CN101504708A - Computer security apparatus and method - Google Patents
Computer security apparatus and method Download PDFInfo
- Publication number
- CN101504708A CN101504708A CNA2009100802904A CN200910080290A CN101504708A CN 101504708 A CN101504708 A CN 101504708A CN A2009100802904 A CNA2009100802904 A CN A2009100802904A CN 200910080290 A CN200910080290 A CN 200910080290A CN 101504708 A CN101504708 A CN 101504708A
- Authority
- CN
- China
- Prior art keywords
- computer
- hard disk
- interface
- data
- protection module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
本发明公开了计算机安全防护装置及其方法。所述装置包括：连接计算机主板的主板接口；连接计算机硬盘的硬盘接口；连接在所述主板接口与所述硬盘接口之间的硬盘数据保护模块。本发明的硬盘数据保护模块对硬盘数据进行物理拦截，把原本从计算机主板连接到硬盘的IDE数据线改为经由硬盘数据保护模块之后，再连接到硬盘，从而实现了对包括计算机操作系统在内的所有硬盘数据的保护处理。
The invention discloses a computer safety protection device and a method thereof. The device comprises: a mainboard interface connected to a computer mainboard; a hard disk interface connected to a computer hard disk; a hard disk data protection module connected between the mainboard interface and the hard disk interface. The hard disk data protection module of the present invention physically intercepts the hard disk data, changes the IDE data line originally connected to the hard disk from the computer motherboard to the hard disk data protection module, and then connects to the hard disk, thereby realizing the protection of computer operating systems. Protection processing of all hard disk data.
Description
Technical field
The present invention relates to the protecting information safety devices and methods therefor, particularly computer security apparatus and method thereof.
Background technology
Computer technology is maked rapid progress, computer network constantly develops, popularizing day by day of electronic office makes global IT application become the megatrend of human development, and government and the enterprises and institutions data more than 80% leave in the computing machine with electronic format.
Enjoying the information-based convenience of bringing and while efficiently, the security of information also is on the hazard.In order to prevent that classified information, important sensitive informations such as business datum, information carrier, information process etc. from leaking, relating computer or preserve important information, the confidential necessary security safeguard procedures of taking of data computing.Computer security comprises physical security strategy, access control policy, data protection technology etc.; present have the securing software of many types can provide as services such as access control, movable storage device use control, external connection apparatus use control, network connection controls on the market; but the service that this class software of one side provides does not comprise the physics safety prevention measure, and there is the possibility that is bypassed in software under many situations on the other hand.Though therefore a lot of softwares have also strengthened the safeguard protection of self, reinstall operating system software function was lost efficacy.Therefore comprise the physical security strategy in all directions completely computer security could fundamentally solve computer security hidden danger.In addition, it seems with regard to present market, nearly all protecting information safety series products all is to install, run on the operating system, the software or the driving of the type selecting appropriate version of the operating system that need install according to computing machine during use are installed, not only ease of use is not high, and have software or drive may with problems such as operating system or computer hardware be incompatible.
Summary of the invention
The purpose of this invention is to provide a kind of computer security apparatus that can address the above problem.
Another object of the present invention provides a kind of method of utilizing aforementioned calculation machine safety device to carry out computer security.
According to first aspect, computer security apparatus of the present invention comprises:
The mainboard interface that connects computer motherboard;
The hard-disk interface that connects hard disc of computer;
Be connected the hard disk data protection module between described mainboard interface and the described hard-disk interface.
Hard disk data protection module of the present invention is carried out the physics interception to hard disc data; script is changed into via after the hard disk data protection module from the IDE data line that computer motherboard is connected to hard disk; be connected to hard disk, thereby realized protection processing all hard disc datas that comprise computer operating system.
Wherein said hard disk data protection module receives data from computer motherboard by mainboard interface, with its encryption after store hard disc of computer into by described hard-disk interface; And described hard disk data protection module reads the encrypted data that is stored in the described hard disk via described hard-disk interface, with its deciphering after deliver to computer motherboard by mainboard interface.
Computer security apparatus of the present invention also comprises safety protection module and pci interface, and described safety protection module and described hard disk data protection module are connected the pci bus of computing machine via described pci interface.
Wherein, described pci interface inserts in the PCI slot of computer motherboard by corresponding plug.
Wherein, described safety protection module carries out the computer starting checking and/or starts the medium selection function with computing machine.
Wherein, described safety protection module comprises the storer of storage security guard process, in the computer starting process, the Basic Input or Output System (BIOS) of computing machine (BIOS) is read the described security protection program of storing in the described storer in the described calculator memory, so that the described security protection program of computer run.
Computer security apparatus of the present invention also comprises key device, and described key device is authorized file via cipher key interface for described hard disk data protection module provides, and provides authentication password for described safety protection module.
Wherein, described storer connects described pci interface via pci interface chip.
Wherein, described key device is the memory device that is suitable for USB interface of being authorized file that has authentication password and hard disk data protection module, and described cipher key interface is a USB interface; Wherein, described USB interface is via selecting chip to connect described hard disk data protection module and pci interface chip respectively.
According to second aspect, the method for utilizing aforementioned calculation machine safety device to carry out computer security of the present invention may further comprise the steps:
The interception computing machine will write all data of hard disc of computer;
The data of being tackled are carried out encryption;
Data through encryption are write hard disc of computer; And
During computing machine reads hard disc of computer, the encrypted data of storing in the hard disc of computer is decrypted processing.
Said method of the present invention is further comprising the steps of:
In the computer starting process, the Basic Input or Output System (BIOS) of computing machine (BIOS) is read the security protection program of the memory stores in the computer security apparatus in the described calculator memory, move described security protection program, so that object computer starts authentication function and starts the medium selection function.
The present invention has considered compatibility and ease for use emphatically, simultaneously can be for the computing machine significant data provide the physical security protection, thereby realize to computing machine comprehensively, security protection completely.
Below in conjunction with accompanying drawing device of the present invention, method are elaborated.
Description of drawings
Fig. 1 is the schematic diagram of computer security apparatus of the present invention;
Fig. 2 is the embodiment synoptic diagram of computer security apparatus of the present invention.
Embodiment
Computer security apparatus of the present invention is to be the hardware card of carrier with the PCI adapter, the subsidiary key device that has authentication password and authority.The invention provides the password authentification of computer starting, the safeguard measure of the startup computer hardware of the bottom is provided at the BIOS layer, and provide dual authentication mechanism in conjunction with the overall data protection of hard disk checking, guarantee to have only authorized user can use a computer hardware device and hard disc data, provide the computer system confidentiality and integrity to detect; The overall protection of hard disc data has realized the real-time guard to hard disc data, and transparent fully to the user; Configurable computer starting medium selection function has realized the pressure hard disk startup or has set sequence starting, the potential safety hazard of having avoided optical disk start-up to bring according to BIOS.This product can be accomplished the i.e. usefulness of plug-in card, and with operating system independent, the hardware environment compatibility is good, need not to install any software or driving, more can not lose efficacy because reinstalling operating system, has really realized the comprehensive security protection to computing machine.
Fig. 1 has shown computer security apparatus theory structure of the present invention, and as shown in Figure 1, computer security apparatus of the present invention mainly comprises: the mainboard interface 1 that connects computer motherboard; The hard-disk interface 2 that connects hard disc of computer; Be connected the hard disk data protection module 4 between described mainboard interface 1 and the described hard-disk interface 2.
Hard disk data protection module 4 can be a data signal processor (DSP); it carries out the physics interception to hard disc data; that is to say script is changed into via after the hard disk data protection module 4 from the IDE data line that computer motherboard is connected to hard disk; be connected to hard disk, thereby realized protection processing all hard disc datas that comprise computer operating system.
When computing machine will be to the hard disc of computer write data, the data that hard disk data protection module 4 receives from computer motherboard by mainboard interface 1, with its encryption after store hard disc of computer into by described hard-disk interface 2.
When computing machine will be from the hard disk reading of data, hard disk data protection module 4 read the encrypted data that is stored in the described hard disk via described hard-disk interface 2, with its deciphering after deliver to computer motherboard by mainboard interface 1.
Above-mentioned data encryption process can be the process that the data of 4 pairs of hard disks to be written of hard disk data protection module are carried out format conversion; Described decrypting process can be the process of having changed and having resolved through the data of format conversion to reading from hard disk.
In an example, mainboard interface 1 of the present invention can be an ide interface 1, and hard-disk interface 2 can be an ide interface 2.When to the hard disk write data, hard disk data protection module 4 carries out all data of tackling to store hard disk again into after the format conversion, be equivalent to a kind of " ciphertext " through the data after the format conversion, have only by can correctly resolving after the proper authorization, thereby the computing machine user can these data of normal reading, that is to say that all be can not be by " mess code " of Direct Recognition through the hard disk data protection module stores to the data of hard disk; When data were read from hard disk, data were resolved by the hard disk data protection module earlier, deliver to then on the IDE bus.Data Format Transform wherein and resolving are finished automatically by hard disk data protection module 4, and 4 of hard disk data protection modules are responsible for resolving the IDE bus protocol, and finish format conversion and resolving to data.
Computer security apparatus of the present invention also comprises safety protection module 3 and pci interface 5.Safety protection module 3 and described hard disk data protection module 4 are connected the pci bus of computing machine via described pci interface 5, and wherein pci interface 5 inserts in the PCI slot of computer motherboard by corresponding plug.
Safety protection module 3 of the present invention carries out the computer starting checking and/or starts the medium selection function with computing machine.
In addition, safety protection module 3 has the authority that hardware data protection module 4 carries out data encryption/decryption, and when starting, computing machine will be verified the correctness of hard disk data protection functional module authority automatically.
Fig. 2 has shown an example of computer security apparatus of the present invention, as shown in Figure 2, safety protection module 3 comprises the storer 31 of storage security guard process, in the computer starting process, the Basic Input or Output System (BIOS) of computing machine (BIOS) is read the described security protection program of storage in the described storer 31 in the described calculator memory, so that the described security protection program of computer run.Storer 31 can be FLASHROM.
In addition, safety protection module 3 also comprises pci interface chip 32, is used for the parsing of pci data interface, finishes the work such as initialization of PCI equipment, and when the program module that from storer 31, reads function of safety protection after the PCI equipment disposition.As shown in Figure 2, storer (31) connects described pci interface (5) via pci interface chip (32).
The present invention comprises that is also selected a chip 8, and USB interface 7 connects described hard disk data protection module 4 and pci interface chip 32 respectively via this selection chip 8.
Hard disk data protection module 4 and function of safety protection module 5 (comprising FLASHROM 31 and pci interface chip 32) be provided with and select chip 8 reasons to be: because all will read the data among the USB Key; but the same time can only be operated USB Key by a module, so select chip 8 to be used for selecting by which functional module key K ey to be read and write.
Computer starting authentication function and startup medium selection function all are the parts of function of safety protection program module, the code of this part is kept among the FLASHROM 31, in the start-up course of computing machine, BIOS finishes detection and the initialization to computer security apparatus (being a PCI equipment in essence) shown in Figure 2 of the present invention, and distribute suitable computer resource, BIOS reads the program module of the function of safety protection among the FLASHROM 31 in calculator memory by pci interface chip 32 then, and move this module (just computer starting authentication function and startup medium selection function), thereby the function of safety protection module is achieved.
Key device (not shown) of the present invention is actually a storer, and this key device is authorized file via cipher key interface 7 for described hard disk data protection module 4 provides, and provides authentication password for described safety protection module.When key device is when being suitable for the memory device of USB interface, 7 of described cipher key interface are USB interface 7.
Preserve the hard disk data protection functional module in the key device and carry out the authority of data protection/parsing; and the used password password of the computer starting authentication function of function of safety protection module; so when the computer starting of " computer security apparatus " of the present invention has been installed; automatically verify the correctness (not needing the user to participate in) of the authority of hard disk data protection module; and the correctness of authentication password password (needing the user to input correct password); any checking that is to say and can only select to shut down computer not by all having no idea to start the hardware device of computing machine in the two.
In addition, the present invention can also utilize computer security apparatus to carry out the method for computer security, and this method may further comprise the steps:
The interception computing machine will write all data of hard disc of computer;
The data of being tackled are carried out encryption;
Data through encryption are write hard disc of computer; And
During computing machine reads hard disc of computer, the encrypted data of storing in the hard disc of computer is decrypted processing.Above-mentioned steps can be finished by hard disk data protection module 4 of the present invention.
In addition, said method of the present invention can also may further comprise the steps:
In the computer starting process, the Basic Input or Output System (BIOS) of computing machine (BIOS) is read the security protection program of the storer in the computer security apparatus (31) storage in the described calculator memory, and move described security protection program, so that object computer starts authentication function and starts the medium selection function.
In sum, the present invention has following technical characterstic:
1, computer security apparatus of the present invention is a PCI equipment in essence, when the BIOS of computing machine detects a PCI equipment of the present invention and has carried expansion ROM (storer 31), at first in expansion ROM, search suitable reflection, and copy to and carry out setup code among the RAM.After initialize routine finished, BIOS adjusted the storage space of distributing to the expansion ROM code, and had the main storage region of expansion ROM code to carry out write-protect to resident, prevented to rewrite this regional content after the operating system acquire the right of control.This moment, all computer standard hardware devices passed through to detect, thereby the security protection program almost can be utilized all computer resources.The security protection procedure stores just can be accomplished the i.e. usefulness of plug-in card in ROM, do not need any software or driving are installed, and is convenient for users to use; Secondly,, and which kind of operating system independent has been installed before booting operating system, has been broken through the restriction of platform because program is to move; The most important thing is that the safety prevention measure that utilizes this mechanism to realize does not exist because there is not any possibility that is bypassed in unloading or reinstall operating system and the possibility that lost efficacy yet.
2,, and generally all be kept on the harddisk memory at the important information of computing machine based on consideration to the computer physics security protection, thus to the overall resist technology of hard disk be guarantee responsive, that important information does not leak is basic.In addition for consideration to the speed aspect; it is to realize the most direct effective and efficient manner of protection totally that hard disc data is carried out physics interception; that is to say script is connected to earlier on the computer security apparatus of the present invention (being PCI Mezzanine Card) from the IDE data line that computer motherboard is connected to hard disk; through behind the data protection module 4; be connected to hard disk; be responsible for the parsing and the real-time format conversion processing of IDE data by data protection module 4: all write the data of hard disk and all pass through the protection module format conversion, and the data of reading are all passed through data protection module 4 and resolved.
Through the hard disk of protecting totally; only can be accessed under the situation that proper authorization information is provided; otherwise can not be from hard disk startup operating system, hard disc data can not cracked by any data reduction technology yet, thereby has realized the physical security protection of computer data.
The present invention can use in such a way:
At first, the mainboard ide interface with mainboard ide interface 1 connection computing machine of the present invention connects the hard disc of computer ide interfaces with hard disk ide interface 2;
Pci interface of the present invention is inserted in any one idle PCI slot of computer motherboard by the pci interface plug;
Key device is inserted on the USB interface 7 of the present invention; Installing operating system can normally use a computer after the successful installation then.After this each use is as long as insert shielding card to correct USB Key, and when each the startup the normal proof procedure of process, can normally use a computer.
In addition, the present invention opens a pilot lamp (LED) 6 that shows 4 operations of hard disk data protection module can be set.
The present invention has following technique effect:
1. startup password protection: start the password authentification of computer hardware equipment, proper password is kept in the key device.User interface prompt user by imitative Windows behind the computer starting inputs password, input error password number of times reaches limited number of times and then locks computing machine, locking computing machine number of times is above three times continuously, key device is with locked, this locking must be removed by the keeper, has guaranteed only can use a computer under the situation of proper authorization hardware device.After password authentification, the user can select directly to start computing machine, revise information such as password, shutdown or software for display version copyright by graphical interfaces, but password can not be sky.
2. start the medium configuration: by the selection of administrator configurations startup medium, the boot sequence startup that can select hard disk startup or be provided with according to BIOS.If the selection hard disk startup then no matter whether be provided with the CD-ROM drive startup in BIOS preferentially all can be forced from hard disk startup operating system.
3. data protection totally: the hard disk data protection of chip-scale, protection comprises all hard disc datas of operating system file, even if the hard disk obliterated data also can not be cracked by any data recovery technique, has realized the physical security of information; 128 hard disk protection key has guaranteed that impossible hardware by the modern times cracks, and key is kept among the USB Key, has strengthened security; The protection process is transparent fully to the user, does not influence computing power.
Although above the present invention is had been described in detail, the invention is not restricted to this, those skilled in the art of the present technique can carry out various modifications according to principle of the present invention.Therefore, all modifications of doing according to the principle of the invention all should be understood to fall into protection scope of the present invention.
Claims (10)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009100802904A CN101504708B (en) | 2009-03-17 | 2009-03-17 | Computer security apparatus and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2009100802904A CN101504708B (en) | 2009-03-17 | 2009-03-17 | Computer security apparatus and method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101504708A true CN101504708A (en) | 2009-08-12 |
| CN101504708B CN101504708B (en) | 2011-02-02 |
Family
ID=40976949
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2009100802904A Expired - Fee Related CN101504708B (en) | 2009-03-17 | 2009-03-17 | Computer security apparatus and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101504708B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103823692A (en) * | 2013-12-31 | 2014-05-28 | 北京华虹集成电路设计有限责任公司 | Computer operating system starting method |
| CN108182353A (en) * | 2018-01-29 | 2018-06-19 | 河南中医药大学 | A kind of computer network security shielding system |
| CN109308414A (en) * | 2018-08-27 | 2019-02-05 | 山东超越数控电子股份有限公司 | A kind of mainboard clean boot realization system and method based on Domestic Platform |
| CN113612769A (en) * | 2021-08-02 | 2021-11-05 | 北京力天世技系统集成有限公司 | Data safety type connector |
-
2009
- 2009-03-17 CN CN2009100802904A patent/CN101504708B/en not_active Expired - Fee Related
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103823692A (en) * | 2013-12-31 | 2014-05-28 | 北京华虹集成电路设计有限责任公司 | Computer operating system starting method |
| CN103823692B (en) * | 2013-12-31 | 2019-05-10 | 北京华虹集成电路设计有限责任公司 | A kind of computer operating system starting method |
| CN108182353A (en) * | 2018-01-29 | 2018-06-19 | 河南中医药大学 | A kind of computer network security shielding system |
| CN109308414A (en) * | 2018-08-27 | 2019-02-05 | 山东超越数控电子股份有限公司 | A kind of mainboard clean boot realization system and method based on Domestic Platform |
| CN113612769A (en) * | 2021-08-02 | 2021-11-05 | 北京力天世技系统集成有限公司 | Data safety type connector |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101504708B (en) | 2011-02-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10061928B2 (en) | Security-enhanced computer systems and methods | |
| CN102208000B (en) | Method and system for providing security mechanisms for virtual machine images | |
| CN107563213B (en) | Safety secrecy control device for preventing data extraction of storage equipment | |
| EP3776223B1 (en) | Secured computer system | |
| US7840795B2 (en) | Method and apparatus for limiting access to sensitive data | |
| CN102884535A (en) | Protected device management | |
| CN102254119B (en) | Safe mobile data storage method based on fingerprint U disk and virtual machine | |
| US20080040613A1 (en) | Apparatus, system, and method for secure password reset | |
| US8539246B2 (en) | Secure resume for encrypted drives | |
| US20080263542A1 (en) | Software-Firmware Transfer System | |
| CN102346716B (en) | Encryption method and decryption method of hard disk storage device and encryption and decryption system used for hard disk storage device | |
| CN101504708A (en) | Computer security apparatus and method | |
| CN101447009A (en) | Method, device and system for installing software | |
| CN104751080A (en) | USB (Universal Serial Bus) flash disk encryption-based data access method and system | |
| CN104361298B (en) | The method and apparatus of Information Security | |
| CN116451188B (en) | Software program operation safety protection method, system and storage medium | |
| CN201845340U (en) | Safety computer provided with user safety subsystem | |
| TWI474189B (en) | Automatic file encryption and decryption system | |
| CN113360877A (en) | Method for designing safe mobile storage medium based on RAM | |
| CN115935389A (en) | Personal sensitive information protection method and device, electronic equipment and storage medium | |
| CN113420340A (en) | Information recording device, computer equipment and information recording method | |
| CN103198029B (en) | Pen drive and data storage system with protection mechanism | |
| Deng et al. | A new architecture of sensitive file management based on Dual-Core and EFI |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CP02 | Change in the address of a patent holder | ||
| CP02 | Change in the address of a patent holder |
Address after: 100086 Beijing Haidian District Dijin Road 9 Courtyard 9 Building 4 Floor 101 Patentee after: BEIJING TIP TECHNOLOGY Co.,Ltd. Address before: 100086 Building 46, Area 6, 43 North Third Ring West Road, Haidian District, Beijing Patentee before: BEIJING TIP TECHNOLOGY Co.,Ltd. |
|
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20090812 Assignee: CHINA TECHNOLOGY EXCHANGE Co.,Ltd. Assignor: BEIJING TIP TECHNOLOGY Co.,Ltd. Contract record no.: X2022110000030 Denomination of invention: Computer security protection device and method Granted publication date: 20110202 License type: Exclusive License Record date: 20220927 |
|
| EE01 | Entry into force of recordation of patent licensing contract | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Computer security protection device and method Effective date of registration: 20220930 Granted publication date: 20110202 Pledgee: CHINA TECHNOLOGY EXCHANGE Co.,Ltd. Pledgor: BEIJING TIP TECHNOLOGY Co.,Ltd. Registration number: Y2022110000251 |
|
| EC01 | Cancellation of recordation of patent licensing contract | ||
| EC01 | Cancellation of recordation of patent licensing contract |
Assignee: CHINA TECHNOLOGY EXCHANGE Co.,Ltd. Assignor: BEIJING TIP TECHNOLOGY Co.,Ltd. Contract record no.: X2022110000030 Date of cancellation: 20240328 |
|
| PC01 | Cancellation of the registration of the contract for pledge of patent right | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right |
Granted publication date: 20110202 Pledgee: CHINA TECHNOLOGY EXCHANGE Co.,Ltd. Pledgor: BEIJING TIP TECHNOLOGY Co.,Ltd. Registration number: Y2022110000251 |
|
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20110202 |