Patent Publication Number: US-2007118708-A1

Title: Method and apparatus for securing data stored on a removable storage medium of a computer system

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
      This application is a Continuation Application of prior U.S. patent application Ser. No. 10/303,719 filed Nov. 26, 2002, which claims priority under 35 U.S.C. §119 to Korean Application No. P2002/6278 filed on Feb. 4, 2002, whose entire disclosures are hereby incorporated by reference. 
    
    
     BACKGROUND OF THE INVENTION  
      1. Field of the Invention  
      The present invention relates to a method and apparatus for securing data of a computing system.  
      2. Background of the Related Art  
      A computing system, such as a desktop-type personal computer, notebook computer or the like, provide security functions. As an example of such a security function, upon booting of a related art computer system, a password entry window is displayed on a screen to allow a user to enter a password. The entered password is compared with a password previously entered and set by the user. An operating system of the computer system is run only when the two passwords are the same. In this manner, only an authorized user can gain access to the computer system.  
      However, a related art computer system employing such a security function has a disadvantage in that the security function protects only access to the computer system without respect to data stored in the computer system such as on a hard disk as an auxiliary storage unit. Thus, when the hard disk is detached from the related art computer system with the above-described security function and then mounted to a different computer system, data such as important documents etc. stored on the hard disk may be easily exposed to other persons.  
      The above references are incorporated by reference herein where appropriate for appropriate teachings of additional or alternative details, features and/or technical background.  
     SUMMARY OF THE INVENTION  
      An object of the invention is to solve at least the above problems and/or disadvantages and to provide at least the advantages described hereinafter.  
      Another object of the present invention is to provide a method and apparatus that secures data on a removal storage device.  
      Another object of the present invention is to provide a method and apparatus that secures data in a data processing apparatus.  
      Another object of the present invention is to provide a method and apparatus that secures data on a hard disk of a computer.  
      Another object of the present invention to provide a method and apparatus that secures data stored on a detachable storage device of a computer system to prevent unauthorized users of the data or the computer system from interpreting data stored on the detachable storage device.  
      To achieve at least the above objects and other advantages in a whole or in part and in accordance with the purpose of the present invention, as embodied and broadly described herein, there is provided a system that includes a processor that operates application programs, and a removable storage device coupled to the processor and configured to store data accessible to the processor, wherein the removable storage device is provided a second password using the processor, and wherein the removable storage device is not responsive to data access request unless a first password associated with the data access request corresponds to the second password.  
      To further achieve at least the above objects and other advantages in a whole or in part and in accordance with the purpose of the present invention, as embodied and broadly described herein, there is provided a method for securing data stored on a hard disk of a computer system including requesting a user to enter a password when a password for security of the computer system is previously registered, wherein data to be written to the hard disk is converted into a specific format for security when stored on the hard disk of the computer system, determining whether the password entered by the user is the same as the previously registered security password and storing the determined result, reading the data stored on the hard disk in the specific format for security if the user requests it to be read from the hard disk, and processing the read data in different manners according to the determined result.  
      To further achieve at least the above objects and other advantages in a whole or in part and in accordance with the purpose of the present invention, as embodied and broadly described herein, there is provided a method for securing data stored on a hard disk of a portable computer system including converting data requested to be written by a user into a predetermined format for security when the user requests a write operation after booting of the computer system is completed, and storing the security format-converted data on the hard disk of the computer system.  
      To further achieve at least the above objects and other advantages in a whole or in part and in accordance with the purpose of the present invention, as embodied and broadly described herein, there is provided a method that includes enabling a computer system, selectively accessing encoded data stored in a first format in a detachable storage device, and outputting the data converted to a second format when a security code for the detachable storage device is matched.  
      Additional advantages, objects, and features of the invention will be set forth in part in the description which follows and in part will become apparent to those having ordinary skill in the art upon examination of the following or may be learned from practice of the invention. The objects and advantages of the invention may be realized and attained as particularly pointed out in the appended claims. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
      The invention will be described in detail with reference to the following drawings in which like reference numerals refer to like elements wherein:  
       FIG. 1  is a block diagram showing a preferred embodiment of a computer system that secures data stored on a hard disk of the computer system in accordance with the present invention; and  
       FIGS. 2   a  and  2   b  are flow charts illustrating a preferred embodiment of a method for securing data stored on a storage device such as a hard disk of a computer system in accordance with the present invention.  
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS  
       FIG. 1  is a diagram that schematically shows construction of a preferred embodiment of a computer according to the present invention. As shown in  FIG. 1 , a computer system  100  is capable of implementing a method or apparatus that secures data stored on a hard disk of the computer system in accordance with the present invention. As shown in  FIG. 1 , the computer system  100  can include a read only memory (ROM)  10  for storing a basic input/output system (BIOS) program, various application programs and an operating system program. A data input interface  11  is coupled with input devices for input of data, such as by a user using a keyboard, a mouse and the like. A hard disk drive (HDD)  30  is an exemplary auxiliary storage unit for storing data (e.g., documents, etc.) inputted under control of the user, for example, through the use of the input devices by the user. The HDD  30  preferably includes a ROM  31  for storing firmware with a data conversion function, and a nonvolatile random access memory (RAM)  32  for registering and storing a password entered and set by the user. A video adapter  40  can convert various data into video signals to output and display the data on a monitor  200 . A central processing unit (CPU)  20  preferably performs a system control function according to the BIOS program stored in the ROM  10 . The BIOS program stored in the ROM  10  is a sub-program of the operating system for controlling the computer system  100  and peripheral devices and can be composed of a set of basic computer routines with a lowest-level interface for control of devices such as a system clock, a video display, disk drives, a keyboard, etc.  
       FIGS. 2   a  and  2   b  are flow charts illustrating a preferred embodiment of a method for securing the data stored on a storage device such as a hard disk of a computer system in accordance with the present invention. The preferred embodiment of a method for securing data as shown in  FIGS. 2   a  and  2   b  according to the present invention can be implemented and will be described with reference to the system of  FIG. 1 . However, the present invention is not intended to be so limited.  
      First, if the user requests password registration through an input device under the condition that the computer system  100  is powered on, this password registration request may be transferred to the CPU  20  via the data input interface  11 . In response to the password registration request, the CPU  20  runs the BIOS program preferably along with a password registration program, among the application programs stored in the ROM  10 . As the password registration program is run, preferably a password entry window is outputted to the monitor  200  through the video adapter  40 .  
      As a result, the user enters a password in the password entry window using the input device, and the entered user&#39;s password can be stored in the nonvolatile RAM  32  of the HDD  30  under the control of the executing BIOS program. However, the present invention is not intended to be so limited as other procedures can be used to store the password into the RAM  32  or the like.  
      As shown in  FIG. 2   a , after a process starts under the condition that the password entered and set by the user is registered and stored as described above, the computer system  100  is powered on if the user pushes a power button of the system  100  (step S 10 ). The BIOS program in the ROM  10  preferably performs a power-on self-test (POST) operation for booting of the computer system  100 . The POST operation is performed to carry out a series of tests for inspecting and initializing respective states of devices constituting the computer system  100  upon application of power to the system to enable the normal operation of the computer system  100 . Thus the POST operation can perform self-tests after power-on, report state information and error information and the like.  
      If the POST operation is completed, the BIOS program outputs a password entry request such as the password entry window to the monitor  200  through the video adapter  40  to request the user to enter a password (step S 11 ). In the case where a password entered by the user is inputted via the data input interface  11  in response to the password entry request, the CPU  20  receives the entered password and compares it with the password previously registered and stored in the nonvolatile RAM  32  of the HDD  30  to determine whether the two passwords are the same or correspond (step S 12 ).  
      In the case where the two passwords are determined to be the same (e.g., correspond) as a result of the comparison (step S 20 ), the BIOS program can generate a signal or flag indicative of password identity and stores the generated flag in the nonvolatile RAM  32  of the HDD  30  (step S 21 ). However, if the two passwords are determined not to be the same (e.g., correspond) as a result of the comparison (step S 20 ), the BIOS program can generates a signal or flag indicative of password nonidentity and stores the generated flag in the nonvolatile RAM  32  of the HDD  30  (step S 22 ).  
      Under the condition that the generated flag is stored in the nonvolatile RAM  32  of the HDD  30  in the above manner, if the computer system  100  completes power on operations after the computer system  100  performs other task according to request of the user and then is powered off by the user, preferably the flag stored in the nonvolatile RAM  32  of the HDD  30  is automatically converted to the state indicative of password nonidentity such as by the firmware stored in the ROM  31  of the HDD  30 . Thereafter, procedures of the steps S 11 , S 12 , S 20 , S 21 , S 22  are successively executed and can be repeated for each power on of the computer system  100 .  
      On the other hand, if the user requests a data write operation of the HDD  30  via the data input interface  11  under the condition that the flag indicative of the password identity is generated and stored in the nonvolatile RAM  32 , the CPU  20  preferably runs the firmware stored in the ROM  31  of the HDD  30  such that the run firmware converts the format of data requested to be written by the user into a predetermined format (e.g., encrypted for security) and stores the resulting data in a corresponding data storage area of the HDD (steps S 30  and S 31 ). This data conversion can be processed in the unit of sector data by an encryption program of the firmware stored in the ROM  31  of the HDD  30 .  
      If the user requests a data read operation of the HDD  30  via the data input interface  11  under the condition that the data requested to be written by the user is format-converted and stored in the HDD  30  as described above, the CPU  20  runs the firmware stored in the ROM  31  such that the run firmware reads data requested to be read by the user from the HDD  30  (steps S 40  and S 41 ). This read data is preferably data format-converted (e.g., encoded) as described above. Subsequently, the firmware (or BIOS program) checks the flag indicative of the password identity or nonidentity prestored in the RAM  32  to determine whether the two passwords correspond or are the same (step S 42 ).  
      Upon determining from the flag that the two passwords correspond or are the same, the firmware (or BIOS program) performs a data inverse-conversion operation to restore the read data into the original data (e.g., decrypted format), and the CPU  20  outputs the restored data to the monitor  200  through the video adapter  40  (steps S 50  and S 51 ).  
      However, in the case where it is determined from the flag that the two passwords are not the same (step S 50 ), the firmware (or BIOS program or the like) does not perform the data inverse-conversion operation with respect to the read data, so the CPU  20  outputs the read data to the monitor  200  through the video adapter  40  as it is (steps S 50  and S 51 ). In this manner, if the user is an unauthorized person, the format-converted data is outputted to the monitor  200  through the video adapter  40  directly as it remains converted in format (e.g., encrypted), without being inversely converted into the original data. As described above, a security function is carried out to prevent the unauthorized user from interpreting the data stored in the HDD  30 .  
      As described above in  FIG. 1 , preferred embodiments according to the present invention are described using a computer and a hard disk. However, the present invention is not intended to be so limited. For example, preferred embodiments according to the present invention can be used to protect stored data in a detachable storage device or memory and implemented in a portable computer, data processing apparatus, server, PDA or notebook computer.  
      In addition, in the preferred embodiments according to the present invention, the format conversion of data requested to be written may be selectively made according to the user&#39;s discretion and the enhanced security function. Also, data access requests (e.g., read or write) by a user for storage devices in the system could be selectively performed or denied based on a password identity status (e.g., authorized user).  
      Further, in preferred embodiments, the password verification was entered on booting the system. However, such verification (e.g., user) could be performed periodically or even with each data access request (e.g., read or write). The password verification as shown in  FIG. 2   a  determines if the passwords are identical, however, a known correspondence of passwords such as binary conversion of a number can also be used. Similarly, other password entry methods could be implemented such as a single authorization loading or authorizing data access applications, which can be used for accessing stored data into the system. In addition, security or password information can include machine or hardware specific information (e.g., serial number of CPU, etc.). Further, the security or password information can be one of user codes, biometric information, hardware identification numbers, data received via encoded smart cards and registration numbers.  
      As described above, preferred embodiments according to the present invention can provide a method for securing data stored on a hard disk of a computer system, which is capable of reducing or preventing unauthorized access and can provide increased security for the data stored on the hard disk.  
      The foregoing embodiments and advantages are merely exemplary and are not to be construed as limiting the present invention. The present teaching can be readily applied to other types of apparatuses. The description of the present invention is intended to be illustrative, and not to limit the scope of the claims. Many alternatives, modifications, and variations will be apparent to those skilled in the art. In the claims, means-plus-function clauses are intended to cover the structures described herein as performing the recited function and not only structural equivalents but also equivalent structures.