CN1405686A

CN1405686A - System and method for ensuring computer host security

Info

Publication number: CN1405686A
Application number: CN 01142167
Authority: CN
Inventors: 陈雅晃; 梁政钦
Original assignee: ATOZ TECHNOLOGY (TAIWAN) Inc
Current assignee: ATOZ TECHNOLOGY (TAIWAN) Inc
Priority date: 2001-09-14
Filing date: 2001-09-14
Publication date: 2003-03-26

Abstract

The invention relates to a system and a method for ensuring the security of a computer host, which ensure the security of the computer host by a hardware and software layer-by-layer protection mode, can prevent the invasion of hackers and protect the security of hard disk data. The system of the present invention is characterized by comprising: a computer motherboard, a processor, a north bridge chip, a south bridge chip, an input/output control chip, a keyboard, a card reader, a fingerprint scanner, a hard disk, an encryption/decryption card, and a shell.

Description

Guarantee the system and method for computer host safety

Technical field

The present invention is relevant a kind of system and method for guaranteeing computer host safety, particularly utilizes the protected mode of hardware and software simultaneously, to guarantee the safety of host computer.

Background technology

Application along with individual privacy and financial sector, though its convenience is popular, but its security is worrying also, especially will dominate the capital construction of whole application in future network identification and payment system, therefore before being extensive use of, must analyze the safety factor of existing system equipment, otherwise once host computer suffers that the illegal production mode is invaded or hard disk is stolen, will make all data exposures or even distorted.

Protect the identifying procedure of computer host safety traditionally; utilize operating system (OS) to do authentication after being generally start; or in start process, utilize basic input/output system (BIOS) to do authentication; yet these authentication methods are started shooting because of main frame; so can't stop the invasion of hacker (hacker) entirely; therefore the present invention could start shooting after need proposing authentication to pass through, but not just does the invention of authentication after the start.In addition; above-mentioned protected mode only has software mode, if the hard disk that stores data directly is stolen, these with software protection mode will be to make a futile effort; therefore the inventor uses the mode of protection hard disk and data thereof simultaneously again, to reach tight security protection.

Content of the present invention

Fundamental purpose of the present invention is to utilize the protected mode of hardware and software simultaneously, to guarantee the safety of host computer.

Another object of the present invention is to utilize authentication modes such as IC-card and identification of fingerprint, the user need authenticate by after just can make host computer start, but not just do authentication after the start.

Another purpose of the present invention be utilize on an enciphering/deciphering card and the shell microswitch with the protection hardware resources safety.

For achieving the above object, the present invention proposes a kind of system that guarantees computer host safety, and it comprises at least:

One computer motherboard, it comprises at least: a processor (Processor); One north bridge wafer (NorthBridge) is connected with processor, is as the flow management between processor and bus-bar, makes processor one operating system and an identification of fingerprint software be arranged in this storer to the access of devices such as storer; One south bridge wafer (South Bridge) is gone into control wafer with north bridge wafer and output and is connected, and is the bridge as USB interface and peripheral device data input processor; And one output go into control wafer, be connected with the south bridge wafer, this is exported and starts computer after control wafer receives only keyboard input proper password;

One keyboard is gone into control wafer with card reader and output and is connected, and just starts keyboard after this card reader authentication is finished and inputs password for the user;

One card reader, it utilizes operation circuit to be connected to above-mentioned computer motherboard, this card reader can be done authentication to IC-card, if legal user, then start-up control circuit, make the computer normal operation, if remove above-mentioned IC-card before above-mentioned computer normal boot-strap, this card reader starts computer and suspends (suspend) function, stops all and exports into action, and, can't restart above-mentioned computer as not authentication again;

One fingerprint scanner, it is connected with above-mentioned computer motherboard, and this fingerprint scanner is to accept the user to import fingerprint data;

One hard disk, it is connected with above-mentioned computer motherboard, and this hard disk is in order to store data;

One enciphering/deciphering card, it is connected with above-mentioned computer motherboard, this enciphering/deciphering card is to be stored to above-mentioned hard disk more earlier this data is done encryption when storing data after, and read again after when above-mentioned hard disk reads data, earlier this data being done decryption processing, the key of this enciphering/deciphering card is stored on the flash memory of this enciphering/deciphering card; And

One shell, it surrounds above-mentioned computer motherboard, card reader, fingerprint scanner, hard disk and enciphering/deciphering card, this shell comprises a microswitch, can start this microswitch when shell is opened, and removes the key in the flash memory that is stored in above-mentioned enciphering/deciphering card.

Cooperate above-mentioned system, the present invention proposes a kind of method of guaranteeing computer host safety, and it comprises following steps:

A. insert IC-card,, start computer by the IC-card identifying procedure;

B. start the operating system, read fingerprint data from hard disk simultaneously;

C. the user imports fingerprint by fingerprint scanner;

Whether d. identification of fingerprint software is compared above-mentioned fingerprint correct; If not, resumes step (c); If continue next step;

E. login operating system;

F. read/store the data of hard disk by the enciphering/deciphering card; This enciphering/deciphering card is to be stored to above-mentioned hard disk more earlier this data is done encryption when storing data after, and read again after when above-mentioned hard disk reads data, earlier this data being done decryption processing, the key of this enciphering/deciphering card is stored on the flash memory of this enciphering/deciphering card, on the shell microswitch is arranged simultaneously, when shell is opened, can start this microswitch, and remove the key in the flash memory that is stored in above-mentioned enciphering/deciphering card; And

G. check that this IC-card is whether still in card reader; If, but normal shutdown then; If not, then this card reader starts the computer pause function, stops all and exports into action, and display message is notified the user simultaneously.

Description of drawings

Fig. 1 is the system schematic of the embodiment of the invention;

Fig. 2 is the main flow chart of the embodiment of the invention;

Fig. 3 is the IC-card identifying procedure figure of the embodiment of the invention;

Fig. 4 is the process flow diagram that the computer of the embodiment of the invention suspends and remove this halted state.

Specific implementation

For disclosing the present invention in detail, following conjunction with figs. elaborates.Fig. 1 shows the system schematic of the embodiment of the invention, and it comprises at least by finding out system of the present invention among the figure: a computer motherboard 110, and this computer motherboard 110 comprises at least: a processor 111; One north bridge wafer 112 is connected with processor 111, is as the flow management between processor 111 and bus-bar, makes processor 111 one operating system and an identification of fingerprint software be arranged in this storer to the access of devices such as storer; One south bridge wafer 113, going into control wafer (present embodiment is the Winbond Super IO wafer 114 for being produced by winbond electronics company) with north bridge wafer 112 and output and be connected, is the bridge as USB interface, PCI interface, IDE interface and peripheral device (as: keyboard 121, serial port 122 and parallel port 123 etc.) data input processor 111; And a Winbond Super IO wafer 114, being connected with south bridge wafer 113, this Winbond Super IO wafer 114 starts computer after receiving only keyboard 121 input proper passwords; One keyboard 121 is connected with card reader 130 and Winbond Super IO wafer 114, just starts keyboard 121 after these card reader 130 authentications are finished and inputs password for the user; One card reader 130, it utilizes circuit to be connected to above-mentioned computer motherboard 110, this card reader 130 can be done authentication to IC-card, if legal user, start-up control circuit then, make the computer normal operation, if remove above-mentioned IC-card before above-mentioned computer normal shutdown, this card reader starts the computer pause function, stops all and exports into action, and as not authentication again, can't restart above-mentioned computer, this card reader has more comprised a light emitting diode (LED) 131 and a timer (not shown), behind the computer normal shutdown, if IC-card does not remove in the given time, can remind the user; One fingerprint scanner 140, it is connected with the USB interface with above-mentioned computer motherboard 110, and this fingerprint scanner 140 is to accept the user to import fingerprint data; One hard disk 150, it is connected with the IDE interface with above-mentioned computer motherboard 110, and this hard disk 150 is in order to store data; One enciphering/deciphering card 160, it is connected with the PCI interface with above-mentioned computer motherboard 110, this enciphering/deciphering card 160 is to be stored to above-mentioned hard disk 150 again this data is done encryption earlier when storing data after, and read again after when above-mentioned hard disk 150 reads data, earlier this data being done decryption processing, even therefore hard disk 150 goes adrift, its inside information also can't be picked out, and the key of this enciphering/deciphering card 160 is stored on the flash memory of this enciphering/deciphering card 160; An and shell 170, it surrounds above-mentioned computer motherboard 110, card reader 130, fingerprint scanner 140, hard disk 150 and enciphering/deciphering card 160, this shell 170 comprises a microswitch 171, usual shell 170 keeps opening circuit when closing, when being opened, shell 170 can start this microswitch 171, produce a clear signal to enciphering/deciphering card 160, and removing is stored in the interior key of flash memory of enciphering/deciphering card 160, when therefore opening shell 170 as if stealer, key will be eliminated, and also can't use even steal enciphering/deciphering card 160; One IC-card (not shown), whether it is to store the user to discern data, be legal use for card reader 130 identifications.

The main flow chart of the embodiment of the invention shown in Figure 2, the user inserts IC-card, behind the IC-card identifying procedure, start computer (as step 210), then start the operating system, read fingerprint data (as step 220) from hard disk 150 simultaneously, the user is by fingerprint scanner 140 input fingerprints (as step 230) then, and whether the above-mentioned fingerprint of identification of fingerprint software comparison correct (as step 240); If not, resumes step 230; If, then can login operating system (as step 250) and carry out general job, but when reading/store hard disk 150 data, it all needs by enciphering/deciphering card 160 (as step 260), this enciphering/deciphering card 160 is to be stored to above-mentioned hard disk 150 again this data is done encryption earlier when storing data after, and read again after when above-mentioned hard disk 150 reads data, earlier this data being done decryption processing, the key of this enciphering/deciphering card 160 is stored on the flash memory of this enciphering/deciphering card 160, on the shell 170 microswitch 171 is arranged simultaneously, when being opened, shell 170 can start this microswitch 171, and remove the interior key of flash memory that is stored in above-mentioned enciphering/deciphering card, also can't use even therefore steal enciphering/deciphering card 160.

The IC-card identifying procedure figure of the embodiment of the invention shown in Figure 3, it is the detailed process of Fig. 2 step 210, at first, card reader 130 enters holding state (as step 310) behind the input current, then the user inserts IC-card to card reader 130 (as step 320), and whether correctly card reader 130 judges IC-card (as step 330); If not, resumes step 310; If, card reader 130 start-up control circuits, make Winbond Super IO wafer 114 start keyboard 121 (as step 340), card reader 130 display message notify the user to input password simultaneously, then the user by keyboard 121 input passwords after (as step 350), whether correctly Winbond Super IO wafer 114 judges this password (as step 360); If not, resumes step 350; If then Winbond Super IO wafer 114 starts computer.

The computer of the embodiment of the invention shown in Figure 4 suspends and removes the process flow diagram of this halted state, and when computer is carried out general job (as step 410), card reader 130 can check always that IC-card is whether still in card reader 130; If, but normal shutdown (as step 470) then; If not, then this card reader starts the computer pause function, stops all and exports into action, simultaneously notify the user (as step 430) via light emitting diode (LED) 131 display message, see then whether the user inserts IC-card (as step 440) again, if not, resumes step 430; If card reader 130 is checked IC-card whether correct (as step 450) once more, if incorrect, resumes step 430; If correct, card reader 130 is removed this halted state, simultaneously resumes step 410.Behind step 470 computer normal shutdown, card reader 130 can check whether IC-card was extracted (as step 480) in 10 seconds, if then finish this flow process; If not, behind the timer inverse to 10 in the card reader 130 second, the sound that can give a warning is reminded the user, simultaneously resumes step 480 (as step 490).

In sum; a kind of system and method for guaranteeing computer host safety provided by the invention; by hardware and software protected mode layer by layer; to guarantee the safety of host computer; can stop hacker's invasion; and the safety of protection data on hard disc, so the important document of Patent Law invention, mere formality application have in accordance with the law been met.

Below the present invention has been done a detailed description, only the above, when not limiting scope of the invention process.To being familiar with the personage of this skill, when carrying out the variation example of various equivalences to it, precisely because all should be included in spirit of the present invention and the scope.

Claims

1. A system for ensuring the security of a computer host, characterized in that it at least includes:

a computer motherboard,

a processor;

A north bridge chip is connected with the processor, and is used as a flow control between the processor and the bus, so that the processor can access devices such as memory, and the memory has an operating system and a fingerprint identification software;

A south bridge chip is connected with the north bridge chip and the input and output control chip, and is used as a bridge for USB interface, PCI interface, IDE interface and peripheral device data input processor; and

An I/O control chip is connected with the south bridge chip, and the I/O control chip only receives the correct password from the keyboard to start the computer;

A keyboard is connected with the card reader and the input/output control chip, and the keyboard is activated for the user to input the password after the card reader authentication is completed;

A card reader, which utilizes a control line to connect to the above-mentioned computer main board, the card reader can confirm the IC card, if it is a legitimate user, then start the control line to make the computer operate normally, if the above-mentioned computer is normally started before Remove the above-mentioned IC card, the card reader will activate the computer suspend function, stop all input and output actions, and the above-mentioned computer cannot be restarted without re-authentication;

A fingerprint scanner, which is connected to the above-mentioned computer motherboard, and the fingerprint scanner accepts fingerprint data input by the user;

A hard disk, which is connected to the above-mentioned computer motherboard, and the hard disk is used for storing data;

An encryption/decryption card, which is connected with the above-mentioned computer mainboard, the encryption/decryption card encrypts the data before storing the data in the above-mentioned hard disk, and first encrypts the data when reading the data from the above-mentioned hard disk. The data is read out after being decrypted, and the key of the encryption/decryption card is stored on the flash memory of the encryption/decryption card; and

A shell, which surrounds the above-mentioned computer main board, card reader, fingerprint scanner, hard disk and encryption/decryption card, the shell includes a micro switch, when the shell is opened, the micro switch will be activated, and the memory stored in the The key in the flash memory of the above-mentioned encryption/decryption card.

2. The system for ensuring the security of a computer host as claimed in claim 1, further comprising:

An IC card is used to store user identification information for the card reader to identify whether it is legally used.

3. The system for ensuring the security of a computer host as claimed in claim 1, wherein the card reader further includes a light emitting diode (LED).

4. The system for ensuring the safety of the computer host as claimed in claim 3, wherein the card reader further includes a timer, which can remind the user if the IC card is not removed within a predetermined time after the computer is shut down normally .

5. A method for ensuring the safety of a computer host, characterized in that it comprises the following steps:

a. Insert the IC card, pass the IC card authentication process, and start the computer;

b. Start the operating system and read the fingerprint data from the hard disk at the same time;

c. The user inputs the fingerprint through the fingerprint scanner;

d. Whether the fingerprint recognition software compares the above fingerprints is correct; if not, go back to step (c); if so, continue to the next step;

e. Log in to the operating system;

f. Read/store the data of the hard disk through the encryption/decryption card; After the data is decrypted and then read out, the key of the encryption/decryption card is stored on the flash memory of the encryption/decryption card, and there is a micro switch on the casing, which will be activated when the casing is opened. And clear the key stored in the flash memory of the above-mentioned encryption/decryption card; and

g. Check whether the IC card is still in the card reader; if so, it can be shut down normally; if not, the card reader will activate the computer suspend function, stop all input and output actions, and display information to notify the user at the same time.

6. The method for ensuring the safety of a computer host as claimed in claim 5, wherein the IC card authentication process in step (a) includes the following steps:

a1. The card reader enters the standby state;

a2. Insert the IC card into the card reader;

a3. Determine whether the IC card is correct; if not, return to step (a1); if so, continue to the next step;

a4. The card reader activates the control circuit so that the input/output control chip activates the keyboard, and at the same time the card reader displays information to inform the user to enter the password;

a5. The user enters the password through the keyboard;

a6. The I/O control chip judges whether the password is correct; if not, return to step (a5); if so, proceed to the next step; and

a7. The I/O control chip starts the computer.

7. The method for ensuring the security of a computer host as claimed in claim 5 or 6, further comprising the following steps:

h. Whether to re-insert the IC card; if not, the computer continues to be suspended; if so, continue to the next step; and

i. Judging whether the IC card is correct; if not, the computer continues to stay in the suspended state; if so, the suspended state is released.

8. The method for ensuring the safety of the computer host as claimed in claim 5, wherein in step (g), after the computer is shut down normally, the card reader checks whether the IC card has been removed within a predetermined time; if not, the card reader Sound the warning.

9. The method for ensuring the security of a computer host as claimed in claim 8, wherein the predetermined time is 10 seconds.