Abstract:
A data protection system is constructed to protect data stored on storage devices or media by changing the mapping between the physical position and the operating system acknowledged position of storage cells.  
     It includes a storage space address conversion module which converts the default space address sequence of the protected zone of storage devices or media designated by the system to the re-mapped space address sequence, and a data encryption/decryption module which encrypts plaintext into ciphertext using an encryption algorithm with an encryption key before saving the data and decrypts ciphertext back to plaintext using a decryption algorithm with a decryption key after reading of data.  
     Therefore those computers without the data protection system and those computers with different re-mapping mechanism cannot read the correct data out of the protected zone of the storage devices or media.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    This invention relates to a data protection system that protects the data stored on computer peripheral storage devices or media, more particularly to a data protection system which protects the data stored on the protected zone of storage devices or media by re-mapping the address of the protected zone of the storage devices or media, encrypting the data to be stored before writing it to the storage devices or media, and decrypting the data right after it is read out of the storage devices or media.  
           [0003]    2. Description of the Related Art  
           [0004]    Along with fast improvement of computer technology, almost all government organizations, research centers, academic institutes, and companies use computers for documents writing. A variety of computer peripheral storage devices or media have been developed for digital data storage, including documents, technical data, confidential data, . . . etc. People are used to store data, prepare copies of data for backup or carrying them from place to place with peripheral data storage devices or media because of ease to carry, space saving and long life-time usage. Although data storage devices or media provide efficient way of storing data, they also become the target of computer criminals. Computer criminals may steal confidential data via the Internet. Various data protection methods have been developed to protect data by encrypting plaintext into ciphertext. However, conventional data protection methods can be easily broken by using more computers.  
         SUMMARY OF THE INVENTION  
         [0005]    The invention provides a data protection system for the protected zone of storage devices or media, which protect data stored on the storage devices or media from unauthorized access by configuring an address re-mapping mechanism according to an address conversion key and the protected zone default address sequence to convert protected zone default address sequence to protected zone re-mapped address sequence. Therefore those computers without the data protection system and those computers with the data protection system but different re-mapping mechanism cannot read the correct data out of the protected zone of the storage devices or media.  
           [0006]    The protection is achieved by storing data to and reading data from the storage cells corresponding to re-mapped addresses instead of system-designated addresses. And the data is encrypted before being stored and decrypted after being read out. The embodiment includes initially generating an address re-mapping rule according to an address conversion key CNVkey and the protected zone default address sequence [Pi, i=0, 1, . . . , n], and then using the address re-mapping rule to setup a protected zone address re-mapping table which can be used for look-up to convert the protected zone default address sequence [Pi, i=0, 1, . . . , n] into the protected zone re-mapped address sequence [Si, i=0, 1, . . . , n] afterwards. When storing data, the plaintext [Di, i=0, 1, . . . , m] is encoded into the ciphertext [Ri, i=0, 1, . . . , k] using an encryption algorithm with an encryption key, and then the access domain default address sequence [Ui, i=0, 1, . . . , x] is converted into the access domain re-mapped address sequence [Vi, i=0, 1, . . . , x] using the address re-mapping rule or the address re-mapping table. Finally, the ciphertext is stored to the storage device according to the access domain re-mapped address sequence. When reading data, the system designated access domain default address sequence [Ui, i=0, 1, . . . , x] is converted into the access domain re-mapped address sequence [Vi, i=0, 1, . . . , x] using the address re-mapping rule or the protected zone address re-mapping table, and then the ciphertext [Ri, i=0, 1, . . . , k] is read out and decrypted into the plaintext [Di, i=0, 1, . . . , m] using the decryption algorithm with the decryption key. The aforesaid protected zone default address sequence means an ordered sequence of numbers representing the addresses designated by the base computer system for the protected zone of storage devices or media while sequentially access the storage cells within the protected zone. The aforesaid access domain default address sequence means a sequence of addresses originally designated by the base computer system while accessing data within the access domain. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0007]    [0007]FIG. 1 is a block diagram of a preferred embodiment of the present invention.  
         [0008]    [0008]FIG. 2 is a block diagram of another preferred embodiment of the present invention.  
         [0009]    [0009]FIG. 3 is a block diagram of another preferred embodiment of the present invention.  
         [0010]    [0010]FIG. 4 is a protected zone address re-mapping table setup using a sample address re-mapping rule.  
         [0011]    [0011]FIG. 5 is another protected zone address re-mapping table setup using another sample address re-mapping rule.  
         [0012]    [0012]FIG. 6 is a table showing an example of the conversion of plaintext into ciphertext and the conversion of ciphertext to plaintext.  
         [0013]    [0013]FIG. 7 is a graph illustrating conversion between the access domain default address sequence and the access domain re-mapped address sequence using a sample of the protected zone address re-mapping table.  
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0014]    Before the present invention is described in greater details, it should be noted that same reference numerals have been used to denote like elements throughout the disclosure.  
         [0015]    [0015]FIG. 1 is a block diagram of a preferred embodiment of the present invention. As illustrated in FIG. 1, the hardware system  10  of this configuration comprises a computer  11  providing a data encryption/decryption module  20  and an access domain address conversion module  25 , and a peripheral storage equipment  12  having a data storage device  30 . FIG. 2 is a block diagram of another preferred embodiment of the present invention. As illustrated in FIG. 2, the hardware system  10  of this configuration comprises a computer  11  providing a data encryption/decryption module  20 , and a peripheral storage equipment  12 , which contains an access domain address conversion module  25  and a data storage device  30 . FIG. 3 is a block diagram of another preferred embodiment of the present invention. As illustrated in FIG. 3, the hardware system  10  of this configuration comprises a computer  11 , and a peripheral storage equipment  12  which contains a data encryption/decryption module  20 , an access domain address conversion module  25 , and a data storage device  30 .  
         [0016]    The access domain address conversion module  25  provides the functions of:  
         [0017]    (A) setting up an address re-mapping rule  60  according to an address conversion key  95  and a protected zone default address sequence  70 , and using the address re-mapping rule  60  to set up a protected zone address re-mapping table  65 , which can be used for look-up to convert the protected zone default address sequence  70  to the protected zone re-mapped address sequence  75 ; and  
         [0018]    (B) using the protected zone address re-mapping rule  60  or the address re-mapping table  65  to convert the system designated access domain default address sequence  80  to the access domain re-mapped address sequence  85 .  
         [0019]    The data encryption/decryption module  20  provides the functions of:  
         [0020]    (A) encrypting plaintext  50  into ciphertext  55  using an encryption algorithm  40  with an encryption key  90 ; and  
         [0021]    (B) decrypting ciphertext  55  into plaintext  50  using a decryption algorithm  45  with a decryption key  92 .  
         [0022]    According to the preferred embodiments, when storing data to the protected zone of the storage device or media, the data encryption/decryption module  20  encrypt plaintext  50  into ciphertext  55 , then the access domain address conversion module  25  calculate the access domain re-mapped address sequence  85  corresponding to the system designated access domain default address sequence  80 , and then save ciphertext  55  to the storage cells corresponding to the access domain re-mapped address sequence  85 . On the contrary, when reading data, the access domain address conversion module  25  calculate the access domain re-mapped address sequence  85  corresponding to the system designated access domain default address sequence  80 , then read ciphertext  55  from the storage cells corresponding to the access domain re-mapped address sequence  85 , and then the data encryption/decryption module  20  decrypt ciphertext  55  into plaintext  50 .  
         [0023]    For the preferred embodiments illustrated in FIG. 1, 2, and  3 , the operations performed are outlined hereinafter:  
         [0024]    The access domain address conversion module  25  sets up an address re-mapping rule  60  with an address conversion key  95  and a protected zone default address sequence 70 [Pi, i=0, 1, . . . , n], and then the address re-mapping rule  60  is used to set up a protected zone address re-mapping table  65 , which converts protected zone default address sequence  70  [Pi, i=0, 1, . . . , n] into protected zone re-mapped address sequence  75  [Si, i=0, 1, . . . , n]. The address re-mapping rule  60  is a defined one-to-one and onto function mapping from domain [Pi, i=0, 1, . . . , n] to range [Si, i=0, 1, . . . , n] with the address conversion key  95  and the protected zone default address serial  70  [Pi, i=0, 1, . . . , n] as parameters. Next, we use some examples to illustrate it:  
         [0025]    (A) Define the address re-mapping rule  60  as a function of the range of the protected zone address:  
         [0026]    For the example shown in FIG. 4, the protected zone default address sequence  70  is [0, 1, . . . , 1000], that is, the addresses of storage cells in the protected zone are in the range of 0 and 1000, then define the address re-mapping rule  60  as:  
           f ( x )=1000− x    
         [0027]     therefore the address re-mapping rule  60  converts the protected zone default address sequence  70  [0, 1, . . . , 1000] into protected zone re-mapped address sequence  75  [1000, 999, . . . , 0].  
         [0028]    (B) Define the address re-mapping rule  60  as a function of the address conversion key and the range of the protected zone address:  
         [0029]    For the example shown in FIG. 5, suppose that the protected zone default address sequence 70 is [0, 1, . . . , 499] and the address conversion key  95  is “a1K9”, which corresponds to ASCII code 97-49-75-57. First, use code  128  to pad the code sequence, forming a new character code sequence 97-49-75-57-128-128-128-128 . . . , then define the address conversion rule  60  as:  
         f        (   x   )       =                  96   -   x         if         0   ≦   x   &lt;   97               145   -   x   +   97         if         97   ≦   x   &lt;   146               220   -   x   +   146         if         146   ≦   x   &lt;   221               277   -   x   +   221         if         221   ≦   x   &lt;   278               405   -   x   +   278         if         278   ≦   x   &lt;   406               499   -   x   +   406         if         406   ≦   x   &lt;   500                                 
 
         [0030]    therefore, the address re-mapping rule 60 converts the protected zone default address sequence  70  [0, 1, . . . , 96, 145, . . . , 220, . . . , 227, . . . , 499] into the protected zone re-mapped address sequence  75  [96, 95, . . . , 0, . . . , 97, 146, . . . , 221, . . . , 406].  
         [0031]    The procedure of storing data to the protected zone of the storage device or media is described as follows:  
         [0032]    (A) The encryption/decryption module  20  use an encryption algorithm  40  to encrypt plaintext  50  [Di, i=0, 1, . . . , m] into ciphertext  55  [Ri, i=0, 1, . . . , k] with the encryption key  90 , where the total length of plaintext  50  is greater than or equal to that of ciphertext  55 . This is to encode data to be saved into random gibberish to prevent others from reading out the data correctly by analyzing the data context. The following example is used to illustrate this operation:  
         [0033]    Assume the encryption key  90  is “SSun”, which corresponds to ASCII code 0x53-0x53-0x75-0x6E. Define the symmetrical encryption/decryption algorithm 40 as:  
                                                           X i  =   X i  {circumflex over ( )} X i − 1     if i ≠ 0               X i   {circumflex over ( )} 0×5353756E   if i = 0                      
 
         [0034]    where i=8, 7, 6, . . . , 0, Xi is a DWORD, and “{circumflex over ( )}” means “Exclusive Or” operation.  
         [0035]    As shown in FIG. 6, using this algorithm with the encryption key  90  “SSun”, plaintext  50  [0x645BCF98, 0x6839274D, 0x4B652188, 0x7890123E] is encrypted into ciphertext  55  [0x3708BAF6, 0x0C62E8D5, 0x235C06C5, 0x5EA5B9CC].  
         [0036]    (B) The access domain address conversion module  25  use the protected zone address re-mapping table  65  or the address conversion rule  60  to convert the access domain default address sequence  80  [Ui, i=0, 1, . . . , x] designated by the base computer system to the access domain re-mapped address sequence 85 [Vi, i=0, 1, . . . , x].  
         [0037]    As illustrated in FIG. 7, the address re-mapping rule  60  and the protected zone address re-mapping table  65  are the same as that shown in FIG. 4, thus the access domain default address sequence  80  [1, 2, 4, 6, 7, 996] is converted to the access domain re-mapped address sequence  85  [999, 998, 996, 994, 993, 4].  
         [0038]    Store the ciphertext  55  [Ri, I=0, 1, . . . , k] to the storage device or media according to the access domain re-mapped address sequence  85  [Vi, i=0, 1, . . . , x]. For the example shown in FIG. 7, ciphertext  55  [Ri, i=0, 1, 2, . . . , k] is stored to the storage cells corresponding to the access domain re-mapped address sequence  85  [999, 998, 996, 994, 993, 4].  
         [0039]    The procedure of reading data from the protected zone of the storage device or media is described as follows:  
         [0040]    (A) The access domain address conversion module  25  use the protected zone address re-mapping table  65  or the address conversion rule  60  to convert the access domain default address sequence  80  [Ui, i=0, 1, . . . , x] designated by the base computer system to the access domain re-mapped address sequence  85  [Vi, i=0, 1, . . . , x].  
         [0041]    As illustrated in FIG. 7, the address re-mapping rule  60  and the protected zone address re-mapping table  65  are the same as that shown in FIG. 4, thus the access domain default address sequence  80  [1, 2, 4, 6, 7, 996] is converted into the access domain re-mapped address sequence  85  [999, 998, 996, 994, 993, 4].  
         [0042]    Read ciphertext  55  [Ri, i=0, 1, 2, . . . , k] from the storage device or media according to the access domain re-mapped address sequence  85  [Vi, i=0, 1, . . . , x]. For the example shown in FIG. 7, ciphertext  55  [Ri, i=0, 1, 2, . . . , k] is read from the storage cells corresponding to the access domain re-mapped address sequence  85  [999, 998, 996, 994, 993, 4].  
         [0043]    The data encryption/decryption module  20  use the decryption algorithm  45  to decrypt ciphertext  55  [Ri, i=0, 1, 2, . . . , k] into plaintext  50  [Di, i=0, 1, 2, . . . , m] with the decryption key  92 . The following example is used to illustrate this operation:  
         [0044]    Assume the decryption key  92  is “SSun”, which corresponds to ASCII code 0x53-0x53-0x75-0x6E. Define the symmetrical decryption algorithm  45  as:  
                                                           X i  =   X i   {circumflex over ( )}0×5353756E   if i = 0               X i   {circumflex over ( )}X i − 1     if ≠ 0                      
 
         [0045]    where i=0, 1, 2, . . . , 8, Xi is a DWORD, and “{circumflex over ( )}” means “Exclusive Or” operation.  
         [0046]    As shown in FIG. 6, using this decryption algorithm and the decryption key  92  “SSun”, ciphertext  55  [0x3708baf6, 0x0c62e8d5, 0x235c06c5, . . . , 0x5ea5b9 cc] is decrypted into plaintext  50  [0x645bcf98, 0x6839274d, 0x4b652188, 0x7890123e].  
         [0047]    It will therefore be seen that the foregoing represents a highly extensible and advantageous approach to the protection of data on storage devices or media. The terms and expressions employed herein are used as terms of description and not of limitation, and there is no intension, in the use of such terms and expressions, of excluding any equivalents of the features shown and described or portions thereof, but it is recognized that various modifications are possible within the scope of the invention claimed.