JP4838735B2 - Removable memory unit - Google Patents

Description

  The present invention relates to a removable memory unit that stores an OS (operating system) of a computer device and fingerprint authentication means, and in particular, a removable memory without reading the OS stored in the removable memory unit into the computer device after fingerprint authentication. The present invention relates to a removable memory unit that can be started on the unit.

  A computer device currently used by many users installs a processor chip, an OS startup program, and an OS (operating system / calculation / control program) on a hard disk built in the computer device, and the OS is started by the OS startup program. When activated, the processor chip is configured to control various resources in the computer device according to the OS and perform arithmetic operations.

  The hard disk device is divided into an area managed and used by the OS and an area used by the user, and application programs necessary for the user to use the computer device are installed in the user used area of the hard disk device under the management of the OS. , Operating under the control of the OS. In addition, data created by the user operating the computer device (starting a desired application) can also be stored in the user use area of the hard disk device.

  In addition, when a computer device is placed in a network environment, it accesses resources such as various servers and shared file devices in the network according to the network environment conditions set for the network and the user's computer device. Data permitted in the computer device can be acquired or the data can be rewritten.

  Further, when the computer apparatus is placed in a network environment where an external network can be accessed from the LAN (local area network) via the Internet, various resources such as an external WEB server that can be accessed via the Internet network. Can also be used.

  Such a computer device is also used for creating and storing highly confidential information in a company or the like. Therefore, the computer device is used by a third party who is not allowed to steal or originally use the computer device. There is a risk that confidential information may be leaked. In order to prevent such a situation, security measures for the computer apparatus and the network are required.

  Various methods have been proposed as security measures for computer devices, and many methods have been applied in practice. Generally, a personal authentication function is installed in the OS startup program, the password set by the original user is input when the OS is started, and the OS is started by checking the set password. In this method, if the password is stolen or the password is taught to another person, the original security function cannot be achieved, and it cannot be said that it is an advanced security measure.

  As a security measure for a computer device, for example, the following Patent Document 1 (Japanese Patent Laid-Open No. 2002-341957) discloses a computer startup method using a removable unit such as a flash memory. In this computer startup method disclosed in Patent Document 1, a removable unit that is detachable from a computer main body includes a general data recording unit and a user code recording unit made of a flash memory, and can be used as an MP3 player. The BIOS-ROM includes a unit code recording unit, an interface unit to which the removable unit is connected, and a control unit that allows the system to be activated when the user code matches the unit code.

  When the computer user starts the computer, the removable unit is connected to the computer main body. The user code is sent from the removable unit to the computer via the interface, and the controller of the computer compares the contents of the user code with the contents of the unit code. If they match, the system is allowed to start. If they do not match, system startup is not permitted. By doing so, it is possible to start up the computer only when the correct removable unit is connected by simply connecting the removable unit to the computer body without using a password.

  According to this method, as long as the removable unit is properly managed by the user, an operation such as password entry is unnecessary and convenient, but the removable unit is stolen or lent to a third party. If this happens, you will not be able to perform the security function, which is not much different from using a password.

  To solve this problem, if a server room with security is provided and a system in which the client does not have a hard disk is built, access via the network is relatively easy even though the hard disk can be taken out or stolen. Easily possible.

  Recently, since the storage capacity of the removable unit has increased dramatically, it has become common to use a removable unit such as a USB memory stick. For example, the following Patent Document 2 (Japanese Patent Laid-Open No. 2005-166049) discloses a memory storage device including a fingerprint sensor.

  A memory storage device having a fingerprint sensor disclosed in Patent Document 2 includes a host interface connected to a host, a controller connected to the host interface, a fingerprint sensor connected to the controller, and a memory module. Communicates by handshake, downloads the drive program and application program suitable for the host from the memory module to the host, the host receives the user's command through these two programs, notifies the controller to control the fingerprint sensor Read the user's recognition standby fingerprint data, process the recognition standby fingerprint data using an application program, compare it with the template fingerprint data stored in the memory module, and see if they match. And compare, in which the host is configured to allow access to a particular block of memory modules by the comparison result.

Japanese Patent Laying-Open No. 2002-341957 (FIG. 3) Japanese Patent Laying-Open No. 2005-166049 (FIGS. 1 and 4)

  Recently, since the storage capacity of the removable unit has increased dramatically, the OS startup program and the OS itself are not installed in the computer device, and the computer device has a display means, an input means such as a keyboard, and a removable device such as a USB port. It is possible to provide only the unit connection means so that it does not function as a computer device in a state where the removable unit is not connected. That is, the OS is stored in the removable unit and a fingerprint sensor is provided. When biometric authentication cannot be performed normally, the OS activation program is not activated to enhance the security function. When biometric authentication is normally performed, the OS is started on the removable memory unit.

  FIG. 6 is a block diagram showing such a removable unit and a computer apparatus, and the USB memory unit 100 is used as the removable unit. The computer device 200 includes a display unit 210 such as a liquid crystal display unit, an input unit 220 such as a keyboard and a mouse, and a USB port 230 for connecting the USB memory unit 100. Although not shown, the computer device 200 is equipped with a microprocessor chip that controls the display unit 210, the input unit 220, and the USB port 230.

  On the other hand, the USB memory unit 100 includes a USB controller 110, an input / output unit 120, a processing module 130 having an OS activation program 131, an OS 132, and a memory 133. In addition, a fingerprint sensor 180 including a touch panel and authentication verification data 190 which is fingerprint data for authentication are included.

  The authentication verification data stores fingerprint data registered by an authorized user of the USB memory unit 100. When the user uses the computer device 200, the USB memory unit 100 is connected to the USB port 230 of the computer device 200. Connect to and let the fingerprint sensor read the fingerprint. The USB controller 110 collates the fingerprint data read by the fingerprint sensor 180 with the authentication collation data 190, and permits the operation of the OS boot program 131 if they match.

  When the OS activation program 131 is activated to activate the OS 132, information can be transmitted and received between the display unit 210 and the input unit 220 of the computer device 200 via the input / output unit 120 and the USB port 230, and the USB memory The processing module 130 of the unit 100 operates as a part of the computer device 200.

  With such a configuration, an OS and a hard disk are not required in the computer apparatus body, and no data remains in the computer apparatus body, so that information leakage can be completely shut out. This USB memory unit (also referred to as a memory stick type client device) is combined with a biometric authentication system such as a fingerprint authentication device, and can have a higher level of individual security.

  Generally, information called MBR (Master Boot Record) is used to start the OS of a computer apparatus. This MBR is recorded at the head address of the storage device, and is usually information of about 512 bytes. The MBR is stored in a storage area that is read first in order to start up the OS after the computer apparatus is turned on and a BIOS (Basic Input Output System) is started up. Screen information etc. are recorded.

  When the computer apparatus is powered on, a BIOS (Basic Input Output System) is activated, and the MBR recorded in the first 512 bytes of the storage device is read by the BIOS. Since the MBR stores the address of the storage area of the OS main body and the initial display screen information, the BIOS can display the initial screen on the display means and start the OS main body.

  On the other hand, a removable memory unit is generally recognized as a hard disk drive by a computer device. A hard disk drive is usually recognized by a computer device as a structure having a plurality of storage areas partitioned by partitions. Therefore, as shown in FIG. 6, when the fingerprint authentication and OS are stored in the removable memory unit and the OS is operated on the removable memory unit, the MBR is recorded at the head of the data storage area of the removable memory unit, It is necessary to record the storage location where the OS main body is stored in the MBR. That is, it is necessary to record in which partition the storage location of the OS main body is stored.

  By the way, when the fingerprint authentication unit is constructed in a removable memory unit that is recognized as a hard disk drive, the storage area of the removable memory unit is divided into a plurality of partitions divided by a plurality of partitions before the fingerprint authentication is established, as shown in FIG. 7A. It is recognized as a structure having storage areas sd1 to sd4. After the fingerprint authentication is established, as shown in FIG. 7B, the storage area of the removable memory unit is not recognized as a structure divided by a plurality of partitions, and the entire storage area sda is one storage area of the disk drive. Designed to be recognized as.

  Note that sda represents the disk drive a, and when there are a plurality of physical drives, each disk drive is represented as sdb... Sdn. Note that sda indicates that the hard disk drive conforms to the SCSI standard, and when the hard disk drive conforms to the DE standard, it is represented as hda... Hdn. Similarly, when the disk drive is based on the CD standard, it is represented by sr. In addition, the number of partitions by partition can be divided into a maximum of nine partitions of the basic partition 4 and the logical partition 5 in the SCSI standard. The same applies to the DE standard.

  Which hard disk drive standard the computer device employs depends on the manufacturer and model. Since the removable memory unit is connected to various computer devices, it should not depend on the model and has drive information applicable to any of the SCSI standard, DE standard, CD standard, and the like.

  As described above, when storing the OS in the removable memory unit and operating the OS on the removable memory unit, it is recorded in which partition the storage location of the OS main body is stored. After the fingerprint authentication is established, the storage area of the removable memory unit is recognized as a structure having one storage area without a partition. For this reason, since the storage area divided by the partition cannot be recognized, the storage location of the OS main body stored in the MBR cannot be specified, and the OS cannot be started.

  Therefore, the OS start program including a search script for searching the storage location of the OS main body at the storage location specified by the relative address with respect to the MBR storage location (the start address of the memory) is not directly stored in the MBR. It is also considered that the OS main body is specified by sequentially searching each storage area divided by partition.

  FIG. 8 is a diagram showing the configuration of this OS boot program. The OS boot program includes a search script for searching the storage location of the OS main body, and is configured to sequentially search each storage area divided by the partition and specify the OS main body by executing the search script. Has been. This OS boot program can be read and executed by storing it in a position indicated by a relative address with respect to the storage address of the MBR, and specifying the relative address position in the MBR.

  As shown in FIG. 8, the search script included in the OS boot program is a script that sequentially searches the partitions sda1 to sda9 of the disk drive sda, ... a script that sequentially searches the partitions sdd1 to sdd9 of the disk drive sdd, and a disk drive hda Scripts that search the partitions hda1 to hsda9 in order, ... scripts that search the partitions hdd1 to hdd9 in the disk drive hdd in order A search script is provided to meet the disk drive standards. Thereby, the stored partition of the OS body can be searched and the OS body can be started.

  However, when a fingerprint authentication unit is mounted on a removable memory unit and combined with fingerprint authentication, the disk drive is recognized as one storage area that is not partitioned by authentication as described above. In the script that sequentially searches a plurality of sections divided by (1), there is a problem that the storage location of the OS main body cannot be specified.

  As a result of various studies to solve the above problems, the inventor of the present application sequentially searches each storage area partitioned by partition into an OS startup program including a search script for searching the storage location of the OS main body. In addition to the search script for searching the storage location of the OS main body, the OS stored in the storage area of the removable memory unit after the fingerprint authentication is established by providing a search script for searching the OS main body as one storage area that is not divided by partition. The present invention has been completed by conceiving that the storage position of the main body can be searched.

  That is, the present invention aims to solve the above problems, and is a removable memory unit that stores an OS (Operating System) of a computer device and fingerprint authentication means, and is stored in the removable memory unit after fingerprint authentication. It is an object of the present invention to provide a removable memory unit that can be started on a removable memory unit without reading an OS into a computer device.

In order to solve the above-mentioned problem, the invention according to claim 1 of the present application is
In a removable memory unit connected to a computer device having a port for connecting a display means, an input means and a removable memory unit,
The removable memory unit is installed with an authentication verification data storing fingerprint data for authenticating an authorized owner of the removable memory unit, a fingerprint authentication unit including a fingerprint sensor, a master boot record, an OS boot program, and an OS main body. And a processed processing module,
The OS boot program sequentially searches each storage area partitioned by partition and searches the storage location of the OS main body, and the storage area of the removable memory unit is set as one storage area not partitioned by partition. Including a search script for searching the OS body;
A removable memory unit, wherein when authentication in the fingerprint authentication unit is established, an OS boot program is read by the master boot record, the OS main body is searched, and the OS main body is started on the removable memory unit.

  The invention according to claim 2 of the present application is the removable memory unit according to claim 1, wherein the removable memory unit further includes RFID reading means, and the authentication verification data includes an authorized owner of the removable memory unit. It is characterized in that fingerprint data for authentication is read from a stored RFID tag.

In the invention according to claim 1, the removable memory unit includes: authentication verification data storing fingerprint data for authenticating a proper owner of the removable memory unit; a fingerprint authentication unit including a fingerprint sensor; a master boot record; An OS startup program and a processing module in which the OS body is installed,
The OS boot program sequentially searches each storage area partitioned by partition and searches the storage location of the OS main body, and the storage area of the removable memory unit is set as one storage area not partitioned by partition. When a search script for searching the OS body is included and authentication in the fingerprint authentication unit is established, the OS boot program is read by the master boot record, the OS body is searched, and the OS body is started on the removable memory unit. To do.

  According to such a configuration, even if the USB memory unit, which is a removable memory unit, is recognized as a disk drive having one storage area that is not partitioned by a partition after authentication is established by the fingerprint authentication unit, By executing a search script (for example, search scripts sda, sdb... Sdd of FIG. 3) for searching the OS main body as a storage area, the storage location of the OS main body can be specified. Will be able to start.

  In the invention according to claim 2, in the removable memory unit according to claim 1, the removable memory unit further includes RFID reading means, and the authentication verification data authenticates a proper owner of the removable memory unit. Read from the RFID tag storing the fingerprint data.

  According to such a configuration, the reference data for authentication is separated from the outside of the USB memory unit and stored in advance in the chip of the RFID tag 40. Even if the test is performed under the forced external force, if there is no RFID tag, the authentication function is not passed and the security function can be improved.

  Hereinafter, specific examples of the present invention will be described in detail with reference to examples and drawings. However, the embodiment shown below exemplifies a removable memory unit for embodying the technical idea of the present invention, and is not intended to specify the present invention as this removable memory unit. The present invention is equally applicable to the removable memory units of other embodiments within the scope of the claims.

  FIG. 1 is a diagram illustrating a configuration of a removable memory unit and a computer apparatus according to the first embodiment of the present invention. In the first embodiment, the removable memory unit includes a USB memory unit 10, and the computer device 20 includes a USB port 23 for connecting the USB memory unit 10.

  Similar to FIG. 6, in addition to the USB port 23 that is a connection port of the removable memory unit, the computer device 20 includes a display means 21, an input means 22, and a control means such as a microprocessor (not shown) for controlling these, a power supply Although it has a unit, it does not have an OS startup program or a hard disk device in which an OS is installed unlike a normal computer device. Therefore, the computer device 20 alone cannot be operated as a computer device.

  The USB memory unit 10 includes a USB controller 11 and an input / output unit 12 in the same manner as a general USB memory unit, and includes a fingerprint sensor 18 and authentication verification data 19 for authenticating the owner of the USB memory unit 10. It has a fingerprint authentication unit. The authentication verification data 19 stores fingerprint data (verification fingerprint data) of the authorized owner of the USB memory unit 10. The fingerprint data read by the fingerprint sensor 18 is collated with the authentication collation data, and when both match, the use of the USB memory unit 10 is permitted. If they do not match, the use of the USB memory unit 10 is not permitted, and the data stored in the USB memory unit 10 cannot be read / written or used.

  In the USB memory unit 10, a portion corresponding to a hard disk device of a normal computer device is provided as a processing module 13. That is, MBR 30, OS boot program 31, and OS 32 are installed in processing module 13, and a storage area corresponding to the user area of the hard disk device used by the user is prepared as memory area 33. In recent years, the storage capacity of a USB memory unit has been dramatically improved, and a USB memory unit having a storage capacity sufficient to configure the processing module 13 has been realized.

  FIG. 2 is a conceptual diagram showing the configuration of the processing module 13 of the USB memory unit 10. An MBR 30 (master boot record) is stored in an area of 512 bytes from the start address of the processing module 13. The OS boot program 31 stores a minimum program for booting the OS main body, and includes a search script for searching a stored area of the OS main body. In addition, the OS startup program stores a program that is minimally required to start the OS main body 32, such as a program for displaying an OS desktop screen.

  The start address of the storage location of the OS boot program is stored in the MBR, but is stored as a relative address with respect to the storage location of the MBR. Accordingly, the MBR is read out, and the OS boot program 31 stored with the relative address position stored therein as the head can be read out and executed. Since the OS startup program 31 stores a search script for searching an area in which the OS main body 32 is stored, the OS main program 32 can be read and the OS can be started by executing this search script.

  Since the processing module 13 (configured in the memory area of the USB memory unit 10) can be read when authentication is established by the fingerprint authentication unit, the fingerprint of the authorized owner of the USB memory unit 10 is the fingerprint. Only when read from the sensor 18 is the processing module 13 operable. Here, before fingerprint authentication is established by the fingerprint authentication unit, as described above, the storage area of the USB memory unit 10 is recognized as having a storage area divided into a plurality of partitions. As described above, it is recognized as having one storage area that is not partitioned by partition.

  Therefore, the search script of the OS startup program is configured as a normal search script, that is, a script for sequentially searching the memory area divided by a plurality of partitions, and the memory area is defined as one memory area not divided by the partition. It has a search script to search.

  FIG. 3 is a conceptual diagram showing a configuration of a search script included in the OS startup program 31. As shown in FIG. The search script according to the present invention includes a disk drive sda in addition to a script for sequentially searching the partitions sda1 to sda9 of the disk drive sda shown in FIG. 8, a script for sequentially searching the partitions sdd1 to sdd9 of the disk drive sdd, and the like. Search scripts sda, sdb... Sdd for recognizing .about.sdd as one storage area and searching the storage location of the OS main body 32 are provided.

  Similar to the search script of FIG. 8, the search script is prepared so that it can be adapted to all disk drive standards so as not to depend on the model of the computer device to which the removable memory unit is connected.

  Therefore, even if the USB memory unit 10 is recognized as a disk drive having one storage area that is not divided by partitions after authentication is established by the fingerprint authentication unit, the OS is executed by executing the search scripts sda, sdb. The storage location of the main body 32 can be specified, and the OS can be started.

  FIG. 4 is a flowchart illustrating the procedure for starting the OS in the removable memory unit according to the first embodiment of the invention. First, in step S101, the computer apparatus 20 is turned on. In step S102, the USB memory unit 10 is connected to the USB port 23 of the computer device 20.

  Next, the user of the USB memory unit 10 uses the fingerprint sensor 18 to read the fingerprint. The fingerprint data read by the fingerprint sensor 18 is collated with the fingerprint data registered in the authentication collation data 19, and fingerprint authentication is performed. The result of the authentication verification is determined in the determination process of step S104. If the authentication is not established, the process proceeds to step S109, and an error warning is displayed on the display unit 21 of the computer device 20, and the process ends.

  When authentication is established in the determination process of step S104, the MBR 30 (master boot record) stored in the first 512 bytes of the memory unit of the USB memory unit 10 is read in the process of step S105. Next, the OS startup program 31 is read based on the MBR 30 in the process of step S106. Since the storage location of the OS boot program 31 is specified by a relative address with respect to the MBR 30, and this relative address is stored in the MBR 30, the OS boot program 31 can be read by reading and executing the MBR 30.

  The OS boot program 31 stores a minimum program for booting the OS main body 32, and includes a search script (see FIG. 3) for searching the storage position of the OS main body 32. In step S107, the search script is sequentially executed to search the storage location of the OS main body 32. When the storage location of the OS main body 32 is known, the OS desktop display screen is displayed on the display unit 21 of the computer 20 in step S108. To start the OS main body 32.

  In the first embodiment, the authentication collation data 19 stores the fingerprint data of the authorized owner of the USB memory unit 10, but the present invention is not limited to such a configuration. For example, the USB memory unit 10 may be provided with an RFID reader / writer that is a non-contact IC tag, and fingerprint data may be stored in an RFID tag that has been authenticated for personal identification. Then, at the time of collation with the fingerprint data read from the fingerprint sensor 18, the fingerprint data stored in the RFID tag is read using an RFID reader / writer to perform authentication collation.

  FIG. 5 is a diagram showing the configuration of the USB memory unit 10 according to the second embodiment of the present invention configured as described above. 5 differs from the first embodiment (see FIG. 1) in that the USB memory unit 10 is provided with an RFID reading unit 15 and an authentication verification unit 16, and the authentication verification data 19 of the first example is stored in the RFID tag 40. Is a point. The configuration of the processing module 13 is the same as that of the first embodiment. In FIG. 5, the same components as those in FIG. 1 are denoted by the same reference numerals.

  That is, the USB memory unit 10 according to the second embodiment stores the authentication data 19 in the RFID tag 40 for individual authentication (personal authentication) of the authorized owner of the USB memory unit 10 as shown in FIG. The authentication data is read by the reading unit 15 and the authentication data and the fingerprint data read by the fingerprint sensor 18 are collated by the authentication collating unit 16 for authentication.

  In this way, if the reference data for authentication is separated outside the USB memory unit 10 and stored in advance in the chip of the RFID tag 40, the biometric authentication action is forced by a third party against the will of the individual. Even if it is performed under the above, if there is no RFID tag 40, the authentication function is not passed and the security function can be improved. Further, for example, in the case of fingerprint data, it is possible to construct a high security level that is not easily broken by performing actions such as periodically changing the finger or changing the combination of fingers.

  As described above in detail, according to the present invention, a removable memory unit that stores an OS (operating system) of a computer device and fingerprint authentication means, and the OS stored in the removable memory unit after fingerprint authentication is stored in the computer. It is possible to provide a removable memory unit that can be activated on the removable memory unit without being read into the apparatus.

It is a block diagram which shows the structure of the removable memory unit concerning Example 1 of this invention. It is a figure which shows the structure of the processing module memorize | stored in the memory of a removable memory unit. It is a schematic diagram which shows the structure of the search script contained in OS starting program of a processing module. It is a flowchart which shows the procedure of OS starting in the removable memory unit concerning Example 1 of this invention. It is a block diagram which shows the structure of the removable memory unit concerning Example 2 of this invention. It is a block diagram which shows the concept of the removable memory unit which was provided with the fingerprint authentication unit and memorize | stored OS starting program and OS main body. It is a conceptual diagram for demonstrating the storage area structure of the removable memory unit provided with the fingerprint authentication unit. FIG. 7A shows a state before the establishment of authentication, and FIG. 7B shows a state after the establishment of authentication. It is a conceptual diagram which shows the search script and OS search procedure in OS starting program.

Explanation of symbols

10. USB memory unit 11. USB controller 12. Input / output unit 13. Processing module 31 ... OS startup program 32 ... OS main body 33 ... Memory 18 ... Fingerprint sensor 19 ... Authentication verification data 40 ... RFID tag 15 ... RFID reading means 16 ... Authentication verification means

Claims (2)

In a removable memory unit connected to a computer device having a port for connecting a display means, an input means and a removable memory unit,
The removable memory unit is installed with an authentication verification data storing fingerprint data for authenticating an authorized owner of the removable memory unit, a fingerprint authentication unit including a fingerprint sensor, a master boot record, an OS boot program, and an OS main body. And a processed processing module,
The OS boot program sequentially searches each storage area partitioned by partition and searches the storage location of the OS main body, and the storage area of the removable memory unit is set as one storage area not partitioned by partition. Including a search script for searching the OS body;
A removable memory unit, wherein when authentication in the fingerprint authentication unit is established, an OS boot program is read by the master boot record, the OS main body is searched, and the OS main body is started on the removable memory unit.   The removable memory unit further comprises RFID reading means, and the authentication verification data is read from an RFID tag storing fingerprint data for authenticating a proper owner of the removable memory unit. Removable memory unit as described.

Images