Storage device and method for protecting data stored therein

• US 20070079138A1
• Filed: 01/17/2006
• Published: 04/05/2007
• Est. Priority Date: 01/19/2005
• Status: Active Grant

• Current Assignee: Egis Technology Inc.
• Original Assignee: Lightuning Tech Incorporated
• Inventors: Chou, Bruce
• Granted Patent: US 7,461,266 B2
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 12/1433 for a module or a part of a module
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints

Abstract

A storage device and a method for protecting data stored therein. The storage device includes a host interface connected to a terminal host, a control module connected to the interface, and a biometrics sensor and a memory module both connected to the control module. The control module makes the host automatically run a suitable driver and a suitable application program. The host receives an instruction from a user through the driver and program and informs the control module to control the sensor to read and process to-be-recognized biometrics data of the user and extract to-be-recognized minutiae data. The host sends the to-be-recognized minutiae data back to the control module through the interface. The control module compares the to-be-recognized minutiae data with template minutiae data stored in the memory module, and enables a private block of the memory module to be accessed by the host according to a matching result.

Claims

1. A storage device to be connected to a terminal host, the storage device comprising:

a host interface to be connected to the terminal host;

a control module, which is connected to the host interface and comprises a microprocessor, a random access memory (RAM) and a read only memory (ROM), the RAM serving as a working memory for data processing, the ROM storing firmware to make the storage device work and a program code for minutiae data matching;

a biometrics sensor, which is connected to the control module, for sensing to-be-recognized biometrics data of a user; and

a memory module, which is connected to the control module and divided into;

a public block;

a private block for storing to-be-protected data; and

a hidden block for storing template minutiae data, wherein;

the control module communicates with the terminal host by handshakes through the host interface and enables the terminal host to automatically run one application program stored in the public block;

the microprocessor of the control module loads the template minutiae data;

the terminal host receives an instruction of the user through the application program to inform the control module to control the biometrics sensor to read the to-be-recognized biometrics data of the user and transfer the to-be-recognized biometrics data to the terminal host; and

the terminal host processes the to-be-recognized biometrics data using the application program to generate to-be-recognized minutiae data, and transfers the to-be-recognized minutiae data back to the microprocessor, the microprocessor judges whether or not the template minutiae data substantially match with the to-be-recognized minutiae data using the program code, and enables the private block to be accessed by the terminal host when the template minutiae data substantially match with the to-be-recognized minutiae data, or disables the private block from being accessed by the terminal host when the template minutiae data do not match with the to-be-recognized minutiae data.

2. The storage device according to claim 1, wherein the control module further comprises a hardware encrypting/decrypting device for encrypting/decrypting data inputted to or outputted from the memory module.

3. The storage device according to claim 2, wherein the hidden block further stores an encrypting/decrypting key, such that the hardware encrypting/decrypting device encrypts/decrypts the to-be-protected data accessed from the private block according to the encrypting/decrypting key.

4. The storage device according to claim 1, wherein the biometrics sensor is an area-type fingerprint sensor for sensing a fingerprint of a finger stationarily placed on the area-type fingerprint sensor, or a sweep-type fingerprint sensor for sensing a plurality of overlapped fingerprint fragment images of the finger sweeping across the sweep-type fingerprint sensor.

5. The storage device according to claim 1, further comprising:

an expansion slot electrically connected to the control module and to be electrically connected to an external memory such that a memory capacity of the storage device is increased.

6. The storage device according to claim 5, wherein the control module further comprises an encrypting/decrypting device for encrypting/decrypting data inputted to or outputted from the external memory.

7. The storage device according to claim 5, wherein the control module formats the external memory into a single expansion private block for stored additional to-be-protected data after the external memory is inserted into the expansion slot.

8. A method of protecting data stored in a storage device, which comprises:

a host interface to be connected to a terminal host;

a control module, which is connected to the host interface and comprises a microprocessor, a random access memory (RAM) serving as a working memory for data processing, and a read only memory (ROM) storing firmware to make the storage device work and a program code for minutiae data matching;

a biometrics sensor, which is connected to the control module, for sensing template biometrics data of an authorized user; and

a memory module, which is connected to the control module and divided into a public block, a private block for storing to-be-protected data and a hidden block, the method comprises, after the storage device is electrically connected to the terminal host, the steps of;

enabling the control module to communicate with the terminal host through the host interface, and enabling the terminal host to automatically run one application program stored in the public block; and

entering an enrolling mode or an authentication mode, wherein;

in the enrolling mode;

the terminal host informs the control module to control the biometrics sensor to read the template biometrics data of the authorized user and transfer the template biometrics data to the terminal host; and

the terminal host processes the template biometrics data, generates template minutiae data using the application program, and transmits the template minutiae data to the hidden block for storage; and

in the authentication mode;

the microprocessor of the control module loads the template minutiae data;

the terminal host informs the control module to control the biometrics sensor to read to-be-recognized biometrics data of a user and transfer the to-be-recognized biometrics data to the terminal host;

the terminal host processes the to-be-recognized biometrics data, generates to-be-recognized minutiae data and transfers the to-be-recognized minutiae data back to the microprocessor using the application program; and

the microprocessor judges whether or not the template minutiae data substantially match with the to-be-recognized minutiae data using the program code, and enables the private block to be accessed by the terminal host when the template minutiae data substantially match with the to-be-recognized minutiae data, or disables the private block from being accessed by the terminal host when the template minutiae data do not match with the to-be-recognized minutiae data.

9. The method according to claim 8, wherein the control module further comprises a hardware encrypting/decrypting device for encrypting/decrypting data inputted to or outputted from the memory module.

10. The method according to claim 9, wherein the hidden block further stores an encrypting/decrypting key, such that the hardware encrypting/decrypting device encrypts/decrypts the to-be-protected data accessed from the private block according to the encrypting/decrypting key.

11. The method according to claim 8, wherein the storage device further comprises an expansion slot electrically connected to the control module and to be electrically connected to an external memory so as to increase a memory capacity of the storage device, and the method further comprises the step of:

enabling the control module to format the external memory into a single expansion private block for storing additional to-be-protected data after the external memory is inserted into the expansion slot.

12. The method according to claim 11, wherein the control module further comprises an encrypting/decrypting device for encrypting/decrypting data inputted to or outputted from the external memory.