Abstract:
The present invention discloses an authentication method based on private bytes of USB flash memory media, and implements a unit for executing authentication by using private bytes of USB flash memory media which is often used. A control chip of the USB flash memory disk receives a read/write instruction sent from the authentication unit, determines whether a read/write operation is executed to the private bytes. If it is, the read/write operation to the private bytes is executed. Otherwise, the read/write operation to normal bytes is executed. Thus, a variety of authentication information can be stored in the private bytes of the USB flash memory disk, which are invisible to users and can not be copied and deleted. The normal data can be stored in the normal bytes of the USB flash memory disk so that an encryption and authentication mechanism can be achieved with security and convenience.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     1. Field of Invention  
         [0002]     The present invention relates to an authentication method based on private bytes of USB flash memory media, and uses for the field of computer security.  
         [0003]     2. Description of Prior Art  
         [0004]     Conventional computers generally have no encryption devices. Recently, the privacy of the personal computers is paid more and more attention, especially for the security of business secretes and personal materials. Generally, the encryption function of the conventional computes is implemented by software. However, the probability that software is hacked is increased, and thus the information in the computers is less secure. On the other hand, most of the encryption methods with hardware, which are commercial available, are the use of Smart Cards, fingerprint recognition and watchdog which is a hardware encryption device. Although the encryption methods with hardware generates better effects than the use of the software, some disadvantages in those methods are as follows:  
         [0005]     1. The use of the encryption methods with hardware lacks popularity and the use is limited, for example, a lot of computers can not support a Smart Card;  
         [0006]     2. The hardware structure and circuit is complex, which results in an expensive cost; and  
         [0007]     3. The function of such encryption by using hardware is alone and thus does not represent notable advantages to the users.  
         [0008]     Recently, products encrypted with Universal Serial Bus (USB) flash memory disks also appear. But the encrypted information is placed in normal bytes of the USB flash memory disks, which is visible to the ordinary users and can be copied and deleted. Therefore, the security of the encryption can not be guaranteed well.  
       SUMMARY OF THE INVENTION  
       [0009]     The object of the present invention is to provide an authentication method based on private bytes of USB flash memory media which uses a commonly used USB flash memory media, for example, USB flash memory disk, with combination with authentication software. The method of the present invention uses the private bytes of the USB flash memory disk, which are invisible to a normal user and can not be copied and deleted, to store encrypted information and encrypted files so that the computer encryption and authentication can be achieved with security and convenience.  
         [0010]     The object of the present invention is achieved by the following technical solutions.  
         [0011]     An authentication method based on private bytes of USB flash memory media, comprising:  
         [0012]     step  10 , reading authentication information from the private bytes of the USB flash memory media by an authentication unit;  
         [0013]     step  20 , authenticating, by the authentication unit, the authentication information input by a user by using the authentication information read from the private bytes of the USB flash memory media;  
         [0014]     step  30 , determining whether the authentication is successful or not, if it is successful, opening an operation authorization based on the authentication information, otherwise, executing a process for failed authentication.  
         [0015]     Preferably, before the step  10 , the method further comprises:  
         [0016]     step  1 , detecting whether the USB flash memory disk is connected to the authentication unit, if it is, executing the step  10 ;  
         [0017]     step  2 , inquiring the user whether to re-authenticate or not, if the user determines to re-authenticate, then prompting the user to connect a USB flash memory media to a USB interface, and executing the step  1  after confirming the connection, otherwise, determining that the authentication is failed, and executing the process for failed authentication.  
         [0018]     Further, the process for failed authentication in the step  30  is to execute the step  2 .  
         [0019]     Alternatively, before the step  10 , the method further comprises:  
         [0020]     step  1 ′, detecting, by the authentication unit, whether the USB flash memory disk is connected to the authentication unit or not;  
         [0021]     step  2 ′, if the connection is held, executing the step  1 ′ after a predetermined time period, and if the connection is not held, then locking the operating system (for example, windows);  
         [0022]     step  3 ′, prompting the user to connect the USB flash memory media to the USB interface and inputting the authentication information;  
         [0023]     step  4 ′, detecting, by the authentication unit, whether the USB flash memory media is connected to the authentication unit;  
         [0024]     step  5 ′, if the connection is held, then executing the step  10 ; otherwise, executing the step  3 ′.  
         [0025]     The process for failed authentication in the step  30  is to release the lock of the operating system and execute the step  1 ′ if it is successful, otherwise, execute the step  4 ′.  
         [0026]     Preferably, the authentication method based on private bytes of USB flash memory media further comprises the step of setting the authentication information to the private bytes of the USB flash memory media when the authentication unit is installed, the setting step comprising:  
         [0027]     step A, sending the authentication information input by the user to the private bytes of the USB flash memory media by the authentication unit; step B, determining whether the operation of writing the authentication information into the private bytes of the USB flash memory media is successful, if it is successful, opening an operation authorization based on the authentication information, otherwise, executing a subsequent process for failed authentication if the operation of writing the authentication information is not successful.  
         [0028]     Preferably, the operating system log-on information of the user is contained in the authentication information.  
         [0029]     Preferably, before the step A, the method further comprises:  
         [0030]     step X, detecting, by the authentication unit, whether the USB flash memory media is connected to the authentication unit, if the connection is held, executing the step A;  
         [0031]     step Y, inquiring the user whether to re-authenticate or not , if the user determines to re-authenticate, then prompting the user to connect the USB flash memory disk to the USB interface, and executing the step X after confirming the connection; otherwise, determining that the authentication is failed, and ending the setting process.  
         [0032]     The subsequent process for failed authentication in the step B is to execute the step Y.  
         [0033]     A control chip of the USB flash memory media receives a read/write instruction sent from the authentication unit, determines whether a read/write operation is executed to the private bytes, if it is, the read/write operation to the private bytes is executed, if it is not, the read/write operation to normal bytes is executed.  
         [0034]     The present invention implements a module for executing authentication by using private bytes of USB flash memory media which is often used. A control chip of the USB flash memory media receives a read/write instruction sent from the authentication unit, determines whether a read/write operation is executed to the private bytes. If it is, the read/write operation to the private bytes is executed. If it is not, the read/write operation to normal bytes is executed. Thus, a variety of authentication information can be stored in the private bytes, which are invisible to a normal user and can not be copied and deleted, of the USB flash memory media, for example, a USB flash memory disk. The normal data can be stored in the normal bytes of the USB flash memory disk. According to the present invention, an encryption and authentication mechanism is achieved with security and convenience. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0035]     The above and other objects, features and advantages of the present invention will be clearer from the following detailed description about the non-limited embodiments of the present invention taken in conjunction with the accompanied drawings, in which:  
         [0036]      FIG. 1  is a block diagram showing the security authentication mechanism combining the security software and the USB flash memory disk according to an embodiment of the present invention;  
         [0037]      FIG. 2  is a diagram showing the function relationships while executing read/write operation by using the USB flash memory disk according to the embodiment of the present invention;  
         [0038]      FIG. 3  is a flowchart showing the process for writing a USB flash memory disk password while the security software is installed according to the embodiment of the present invention;  
         [0039]      FIG. 4  is a flowchart showing the process for authentication while the operation system of a computer is started-up according to the embodiment of the present invention;  
         [0040]      FIG. 5  is a flowchart showing the process for monitoring the USB flash memory disk and executing authentication after the USB flash memory disk is disconnected with the USB interface according to the embodiment of the present invention;  
         [0041]      FIG. 6  is a flowchart showing the process for encrypting files by using the method of the present invention; and  
         [0042]      FIG. 7  is a flowchart showing the process for decrypting files by using the method of the present invention. 
     
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS  
       [0043]     The present invention will be described in conjunction with the embodiments and with reference to the drawings in detailed as below.  
         [0044]     As shown in  FIG. 1 , the method according to an embodiment of the present invention installs security software into an operation system run on a computer. Information is exchanged between the security software and a USB flash memory disk via a USB interface.  
         [0045]     As shown in  FIG. 2 , the information is exchanged between the computer and the USB flash memory disk by using functions. The computer reads/writes file information from/into the normal bytes of the USB flash memory disk by invoking a function of ReadUdisk (parameter  1 )/WriteUdisk (parameter  1 ). The file information is read/written from/into private bytes of the USB flash memory disk by invoking a function of ReadPrivateBYTES (parameter  1 )/WritePrivateBYTES (parameter  1 ). The above two sets of functions are finally converted into a set of read/write functions of Read (parameter  1 , parameter  2 )/Write (parameter  1 , parameter  2 ) so that the bottom layer read/write operation is executed. For the parameters, the parameter  1  is the contents to be read/written, and the parameter  2  is a flag for indicating the normal/private bytes. A control chip of the USB judges the parameter  2  of the read/write functions. If the parameter  2  indicates “private”, then the control chip will read from the private bytes of the USB flash memory chip. If the parameter  2  does not indicate “private”, then the control chip will read from the normal bytes thereof.  
         [0046]     The Difference between the Private Bytes and the Normal Bytes is as follows.  
         [0047]     The private bytes are also referred as reserved bytes and are generally set during the manufacturing and the contents to be stored therein can be written by dedicated tools. The users can not change the properties, sizes and contents of the private bytes. In addition, these private bytes are invisible to the users and can not be formatted.  
         [0048]     The normal bytes are storage areas which can be used by the users with a right of complete control.  
         [0049]     Next, the process of writing a USB flash memory disk password and installing the security software will be described with reference to  FIG. 3 , which shows a flowchart for writing a USB flash memory disk password while the security software is installed according to an embodiment of the present invention. As shown in  FIG. 3 , when the security software is installed, a password and other authentication information set by the user are written into the USB flash memory media, for example, a USB flash memory disk. The process includes the steps as follows.  
         [0050]     At step  101 , the security software is installed.  
         [0051]     At step  102 , the security software is initialized, and the operation system log-on information such as username and log-on password is collected.  
         [0052]     At step  103 , whether the USB flash memory disk is properly connected or not is detected;  
         [0053]     At step  104 , whether the USB flash memory disk is properly connected is determining based on the detecting result of the step  103 . If so, the process goes to step  107 .  
         [0054]     At step  105 , the user is inquired whether to end the installation or not. If the user confirms the complete of the software installation, then the security software is quitted, and the installation procedure is ended. Therefore, the installation of the software is fail.  
         [0055]     At step  106 , the user is prompted to connect the USB flash memory disk to the USB interface, and the process goes to the step  103  after the user confirms the connection.  
         [0056]     At step  107 , a password of the USB flash memory disk is inputted by the user.  
         [0057]     At step  108 , the operation system log-on information and the USB flash memory disk password is formed into an encrypted file.  
         [0058]     At step  109 , the password is written into the private bytes or the normal bytes of the USB flash memory disk.  
         [0059]     At step  110 , it judges whether the writing of the password is successful or not. If it is, the process goes to execute the step  111 . If it is not, the process returns to the step  105 .  
         [0060]     At step  111 , the installation of the security software is complete, the operation system is rebooted.  
         [0061]     Next, the flow for authentication while the operation system of a computer is started-up will be described with reference of  FIG. 4 . As shown in  FIG. 4 , whenever the operating system starts up, the security software installed in the computer executes a security authentication to the user before the user logs-on the computer. If the authentication is passed, an automatic log-on is then executed based on the operation system log-on information stored in the USB flash memory disk. Otherwise, the operation system will be shut down. The steps for the authentication are as follows.  
         [0062]     At step  201 , the operation system is started up.  
         [0063]     At step  202 , whether the USB flash memory disk is properly connected or not is detected.  
         [0064]     At step  203 , whether the USB flash memory disk is properly connected or not is determined based on the detecting result in the step  202 . If it is, the process goes to the step  206 . If it is not, the process proceeds to the step  204 ;  
         [0065]     At step  204 , the user is inquired whether to re-authenticate or not. If the user determines to re-authenticate, the process goes to the step  205 . Otherwise, the operation system is shut down.  
         [0066]     At step  205 , the user is prompted to connect the USB flash memory disk to the USB interface, and the process returns to the step  202  after the user confirms the connection;  
         [0067]     At step  206 , the user inputs a USB flash memory disk password;  
         [0068]     At step  207 , the authentication information of the USB flash memory disk is read.  
         [0069]     At step  208 , the password input by the user is authenticated according to the authentication information.  
         [0070]     At step  209 , whether the authentication is successful or not is determined. If it is successful, the process goes to the step  210 , and if it is not, the process returns to the step  204 .  
         [0071]     At step  210 , the operation system is automatically logged on with the operation system log-on information stored in the USB flash memory disk.  
         [0072]     Next, the process for monitoring the USB flash memory disk and executing authentication after the USB flash memory disk disconnects with the USB interface will be described with reference to  FIG. 5 . As shown in  FIG. 5 , the security software will periodically detect the status of the USB flash memory disk during the operating system normally operates. In a case where the user temporarily leaves the computer, it is not necessary to shut down the operation system, only the pullout of the USB flash memory disk is enough. The system will be locked automatically when the security software detects the absence of the USB flash memory disk. Only if the USB flash memory disk is connected to the computer (USB interface) and the security authentication is passed, the security software releases the lock of the system and causes the system resuming the normal operation conditions. The steps for monitoring and executing authentication are as follows.  
         [0073]     At step  301 , the security software periodically detects the USB flash memory disk when the user executes normal operations;  
         [0074]     At step  302 , it determines whether the USB flash memory disk is properly connected or not based on the detecting result in the step  301 . If it is, the process returns to the step  301 . Otherwise, the process goes to the step  303 .  
         [0075]     At step  303 , the operating system is locked.  
         [0076]     At step  304 , the user is prompted to connect the USB flash memory disk to the USB interface.  
         [0077]     At step  305 , whether the USB flash memory disk is properly connected or not is detected after the connecting of the USB flash memory disk.  
         [0078]     At step  306 , whether the USB flash memory disk is properly connected or not is determined based on the detecting result in step  305 . If it is, the process goes to the step  307 . Otherwise, process returns to the step  304 .  
         [0079]     At step  307 , the user inputs a USB flash memory disk password.  
         [0080]     At step  308 , the authentication information of the USB flash memory disk is read.  
         [0081]     At step  309 , the password input by the user is authenticated according to the authentication information;  
         [0082]     At step  310 , whether the authentication is successful or not is determined. If it is successful, the process goes to the step  311 . If it is not, the process returns to the step  304 .  
         [0083]     At step  311 , the lock of the operating system is released and then the process returns to the step  301 .  
         [0084]     The encryption/decryption to files with the security software and the USB flash memory disk will be described with reference to  FIG. 6 . As shown in  FIG. 6 , the method of the present invention can be further used to encrypt/decrypt files. The process of encrypting files with the security software and the USB flash memory disk includes the following steps.  
         [0085]     At step  501 , the file to be encrypted is determined.  
         [0086]     At step  502 , whether the USB flash memory disk is properly connected or not is detected;  
         [0087]     At step  503 , whether the USB flash memory disk is properly connected or not is determined based on the detecting result in the step  502 . If it is, the process goes to the step  506 . If it is not, the process goes to the step  504 .  
         [0088]     At step  504 , the user is inquired whether to re-authenticate or not. If the user determines to re-authenticate, the process goes to the step  505 . Otherwise,the encryption process is exited, and the file is unencrypted.  
         [0089]     At step  505 , the user is prompted to connect a USB flash memory disk to the USB interface. The process goes to the step  502  after confirming the connecting of the USB flash memory disk.  
         [0090]     At step  506 , the user inputs an encryption password.  
         [0091]     At step  507 , the authentication information is written into the private bytes of the USB flash memory disk.  
         [0092]     At step  508 , it judges whether the writing of the authentication information is successful or not. If it is successful, the process goes to the step  509 . Otherwise, the process returns to the step  504 ;  
         [0093]     At step  509 , the normal file is converted into an encrypted file.  
         [0094]     Next, a method of decrypting the encrypted files with the security software and the USB flash memory disk will be described with reference to  FIG. 7 . As shown in  FIG. 7 , the method includes the following steps.  
         [0095]     At step  401 , the file to be decrypted is determined.  
         [0096]     At step  402 , whether the USB flash memory disk is properly connected or not is detected.  
         [0097]     At step  403 , whether the USB flash memory disk is properly connected or not is determined based on the detecting result in the step  402 . If it is, the process goes to the step  406 . If it is not, then the process goes to the step  404 .  
         [0098]     At step  404 , the user is inquired whether to re-authenticate or not. If the user determines to re-authenticate, then the process goes to the step  405 . Otherwise, the decryption process is exited. At that time, the file is still in the encrypted state.  
         [0099]     At step  405 , the user is prompted to connect the USB flash memory disk to the USB interface. The process returns to the step  402  after confirming the connection of the USB flash memory disk.  
         [0100]     At step  406 , the user inputs a decryption password.  
         [0101]     At step  407 , the authentication information of the USB flash memory disk is read.  
         [0102]     At step  408 , the password input by the user is authenticated according to the authentication information.  
         [0103]     At step  409 , whether the authentication is successful or not is determined. If it is successful, the process goes to the step  410 . If it is not, the process returns to the step  404 .  
         [0104]     At step  410 , the encrypted file is restore into the normal file.  
         [0105]     It should be noted that the above embodiments are described for only illustrating the technical solutions of the present invention without limiting the scope of the present invention. Although the present invention is illustrated with reference to the preferred embodiments thereof, it should be understood by those skilled in the art that various changes or equivalent alterations to the present invention are possible without departing from the spirit or scope of the present invention and are encompassed in the scope defined by the claims of the present invention.