Safe and portable device and system for protecting user data

Abstract

The invention provides a safe and portable device and system for user data protection, and relates to the technical field of data protection, and the device comprises a communication interface module which is connected with a target host for data transmission; the storage module is used for storing data and programs; the security processing module is used for verifying the identity of the user and encrypting or decrypting the data; the main control module is used for controlling the operation of the communication interface module, the storage module and the safety processing module through instructions; connection with a target host is established through the communication interface module, an operation environment on the secure portable device is operated in the target host, and the master control module controls the secure processing module to call a program to verify a user identity, encrypts or decrypts processed data and controls the storage module to store the data. The problems that an existing safe portable device needs additional upper computer software for configuration, data and file copying is needed, and operation is tedious are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of data protection, and in particular to a secure portable device and system for protecting user data. Background Art

[0002] With the development of science and technology and the advancement of informatization, people have an increasing demand for communication and information processing. On the one hand, there are more and more scenarios for mobile office, and on the other hand, people pay more and more attention to the protection of personal data and privacy. Correspondingly, the proportion of portable laptops in personal computers has steadily increased, and personal computer hosts have gradually become smaller, making it easier for users to work on the move. However, the cost of laptops is still relatively expensive, and they often need to be charged. In response to the portability and security needs of user data, various encrypted USB flash drives and secure mobile hard drives have emerged one after another to meet users' needs for data encryption and privacy protection.

[0003] With the development of information technology and the popularity of personal computers, a user often has multiple computers. Computers at work and at home use different operating systems and application software. The data in different computers are usually inconsistent. Data is generally synchronized and copied through a network disk or USB flash drive. In order to solve the problem of data security, it is time-consuming to encrypt network disk data. Encrypted USB flash drives have become a relatively good choice. Various key-encrypted USB flash drives and fingerprint-encrypted USB flash drives have emerged. However, these encrypted USB flash drives generally require the installation of additional host computer software for configuration before use. The encrypted data is only a copy of some files in the work computer. If the user needs to use more data, he needs to copy it again on the work computer, which is time-consuming and labor-intensive. Summary of the invention

[0004] In order to overcome the above technical defects, the purpose of the present invention is to provide a secure portable device and system for user data protection, which solves the problems that existing encrypted USB flash drives require additional host computer software for configuration, require data and file copying, and are cumbersome to operate.

[0005] The present invention discloses a safe portable device for protecting user data, comprising:

[0006] A communication interface module is connected to a target host for data transmission;

[0007] Storage module, used to store user data and files as well as user work environment images;

[0008] The security processing module verifies the user's identity and uses built-in security hardware to encrypt or decrypt data;

[0009] A main control module, which controls the operation of the communication interface module, the storage module and the security processing module through instructions;

[0010] A connection is established with the target host through the communication interface module, and the operating environment on the secure portable device is run on the target host. The main control module controls the security processing module to call a program to verify the user's identity, encrypt or decrypt the processed data, and control the storage module to store the data.

[0011] Preferably, the storage module stores a program of at least one operating environment;

[0012] After the communication interface module is connected to the target host, the main control module receives a user request signal from the target host, runs an operating environment on the target host, verifies the user identity, and processes data in the operating environment.

[0013] Preferably, in the operating environment, the security processing module calls a program to load a user login interface on the target host and verifies the user identity based on user input.

[0014] Preferably, the security processing module includes:

[0015] Key module, which uses built-in security hardware to randomly generate keys and store keys;

[0016] The encryption and decryption processing module obtains the key generated by the key module to perform encryption or decryption processing.

[0017] Preferably, the main control module receives a user operation command from the target host to call a program to set security protection parameters, wherein the security parameters include data type, data location, and program information that generates data.

[0018] Preferably, the secure portable device is configured as a USB flash drive or a removable solid-state hard drive.

[0019] Preferably, the security processing module is arranged on a chip or an integrated circuit card.

[0020] Preferably, the storage module includes at least one fixed data partition and at least one persistent data partition;

[0021] The fixed data partition stores data related to the operating environment, and the persistent data partition stores processed data.

[0022] Preferably, the communication interface module is hardware-connected to a USB port, a SATA port, or a PCIe port provided by the target host to establish communication between the secure portable device and the target host.

[0023] This application also provides a secure portable system for protecting user data.

[0024] Include at least one target host;

[0025] Using any of the above mentioned secure portable devices, connected to the target host through an interface;

[0026] The secure portable device is provided with a unique identifier for device management;

[0027] The secure portable device assigns each user a unique user identity for user management.

[0028] Compared with the prior art, the above technical solution has the following beneficial effects:

[0029] The present application provides a secure portable device and system for user data protection, including a communication interface module, a main control module, a storage module, a key module and an encryption and decryption module. The communication interface module is used to connect to a target host, and an operating environment is run on the target host. When processing data, the key module randomly generates a key and returns the result to the main control module and the encryption and decryption module. The encryption and decryption module is responsible for the encryption and decryption of data and files, and the data is finally stored through the storage module. The operating environment on the secure portable device is directly run on the target host, and data is securely operated and directly stored in this environment. The secure portable device stores all user data and can be used offline even without an Internet connection. There is no need to copy files and transfer them to a network disk or other mobile storage media to find and access data, which solves the problems of existing encrypted USB flash drives requiring additional host computer software for configuration, frequent file copying, and cumbersome operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a module diagram of a first embodiment of a secure portable device and system for protecting user data according to the present invention;

[0031] Figure 2 The present invention is a flowchart of a method for using a secure portable device in Embodiment 1 of a secure portable device and system for protecting user data according to the present invention.

[0032] Reference numerals:

[0033] 1- a secure portable device for protecting user data; 11- a main control module; 12- a communication interface module; 13- a storage module; 14- a security processing module; 141- a key module; 142- an encryption and decryption module. DETAILED DESCRIPTION

[0034] The advantages of the present invention are further described below in conjunction with the accompanying drawings and specific embodiments.

[0035] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0036] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. The singular forms of "a", "said" and "the" used in this disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0037] It should be understood that although the terms first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present disclosure, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0038] In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0039] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0040] In the following description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present invention, and have no specific meanings. Therefore, "module" and "component" can be used interchangeably.

[0041] Embodiment 1: This embodiment discloses a secure portable device for user data protection, which is connected to a computer via a USB interface, has built-in security hardware, provides secure hard isolation and encryption and decryption functions, and can independently configure the user operating environment, such as using multiple operating systems such as Linux, Windows, and MacOS. You can choose to set it to automatically complete the hard encryption protection of files and data, which is both safe and convenient. As an illustration, the secure portable device is set as a mobile storage device such as a USB flash drive or a removable solid-state hard drive, and can be run on a target host such as a personal computer, a laptop computer, etc. anytime and anywhere. For details, see Figure 1 ,include:

[0042] The communication interface module is connected to the target host for data transmission; specifically, the communication interface module in the present application is connected to the USB port, SATA port, and PCIe port provided by the target host to establish hardware connection to establish communication between the secure portable device and the target host, and different existing interface connections can be configured according to actual usage scenarios to achieve high-speed communication between the two. After the communication interface module is connected to the target host, the operating environment (operating system) of the secure portable device can be run on the target host.

[0043] The storage module is used for storing data and programs, storing user data and files as well as user work environment images; in addition, the programs set in the storage module include programs for configuring the operating environment (work environment image), programs that rely on automatic encryption, decryption, storage and other operations of files, and other programs that enable the secure portable device to operate.

[0044] As an optional implementation, the storage module includes at least one fixed data partition and at least one persistent data partition; the fixed data partition stores data related to the operating environment, i.e., the aforementioned program for configuring the operating environment, etc., and the persistent data partition stores processed data, i.e., data that needs to be encrypted and stored when the secure portable device is connected to a computer. When the user uses it normally, the specified data and files will be automatically encrypted and saved in the persistent data partition of the secure portable device.

[0045] The security processing module verifies the user's identity and uses built-in security hardware to encrypt or decrypt data; specifically, the security processing module is arranged on a chip or an integrated circuit card, that is, the secure portable device of the present application has built-in security hardware to realize the functions of the security processing module, thereby performing secure processing of data, that is, the above-mentioned encryption, storage, etc.

[0046] Furthermore, the security processing module includes: a key module, which uses built-in security hardware to randomly generate and store keys; specifically, it can use true random numbers to generate keys; an encryption and decryption processing module, which obtains the keys generated by the key module for encryption or decryption. In the present application, the key module is used to implement hardware storage of the key. The key module is responsible for random number generation and key processing, returns the results to the main control module, and configures the key for the encryption and decryption module. The main control module can call the key interface and encryption and decryption algorithm provided by the security hardware. The specific algorithm uses an existing symmetric algorithm or asymmetric algorithm to automatically encrypt and decrypt data and files. Optionally, it can be set to support single users and multiple users. The keys of each user are different, so the data is independently protected, and each person can have a secret key or each document can have a secret key. Even if the protected user data or files are obtained by other users, they cannot be read or used normally.

[0047] The main control module controls the operation of the communication interface module, storage module and security processing module through instructions; the main control module can coordinate and control the operation of each module, establish a connection with the target host through the communication interface module, run the operating environment on the security portable device on the target host, control the security processing module to call the program to verify the user identity, encrypt or decrypt the processed data, and control the storage module to store the data, that is, specifically, receive the data and commands of the communication interface module, and send commands and data to the external PC through the communication interface module. The received key commands and data are sent to the key module; the received encryption and decryption commands are sent to the encryption and decryption module; the received files and other data are sent to the storage module.

[0048] In a preferred embodiment, the storage module stores a program for at least one operating environment; as mentioned above, in the present application, in the secure portable device, the security software is integrated with multiple user working environments through the program, and supports one or more operating environment (system) selections, such as Debian live, isos, Windows, MacOS, etc. After the communication interface module is connected to the target host, the main control module receives the user request signal of the target host and runs an operating environment on the target host. The user request signal can correspond to the selection of an operating environment, and the user identity is verified and the data is processed under the operating environment.

[0049] In the present application, each secure portable device has a unique ID, which can be used for device management such as device authentication and authorization. The secure portable device can assign a unique ID (user identity) to each user, which can be used for user management such as identity authentication and authorization. Based on this, in a preferred embodiment, under the operating environment, the security processing module calls a program to load a user login interface on the target host, and verifies the user identity based on the user input, and performs identity authentication and permission management based on the user input, so that the protected user data or files cannot be read and used normally even if they are obtained by other users, thereby achieving data security protection.

[0050] In a preferred embodiment, the main control module receives a user operation command from the target host to call a program to set security protection parameters, wherein the security parameters include data type, data location, and program information that generates data. Specifically, as an explanation, the above security protection parameters include data that can be set by the user and need to be encrypted and protected, that is, part of the data can be selected to be encrypted and protected according to the user setting, or all of the data can be selected to be encrypted and protected. As an example, the security software can be run to set it after receiving the user operation command.

[0051] The secure portable device and system for user data protection provided by the present application include a hard isolation area, true random number generation, key management, and encryption and decryption processing. It can integrate multiple operating environments and can be started and run on any personal computer or laptop with a USB interface. Users can use it on computers in different scenarios. The working environment, including the operating system and application software, is unified, realizing a mobile device that is more economical and lighter than carrying a notebook. Compared with ordinary encrypted USB flash drive solutions, no additional host computer software is required to set the encryption password. The secure portable device stores all user data and can be used offline even without an Internet connection. There is no need to copy files and transfer them to a network disk or other mobile storage media to find and access data.

[0052] As an option, the user data protection secure portable device in the present application may also be superimposed with a fingerprint module, which may be controlled by a security processing module to perform user security verification, thereby enhancing the convenience of user use.

[0053] This application uses a program to implement the interface provided by the security hardware through the security software to encrypt and protect the files of the user-specified source, name or type. The security software runs on the operating environment stored in the secure portable device. To further explain the use of the secure portable device of this application, take the Debian live working environment as an example. For specific usage methods, please refer to Figure 2, as follows: First S1: Connect the secure portable device to the USB interface of a PC; S2: Start the PC and start the Debian live system in the secure portable device; If there are multiple operating systems, the PC user will select Debian live to start after receiving the request signal sent by the selection; S3: After the Debian live system starts, the live partition and persistent data partition of the secure portable device are automatically mounted, and the user login page is entered; S4: The user enters the personal user name and login password to enter the work desktop; S5: Run the security software to modify the user data protection settings according to actual needs, including the application name that generates the file to be protected, the file type to be protected, etc. The settings are valid after the modification until the next modification. S6: When the user works normally, the specified data and files will be automatically encrypted and saved in the persistent data partition of the secure portable device. The protected data and files can only be read normally by the user, and other users cannot decrypt and read them because they do not have the correct user key and file key. The encryption key is generated and managed by the built-in security hardware, using true random numbers and security-verified encryption and decryption algorithms, which greatly improves the security of the data. S7: Shutdown, user data and files are saved in the persistent user partition of the secure portable device.

[0054] The secure portable device of the present application includes hardware and software parts, including a communication interface module, a main control module, a storage module, a key module and an encryption and decryption module, as well as a program for data transmission, data encryption, data decryption and data storage with a target host computer and controlled and executed by the main control module. The communication interface module is used to connect to a computer, internally connect to the main control module, run the operating environment, pass communication commands and data to the main control module, receive data and commands from the communication interface module, and send commands and data to an external PC through the communication interface module. For the received key commands and data, they are sent to the key module and the encryption and decryption module. The key module randomly generates a key and returns the result to the main control module and the encryption and decryption module. The encryption and decryption module is responsible for the encryption and decryption of data and files, and the final data is stored through the storage module. The operating environment on the secure portable device is directly run on the target host, and data is operated in this environment, such as encryption or decryption, and directly stored, without the need to set up additional host computer software, and the search and access of data does not require copying and transferring to a network disk or other mobile storage media.

[0055] Embodiment 2: The present application also provides a secure portable system for user data protection, including at least one target host; the secure portable device described in the above embodiment 1 is applied to connect to the target host through an interface, and other existing connectable devices can also be applied, including but not limited to image processing devices, etc. to achieve applications in more scenarios. In addition, the system can include multiple target hosts (such as laptops, desktop computers, etc.), and can also include multiple secure portable devices. Each secure portable device can be connected to one or more target hosts. After the user logs in and passes the verification, it enters the operating environment, in which the operating system and application software are unified, and files of user-specified sources, names or types can be encrypted and protected without the need for additional host computer software to set encryption passwords.

[0056] Furthermore, it may also include a target host, which is connected to any secure portable device, and the secure portable device is provided with a unique identifier for device management (including but not limited to device management such as device authentication and authorization); the secure portable device assigns a unique user identity for each user for user management (including but not limited to user management such as identity authentication and authorization), that is, multiple users can log in to the secure portable device, and each user corresponds to a unique ID (user identity / account) and a password. Each user login corresponds to the storage of the user's data and their own keys. Although the stored data of multiple users are stored in the same secure portable device, because the key is bound to the user ID (user identity), each user can only read and write his own data and files, and cannot normally open the data and files of other users.

[0057] It should be noted that the embodiments of the present invention have better practicability and do not impose any form of limitation on the present invention. Any technician familiar with the field may use the technical content disclosed above to change or modify it into an equivalent effective embodiment. However, any modification or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A secure portable device for protecting user data, characterized in that: include: A communication interface module is connected to a target host for data transmission; Storage module, used to store user data and files as well as user work environment images; The security processing module verifies the user's identity and uses built-in security hardware to encrypt or decrypt data; A main control module, which controls the operation of the communication interface module, the storage module and the security processing module through instructions; A connection is established with the target host through the communication interface module, and the operating environment on the secure portable device is run on the target host. The main control module controls the security processing module to call a program to verify the user's identity, encrypt or decrypt the processed data, and control the storage module to store the data.

2. The safety portable device according to claim 1, characterized in that: The storage module stores at least one program of an operating environment; After the communication interface module is connected to the target host, the main control module receives a user request signal from the target host, runs an operating environment on the target host, verifies the user identity, and processes data under the operating environment.

3. The safety portable device according to claim 1, characterized in that: In the operating environment, the security processing module calls a program to load a user login interface on the target host and verifies the user identity based on the user input.

4. The safety portable device according to claim 1, characterized in that: The security processing module comprises: Key module, which uses built-in security hardware to randomly generate keys and store keys; The encryption and decryption processing module obtains the key generated by the key module to perform encryption or decryption processing.

5. The safety portable device according to claim 1, characterized in that: The main control module receives a user operation command from the target host to call a program to set security protection parameters, wherein the security parameters include data type, data location, and program information that generates data.

6. The safety portable device according to claim 1, characterized in that: The secure portable device is configured as a USB flash drive or a removable solid-state hard drive.

7. The secure portable device according to claim 1, characterized in that: The security processing module is arranged on a chip or an integrated circuit card.

8. The safety portable device according to claim 1, characterized in that: The storage module includes at least one fixed data partition and at least one persistent data partition; The fixed data partition stores operating system related data, and the persistent data partition stores processed data.

9. The secure portable device according to claim 1, characterized in that: The communication interface module is connected to the USB port, SATA port, and PCIe port provided by the target host through hardware to establish communication between the secure portable device and the target host.

10. A secure portable system for protecting user data, characterized in that: Include at least one target host; Using the secure portable device described in any one of claims 1 to 9, connected to the target host through an interface; The secure portable device is provided with a unique identifier for device management; The secure portable device assigns each user a unique user identity for user management.

Images