Embodiment
Below in conjunction with accompanying drawing, specific embodiments of the invention are described in detail.
Information safety devices of the present invention can be the hardware encipher equipment of such as USBKey.User can decipher the encrypt file of some corresponding authority grades to carry out browsing, being encrypted operation etc. to specific file with this information safety devices.The authority of user determines how many functions that he can use this information safety devices, may can only use the simple function of information safety devices when authority is lower.
Fig. 1 is the structural representation with an embodiment of the information safety devices of software protection function of the present invention.
As shown in Figure 1, the information safety devices of the present embodiment has storage unit, authentication ' unit and NFC communication unit, wherein, has prestored the first key corresponding to predetermined right grade in storage unit.
Authentication ' unit according to this first key stored in storage unit, can carry out certification to the operation that user will carry out.If the operation that user carries out meets the Permission Levels of himself, then can pass through certification smoothly.
If the Permission Levels required by operation that user will carry out are higher than the predetermined right grade of himself, then NFC communication unit can receive from specific NFC device the second key corresponding to this higher-rights grade under the instruction of user, so that certification is carried out in the operation of this higher-rights grade of requirement that authentication ' unit will be able to be carried out according to this second double secret key user.
Optionally, when the predetermined right grade of the Permission Levels required by the operation that user will carry out higher than himself, NFC communication unit can also to the request of above-mentioned specific NFC device sending permission under the instruction of user.This specific NFC device side (can be this NFC device subsequently, also can be the managerial personnel using this NFC device) after receiving authority request, in key management system, the Permission Levels of first key of user are distributed in adjustment, make the first key through adjustment have the Permission Levels corresponding with the operation that user will carry out.After authority adjustment process, the information safety devices of user namely can according to this first key through adjustment Permission Levels, certification is carried out to the operation of the above-mentioned higher-rights grade of requirement that user will carry out, carries out to allow user the operation that this requires higher-rights grade.
By information safety devices of the present invention; can realize information safety devices to the defencive function of software while; transmitted by the data of card-scanning type, realize managerial personnel quickly and easily and use user of service the management of the operating right of information safety devices to control.
Such as, in one embodiment of the invention, when the user of this information safety devices will browse encrypt file, certification is carried out in the operation that then authentication ' unit can browse this encrypt file according to the first double secret key user, be specially authentication ' unit the first key to be decrypted this encrypt file, if the Permission Levels of Permission Levels and user required by the encrypt file that user will browse self conform to, then authentication ' unit can be deciphered smoothly to this encrypt file, thus user can browse this encrypt file; And if Permission Levels required by this encrypt file are higher than the Permission Levels of user self, then authentication ' unit cannot decipher this encrypt file with the first key, thus user cannot browse this encrypt file.
When the browser document that user will carry out operation required by the Permission Levels of Permission Levels higher than user self time, user can propose the application browsing the encrypt file of higher level of security to the managerial personnel having super-ordinate right, when managerial personnel agree to authorize, the NFC communication unit of user's log-on message safety equipment, these managerial personnel also start oneself NFC device, by NFC communication between the two, the second key corresponding to higher-rights grade is transferred to the information safety devices of user from the NFC device of managerial personnel.
After obtaining the second key, user can carry out the operation of the encrypt file browsing above-mentioned requirements super-ordinate right again.Authentication ' unit can be browsed this operation requiring the encrypt file of super-ordinate right according to the second double secret key user and carry out certification, be specially authentication ' unit the second key and be decrypted this encrypt file, thus user can browse this encrypt file.
Optionally, when the Permission Levels of the Permission Levels required by the encrypt file that user will browse higher than user self, user can also utilize the NFC communication unit in information safety devices to the above-mentioned specific NFC device sending permission request of managerial personnel, can comprise the first key stored in the storage unit of information safety devices in authority request.After this specific NFC device receives authority request, by this specific NFC device or use the managerial personnel of this specific NFC device to adjust the Permission Levels of the first key distributing to user in key management system, the first key through adjustment is made to have the Permission Levels corresponding with the encrypt file that user will browse.Afterwards, authentication ' unit in the information safety devices of user namely can according to this first key through adjustment Permission Levels, certification is carried out in operation user being browsed to the encrypt file of above-mentioned requirements higher-rights grade, be specially authentication ' unit the first key to be decrypted this encrypt file, thus user can browse this encrypt file.
In another embodiment of the present invention, when the user of this information safety devices will use the specific function of information safety devices, authentication ' unit can use the operation of information safety devices specific function to carry out certification according to the first double secret key user, is specially this specific function whether Permission Levels (namely the Permission Levels of user self) that authentication ' unit confirms that the first double secret key is answered allow to use information safety devices.If the Permission Levels of the Permission Levels required by this specific function and user that user will use self conform to, then authentication ' unit makes this specific function open to user, thus user can use this specific function of information safety devices; And if Permission Levels required by this specific function are higher than the Permission Levels of user self, then authentication ' unit locks this specific function, thus user cannot use this specific function of information safety devices.
When the Permission Levels of the Permission Levels required by the operation that user uses information safety devices specific function higher than user self, user can propose to the managerial personnel having super-ordinate right to use this to have the application of the specific function that higher Permission Levels require, when managerial personnel agree to authorize, the NFC communication unit of user's log-on message safety equipment, these managerial personnel also start oneself NFC device, by NFC communication between the two, the second key corresponding to higher-rights grade is transferred to the information safety devices of user from the NFC device of managerial personnel.
After obtaining the second key, user can attempt the specific function of the above-mentioned requirements super-ordinate right of log-on message safety equipment again.Authentication ' unit can start this operation requiring the specific function of super-ordinate right according to the second double secret key user and carry out certification, be specially this specific function that authentication ' unit confirms the Permission Levels permission use information safety devices that the second double secret key is answered, therefore authentication ' unit makes this specific function open to user, thus user can use this specific function of information safety devices.
In one embodiment of the invention, the portable mobile communication apparatus that this NFC device of managerial personnel can be rfid card, NFC bracelet or mobile phone and so on have NFC function, so that realize the authorization control of card-scanning type.
In another embodiment, supvr is transferred to the second key of the information safety devices of user by NFC device can be the temporary key with certain effective time limit.This temporary key can be stored in the storage unit of information safety devices.This effective time limit can be such as 1 hour, 3 hours or 1 day etc.When user browses the specific function of the high-level authority of requirement of high-level encrypt file or log-on message safety equipment after acquisition second key at every turn, authentication ' unit can carry out certification according to the operation of the second double secret key user, if the second key is also within effective time limit, then user is allowed to browse the specific function of this encrypt file or log-on message safety equipment; If authentication ' unit confirms that the second key lost efficacy, person is not then prohibitted the use to browse the specific function of this encrypt file or log-on message safety equipment.By the present embodiment, managerial personnel can carry out elastic management to the operating right of user, and eliminate user and operate at every turn and all need to seek that managerial personnel authorize is loaded down with trivial details.
In addition, information safety devices is when realizing software protection function, if main frame is PC, information safety devices can be connected with main-machine communication by USB interface, and instruction or the data of Receiving Host process, and complete software protection function; If main frame is the portable handheld terminal equipment with NFC module, information safety devices can start the Passive Mode of NFC communication unit, completes software protection process between hand-held terminal device and information safety devices by NFC communication.
Fig. 2 is the process flow diagram of an embodiment of the authentication method that the information safety devices by having software protection function of the present invention performs.
As shown in Figure 2, the authentication method of the present embodiment comprises: utilize the first key corresponding to predetermined right grade be stored in information safety devices, carry out certification by information safety devices to the operation that user will carry out.If the operation that user carries out meets the Permission Levels of himself, then can pass through certification smoothly.If the Permission Levels required by operation that user will carry out are higher than the predetermined right grade of himself, then under the instruction of user, correspond to this higher-rights grade the second key can be received or to this specific NFC device sending permission request by being arranged in information safety devices NFC communication unit from specific NFC device, so as can to utilize this second key or through these specific NFC device side adjustment Permission Levels the first key, carry out certification by the operation of information safety devices to this higher-rights grade of requirement that user will carry out.
Such as, in one embodiment of the invention, when the user of information safety devices will browse encrypt file, user browses this encrypt file by information safety devices based on the first double secret key user stored and is decrypted, if the Permission Levels of Permission Levels and user required by the encrypt file that user will browse self conform to, then can decipher smoothly this encrypt file, thus user can browse this encrypt file; And if the Permission Levels required by this encrypt file are higher than the Permission Levels of user self, then cannot decipher this encrypt file with the first key, thus user cannot browse this encrypt file.
When the browser document that user will carry out operation required by the Permission Levels of Permission Levels higher than user self time, user can propose the application browsing the encrypt file of higher level of security to the managerial personnel having super-ordinate right, when managerial personnel agree to authorize, by the NFC communication between the NFC communication unit of information safety devices and the NFC device of managerial personnel, the second key corresponding to higher-rights grade is transferred to the information safety devices of user from the NFC device of managerial personnel.
After obtaining the second key, user utilizes the encrypt file of the second key to above-mentioned requirements super-ordinate right to be decrypted by information safety devices, thus user can browse this encrypt file.
Optionally, when the Permission Levels of the Permission Levels required by the encrypt file that user will browse higher than user self, user can also utilize the NFC communication unit in information safety devices to the above-mentioned specific NFC device sending permission request of managerial personnel, can comprise the first key stored in the information safety devices of user in authority request.After this specific NFC device receives authority request, or can use the managerial personnel of this specific NFC device in key management system, adjust the Permission Levels of the first key distributing to user by this specific NFC device, make the first key through adjustment have the Permission Levels corresponding with the encrypt file that user will browse.Afterwards, user is namely according to the first key of this process adjustment Permission Levels, be decrypted this encrypt file by information safety devices, thus user can browse this encrypt file.In another embodiment of the present invention, when the user of this information safety devices will use the specific function of information safety devices, if information safety devices confirms this specific function of Permission Levels (namely the Permission Levels of user self) the permission use information safety devices that the first double secret key is answered, then make this specific function open to user; And if the Permission Levels required by this specific function are higher than the Permission Levels of user self, then lock this specific function, thus user cannot use this specific function of information safety devices.
At this moment, user can propose to the managerial personnel having super-ordinate right to use this to have the application of the specific function that higher Permission Levels require, when managerial personnel agree to authorize, by the NFC communication between the NFC communication unit of information safety devices and the NFC device of managerial personnel, the second key corresponding to higher-rights grade is transferred to the information safety devices of user from the NFC device of managerial personnel.
After obtaining the second key, information safety devices confirms this specific function of the Permission Levels permission use information safety devices that the second double secret key is answered, therefore make this specific function open to user, thus user can use this specific function of information safety devices.
In one embodiment of the invention, the portable mobile communication apparatus that this NFC device of managerial personnel can be rfid card, NFC bracelet or mobile phone and so on have NFC function, so that realize the authorization control of card-scanning type.
In another embodiment, managerial personnel are transferred to the second key of the information safety devices of user by NFC device can be the temporary key with certain effective time limit.This temporary key can be stored in the storage unit of information safety devices.This effective time limit can be such as 1 hour, 3 hours or 1 day etc.When user browses the specific function of the high-level authority of requirement of high-level encrypt file or log-on message safety equipment after acquisition second key at every turn, information safety devices can carry out certification according to the operation of the second double secret key user, if the second key is also within effective time limit, then user is allowed to browse the specific function of this encrypt file or log-on message safety equipment; If the second key lost efficacy, person was not then prohibitted the use to browse the specific function of this encrypt file or log-on message safety equipment.By the present embodiment, managerial personnel can carry out elastic management to the operating right of user, and eliminate user and operate at every turn and all need to seek that managerial personnel authorize is loaded down with trivial details.
In addition, information safety devices is when realizing software protection function, if main frame is PC, information safety devices can be connected with main-machine communication by USB interface, and instruction or the data of Receiving Host process, and complete software protection function; If main frame is the portable handheld terminal equipment with NFC module, information safety devices can start the Passive Mode of NFC communication unit, completes software protection process between hand-held terminal device and information safety devices by NFC communication.
The foregoing is only preferred embodiment of the present invention, be not intended to limit protection scope of the present invention.Within the spirit and principles in the present invention all, any amendment done, equivalent replacement and improvement etc., all should be included within protection scope of the present invention.