to write data into the plug-and-play storage device, allow data to be written into the plug-and-play storage device. 4. The authority identification method according to claim 3, further comprising a step E) of periodically sending a user behavior record data to the server. 5. The authorization identification method according to claim 3, wherein, the step A) further has the following sub-steps: A1) requesting input of address data for searching the electronic certificate; and A2) Search for the electronic certificate according to the address data. 6. The authorization identification method according to claim 3, wherein the data processing device judges the user authorization according to a user authorization list. 7. The authority identification method according to claim 4, wherein the data processing device downloads the administrator's public key from the server periodically. 8. The authorization identification method according to claim 6, wherein the data processing device periodically downloads the user authorization list from the server.

Images