Patent Publication Number: US-10789342-B2

Title: Storage device with biometric module

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This non-provisional application claims priority under 35 U.S.C. § 119(a) on Patent Application No(s). 201710812375.1 filed in China on Sep. 11, 2017, the entire contents of which are hereby incorporated by reference. 
     TECHNICAL FIELD 
     This disclosure relates to a storage device, particularly to the storage device with a biometric module. 
     RELATED ART 
     Flash memory is commonly used in storage devices such as flash drives and memory cards. These storage devices allow users to exchange data between computers and digital products. Generally, the external connecting interface of flash drives adopts the USB (Universal Serial Bus). From the perspective of stability, without the mechanical reading/writing component, the flash drive avoids the damage of the storage data due to crash or falling. From the perspective of portability, the flash drive is lightweight with small size, so it is easy to carry. In addition, the flash drive supports hot plugging by the USB interface, so a user does not need to install an additional driver when using the flash drive, therefore increasing the convenience of using the flash drive. 
     With the promotion of users&#39; awareness of information security, it should pay more attention on the protection of private data. As a storage medium with great convenience, the flash drive with an encryption program installed is an early-stage protection strategy, and the user needs to enter the correct password for accessing the private data. However, the user may forget the password or the password itself may also be leaked. Under the consideration of the above situations, using the fingerprint as a unique biometric identifier was proposed to replace the password-protecting strategy. Some laptops have already adopted the fingerprint identification module for the operating system login. However, for a typical desktop computer, the user needs to insert a third-party dongle if he/she wants to experience the convenience of using his/her fingerprint to log in the operating system. This kind of dongle usually has only one single function, but it still occupies one USB port. 
     From the perspective of the producer who integrates the fingerprint identification component and flash memory, in the common architecture design, the fingerprint identification module is highly dependent upon the control module and the main job of the control module is to access the flash memory chip. Once the size or the process of the flash memory chip changes, the firmware running on the control module has to be adjusted accordingly. 
     SUMMARY 
     According to one or more embodiments of this disclosure, a storage device with a biometric module, comprising: a hub module with an external connection port and a plurality of internal connection ports; a first external transmission module electrically connecting to the external connection port, wherein types of transmission interfaces of the first external transmission module and the hub module are identical; a biometric module electrically connecting to one of the plurality of internal connection ports, wherein the biometric module is configured to perform biometric identification and to generate a biometric identification signal; a control module electrically connecting to an unoccupied one of the plurality of internal connection ports, wherein the control module is configured to obtain a permission signal and to generate an access signal accordingly, wherein the permission signal is associated with the biometric identification signal and a biometric comparison information; and a storage module electrically connecting to the control module, wherein the storage module comprises a public area and a private area, the control module sends the access signal directing toward the private area to the storage module when the control module receives the permission signal. 
     According to one or more embodiments of this disclosure, a login method for logging into an operating system by using a storage device with a biometric module, adapted to a computer with the operating system and a specified software installed therein, comprising: connecting to the computer by the storage device; checking whether the storage device connects to the computer by a detecting procedure of the operating system when the operating system shows a login indication, and requiring a biometric identification signal and a biometric comparison information from the storage device by the specified software when the storage device connects to the computer; executing a biometric comparison procedure by the operating system invoked by the specified software; and executing a login procedure when the biometric identification signal and the biometric comparison information are identical, and providing an error message by the operating system when the biometric identification signal and the biometric comparison information are different. 
     According to one or more embodiments of this disclosure, a private data accessing method for a storage device with a biometric module adapted to a computer with an operating system and a specified software installed therein, wherein the storage device comprises a public area and a private area, comprising: connecting to the computer by the storage device and logging in the operating system; performing an access operation to the private area; requiring a biometric identification signal and a biometric comparison information from the storage device by the specified software; executing a biometric comparison procedure by the operating system invoked by the specified software; and when the biometric identification signal and the biometric comparison information are identical, notifying the operating system by the biometric comparison procedure via the specified software for the operating system to send a permission signal to the storage device, and generating an access signal directing toward the private area according to the permission signal sent by a control module of the storage device; and providing an error message by the biometric comparison procedure when the biometric identification signal and the biometric comparison information are different. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present disclosure will become more fully understood from the detailed description given hereinbelow and the accompanying drawings which are given by way of illustration only and thus are not limitative of the present disclosure and wherein: 
         FIG. 1  is a schematic view of a storage device according to an embodiment of the present disclosure; 
         FIG. 2  is a schematic view of the storage device according to another embodiment of the present disclosure; 
         FIG. 3  is a flowchart of a login method for logging in an operating system according to an embodiment of the present disclosure; 
         FIG. 4  is a flowchart of a private data accessing method for accessing a private area according to an embodiment of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION 
     In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the disclosed embodiments. It will be apparent, however, that one or more embodiments may be practiced without these specific details. In other instances, well-known structures and devices are schematically shown in order to simplify the drawings. 
     Please refer to  FIG. 1 , which is a schematic view of a storage device according to an embodiment of the present disclosure. The storage device  1  comprises a hub module  10 , a first external transmission module  20 , a biometric module  30 , a control module  40  and a storage module  50 . 
     The hub module  10  comprises an external connection port  11  and four internal connection ports,  13 ,  15 ,  17  and  19 . The electronic signals from the external connection port  11  can be transmitted to one or some of the internal connection ports  13 - 19  through the hub module  10 , and the electronic signals from the internal connection ports  13 - 19  can be transmitted to the external connection port  11  through the hub module  10 . Practically, a small-sized control chip can be installed inside the hub module  10  to select which of the internal connection ports can be enabled for exchanging the data with the external connection port  11 . In addition, the storage device  1  is connected to a computer for its usage, so the present disclosure comprises a first external transmission module  20  whose one end electronically connects to the external connection port  11  and another end electronically connects to a computer host&#39;s connection port. It should be noticed that the present disclosure does not limit the number of the internal connection ports  13 - 19 . 
     Moreover, all the connection ports  11 - 19  of the hub module  10  follow the same transmission standard such as USB (Universal Serial Bus) in this embodiment, but the present disclosure does not limit the transmission standard. 
     As shown in  FIG. 1 , the biometric module  30  electronically connects to the internal connection port  19  of the hub module  10 , and the biometric module  30  has the same transmission interface as the hub module  10  in this embodiment. Please refer to  FIG. 2 . In another embodiment of the present disclosure, the biometric module  30  and the hub module  10  have different transmission interfaces. For example, the biometric module  30  adopts SPI (Serial Peripheral Interface) and the hub module  10  adopts USB, so the storage device  1  in another embodiment of the present disclosure further comprises an interface-converting module  32  configured to convert the SPI signals into USB signals. The biometric module  30  performs the biometric identification to get a biometric identification signal from a user. So-called biometric identification is based on one or some of the following features: fingerprint, face, voice, iris, vein, retina, signature and DNA. Practically, storage device  1  can adopt at least one biometric module  30  according to the application scenario, and the following embodiments of the present disclosure adopt “fingerprint” as a representative. 
     Please refer to  FIG. 1 . The control module  40  electrically connects to one of the unoccupied internal connection port  13  of the hub module  10 . As shown in  FIG. 1 , the biometric module  30  electronically connects to the internal connection port  19  of the hub module  10 , and the control module  40  electronically connects to the internal connection port  13  of the hub module  10 . Therefore the control module  40  can receive a permission signal from the computer through the hub module  10 , and the control module  49  also can receive the biometric identification signal from the biometric module  30  through the hub module  10 . In practical, for example, the control module  40  is a MCU (Microprocessor Control Unit) or a SoC (System on Chip). The control module  40  transfers the access operations sent from the computer with high-level language into low-level hardware instructions by running a specified firmware on MCU or SoC. 
     Please refer to  FIG. 1 . In an embodiment of the present disclosure, the storage module  50  electronically connects to the control module  40 . In other embodiments, if the storage module  50  has the same transmission interface as the hub module  10 , the storage module  50  can also electronically connect to the hub module  10  and exchange data with the control module  40  through the hub module  10 . Most of the storage module  50  is mainly divided into a public area  52  and a private area  54 . The private area  54  can be further divided into a plurality of exclusive areas corresponding to a plurality of users, so the present disclosure does not limit the number of the private area  54 . In general, after connecting the storage device  1  to the computer, the user can access the data stored in the public area  52  through the operating system running on the computer. Specifically, the control module  40  transfers an access operation sent from the operating system with high-level language into the access signal that can be recognized by the storage module  50 , and said access signal directs toward the public area  52  only. On the other hand, when the operating system sends an access operation to the private area  54 , the control module  40  has to get a permission signal additionally from the computer, and the control module  40  generates an access signal directing toward the private area  54  according to the permission signal. When receiving the permission signal directing to the private area  54 , the storage module  50  inputs or outputs the data stored in the private area  54  according to the commands from the control module  40 . Practically, for example, the storage module  50  is made by NAND flash, V-NAND flash or NOR flash; however, the present disclosure does not limit the hardware structure of the storage module  50 . 
     In this embodiment of the present disclosure, the permission signal is generated in software manner by the operating system. In other embodiments, the permission signal can be generated in hardware manner by the control module  40 . Basically, the permission signal is associated with the biometric identification signal and a biometric comparison information. Taking the fingerprint signal as an example of the biometric identification signal, the biometric module  30  scan the user&#39;s finger to generate a biometric identification signal when performing the biometric identification every time. In addition, when the storage device  1  is used by the user for the first time, the biometric module  30  scans the user&#39;s fingerprint and stores the scanned result into the biometric storage section of the storage module  50  in a form of the biometric comparison information. In other embodiments, the biometric comparison information can be stored in a memory component of the control module  40 , the present disclosure does not limit the location of the biometric comparison information. It should be noticed that the biometric storage section is accessible only to the control module  40  for ensuring the safety of the original fingerprint information. The control module  40  receives the permission signal directing toward the private area  54  when the operating system adopts a software method (such as a feature detection procedure) to ensure that the biometric identification signal and the biometric comparison information are matched (such as both of them have identical feature points). 
     Please refer to  FIG. 1 . In an embodiment of the present disclosure, the storage device  1  further comprises a second external transmission module  22 . The second external transmission module  22  has at least two transmission interfaces, one of which electronically connects to another unoccupied internal connection port  15  of the hub module  10 , and another transmission interface is configured to connect to an external device. The second external transmission module  22  and the hub module  10  have identical type of the transmission interface. The second external transmission module  22  improves the scalability of the storage device  1  of the present disclosure. For example, an extra device with an USB interface can be electronically connected to an USB port outside of the second external transmission module  22  to make the best use of the serial connection feature of USB. 
     Please refer to  FIG. 3 , which shows a flowchart of a login method for logging in an operating system by using the storage device  1  according to an embodiment of the present disclosure, adapted to a computer with the operating system and a specified software installed therein, wherein said operating system is such as Microsoft Windows operating system. Please refer to the step S 31 . Specifically, the storage device  1  connects to the USB port of the computer through the first external transmission module  20 . Please refer to the step S 33 . After the user powers on the computer and then the computer shows a login indication, the operating system automatically performs a detecting procedure to determine whether the storage device  1  connects to the computer or not. If the operating system ensures that the storage device  1  of the present disclosure has connected to the computer, moving forward to the step S 35 ; otherwise, moving backward to the step S 33 , which means that the operating system continues to perform the detecting procedure if any storage device  1  connects to the computer, and after the detecting procedure finished, the user has to enter the account and the password to login the operating system. 
     In the step S 35 , a specified software such as AP Tool installed in the computer asks the storage device  1  to send the biometric identification signal and the biometric comparison information. The biometric identification signal is generated by scanning the user&#39;s finger with a scanning component of the biometric module  30 . The biometric comparison information is obtained from the biometric storage section of the storage module  50  by the control module  40 . It should be noticed that only the AP Tool can ask the control module  40  to get the biometric comparison information from the biometric storage section, and this is for the safety of the fingerprint original information. 
     Please refer to the step S 37  in  FIG. 3 . The specified software invokes the operating system for executing the biometric comparison procedure. Taking the Windows operating system as an example, Microsoft has added a set of services and interfaces called WBF (Windows Biometric Framework) in the Windows operating systems after the Windows Server 2008 R2, wherein the Windows Biometric Service, which is part of the WBF, gives client applications the ability to capture, compare, manipulate, and store biometric data. So-called biometric data are such as the biometric identification signal generated by the biometric module  30  and the biometric comparison information stored in biometric storage section of the storage module  50 . The control module  40  sends the biometric identification signal and the biometric comparison information to the operating system through the hub module  10  and the first external transmission module  20 , and then the AP Tool invokes the biometric comparison procedure in the WBF to determine whether the biometric identification signal is identical to the biometric comparison information. If the comparison passes, (means that the above two data are the same), the biometric comparison procedure notifies the operating system to execute a login procedure, as shown in the step S 38 . If the comparison fails (means that the above two data are different), the biometric comparison procedure notifies the operating system to provide an error message to the user, as shown in the step S 39 , so that the user can decide to use the fingerprint identification to log in again or use the password to log in. 
     Please refer to  FIG. 4 , which shows a flowchart of a private data accessing method for accessing a private area according to an embodiment of the present disclosure, adapted to a computer with an operating system and a specified software installed therein. Please refer to the step S 41 . Specifically, the storage device  1  was connected to the computer with the operating system logged in and the user can perform data accessing operations in the operating system. In general, a GUI (Graphical User Interface) of the operating system can already show all storage sections of the storage device  1  at this time, these storage sections at least comprise a public area  52 , and the storage device  1  allows the operating system to display the private area  54  in a text or image manner for the user to view in this embodiment. If the user tries to access the public area  52 , the control module  40  generates an access signal directing toward the public area  52 , and said access signal is generated according to the reading or writing operation sent from the operating system. 
     Please refer to the step S 43  in  FIG. 4 . If the user tries to access the private area  54 , the AP Tool invokes an API (Application Programmimg Interface) of WBF and asks the storage device  1  to send the biometric identification signal and the biometric comparison information, as shown in the step S 45 . After the control module  40  gets the biometric identification signal generated by the biometric module  30 , the control module  40  sends the biometric identification signal together with the biometric comparison information to the operating system. Please refer to the step S 47 . The AP Tool invokes the operating system to execute the API of the WBF to perform the biometric comparison procedure after getting the biometric identification signal and the biometric comparison information. If the comparison passes, which means the user who tries to access the private area  54  has passed the fingerprint authentication and the operating system sends a permission signal to the control module  40  of the storage device  1 , as shown in the step S 48 , the control module  40  generates an access signal directing toward the private area  54  accordingly, and then sends said access signal to the storage module  50  for the reading/writing operations afterwards. On the other hand, if the comparison fails, the operating system provides an error message as shown in the step S 49 . It should be mentioned that in this embodiment, the specified software, AP Tool, invokes the API of the operating system to implement the function of the fingerprint identification. In other embodiments, the AP Tool further comprises a middleware to directly communicate with the biometric module  30  in low-level hardware language and execute the same comparison procedure as the API previously did to access the private area  54 . 
     In sum, the storage device with the biometric module of the present disclosure treats the biometric module and the control module as independent components connected in parallel, and the storage device collaborates with the specific software installed on the computer, so that the firmware of the control module does not need to be modified when the fingerprint module or the NAND flash chip has changed, thus reducing the developing time of integration and saving the unnecessary resource costs. The storage device of the present disclosure allows the user to log in the computer&#39;s operating system by the fingerprint identification, meanwhile the user can access the confidential data stored in the private area. By breaking the single function restriction from the conventional USB dongle and the fingerprint flash drive, the present of disclosure has improved the practicability and the convenience of the USB drive.