KR100676087B1 - Secured data storage device and method with a USB interface - Google Patents

Abstract

An apparatus and method for storing secure data are disclosed. According to the invention, a data storage method comprises the steps of: (a) receiving data via a USB interface; And (b) storing the received data in a secure area accessible only through authentication or in a general area accessible without authentication. This allows more secure storage of public certificates, personal account numbers or credit card data, important ID and password data, and other data requiring user authentication. Can be done.

Description

Secure data storage apparatus with USB interface, and method

1 is a block diagram of a flash storage device having a USB interface;

2 is a diagram illustrating a configuration of a secure data storage device and a storage path of data according to a preferred embodiment of the present invention;

3 is a detailed configuration diagram of the secure data storage device of FIG. 2;

4 is a flowchart of a data storage method according to a preferred embodiment of the present invention;

5 is a flowchart of a data reading method according to a preferred embodiment of the present invention.

The present invention relates to data security technology, and more particularly, to an apparatus and a method for securely storing data.

With the development of data storage technology, various types of portable storage devices are used. Among these portable storage devices, a flash memory with a USB (Universal Serial Bus) interface has a large storage capacity, is easy to carry and connects to a PC, and is widely used in various fields such as storing document data, music, photos, and video files. It is used. However, such USB flash memory is very weak in security. Recently, some USB flash memories have a function such as requiring a password to access a specific area of the USB flash memory. However, data stored in the USB flash memory can be stored by means of physical hacking by a hacker, dumping or copying the memory, and the like. Accessibility is not a fundamental troubleshooting tool.

On the other hand, as an operating system (OS), there is an IC card equipped with a chip operating system (COS), a central processing unit (CPU), a security module, and a memory. IC cards employ encryption technology to securely process a variety of transactions, and encrypt and store data, which is widely used in fields such as electronic wallets, electronic accounts, and personal authentication. But while IC cards are highly secure, their storage capacity is not as great as that of flash memory. In addition, in order to store data on the IC card or read the stored data, a reader capable of reading the IC card is required, but the IC card reader is not as widely used as a USB interface, and thus it is inconvenient to use.

Accordingly, an object of the present invention is to provide a secure data storage device and a storage method capable of safely storing data by combining a USB flash memory and an IC card.

Another technical problem to be achieved by the present invention is to provide a secure data storage device having an electronic wallet, electronic money and a transportation card function by combining a USB flash memory and an IC card, and further comprising an RF transceiver.

The technical problem according to the invention, (a) receiving the data via the USB interface; And (b) storing the received data in a secure area accessible only through authentication or in a general area accessible without authentication.

The step (b) may include: (b1) encrypting the received data; And (b2) storing the encrypted data in a secure area accessible only through authentication or in a general area accessible without authentication.

In addition, the technical problem (a) receiving information about the data to be read; (b) determining whether the selected data is stored in a secure area accessible only through authentication or in a general area accessible without authentication; And (c) reading data from a secure area or a general area according to the determination result.

The reading method may further include (d) decrypting the read data if the read data is encrypted data.

On the other hand, according to another field of the present invention, the technical problem is a USB connector for receiving data through the USB interface; A controller which determines a storage area of the received data according to information on which area to store the received data in, and delivers the received data; A flash memory accessible for storing the received data without an authentication process; And a security chip accessible through an authentication process for storing the received data.

The data storage device preferably further includes an RF transceiver for carrying data stored in the security chip in an RF signal and receiving data from an external RF device through an RF signal.

In addition, the security chip is a security chip control unit for controlling the transfer of the received data; An encryption processing unit for encrypting the received data according to a predetermined encryption algorithm; And a secure data storage unit for storing the received data as it is or storing data encrypted by the encryption processing unit.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a flash storage device having a USB interface.

The flash storage device having a USB interface includes a USB connector 110, a controller 120, and a flash memory 130. The USB connector 110 provides a physical interface for exchanging data with the host. That is, it connects to the bus defined by USB, transfers data to and receives data from the host. The controller 120 converts the file system shown to the user to correspond to the physical address and the command of the flash memory 130 so that the flash memory 130 stores data. When data stored in the flash memory 130 is accessed, the physical address of the flash memory is converted into a logical file system and displayed in a form that can be recognized by a user. The flash memory 130 is a nonvolatile memory, and stored data is not deleted even when power is not supplied.

2 is a diagram illustrating a configuration of a secure data storage device and a storage path of data according to a preferred embodiment of the present invention.

The secure data storage device includes a USB connector 210, a controller 220, a flash memory 230, and a security chip 240, and preferably further includes an RF transceiver 250. The USB connector 210 provides a physical interface for exchanging data with a host. That is, it connects to the bus defined by USB, transfers data to and receives data from the host. At this time, according to the data storage method according to the present invention, the data received from the host via the USB connector 210 via the control unit 220, the memory stored in the flash memory 230 or included in the security chip 240 You can also save to. The security chip 240 may store the received data without performing encryption on the received data or encrypt the received data. Alternatively, according to an encryption algorithm embedded in the security chip 240, the received data may be encrypted and stored in the flash memory 230.

When the transmission path of the data is displayed, general data storage is performed along the storage path 1 260, and storage to the security chip 240 is performed along the storage path 2 270. Performing encryption and storing to flash memory 230 is done along storage path 3 280. A detailed operation description will be described later.

The controller 220 transmits the data received from the USB connector 210 to the flash memory 230 or the security chip 240, and receives the data encrypted by the security chip 240 back to the flash memory 230. To pass. To this end, the controller 220 converts the file system shown to the user to correspond to the physical address and the command of the flash memory 230 so that the flash memory 230 stores data. Even when data stored in the flash memory 230 is accessed, the physical address is converted into a logical file system and displayed in a form that a user can recognize.

The RF transceiver 250 exchanges data with other devices through RF communication. For example, in order to perform a traffic card or electronic money function in a non-contact manner, the traffic card or electronic money related data recorded in the security chip 240 is transmitted through an RF reader. In this case, the security chip 240 operates by receiving power from the RF transceiver 250.

Storing data from the host will now be described in detail according to the transmission path of the data. Storing data according to storage path 1 260 is performed in the same manner as storing data in a general USB flash memory. This process is as described above with reference to FIG.

Storing data according to storage path 2 270 may include requesting authentication to security chip 240 when an application program that performs data storage is executed on a host, and user authentication on security chip 240 succeeds. The application program of the host transmits the data to be stored. The security chip 240 stores the received data as it is, or encrypts it. Meanwhile, since the encryption process takes a long time, only a part of the received data may be encrypted and stored. Some data may be for example a 4 byte header of received data.

A process of storing data according to storage path 3 280 is as follows. When the application program to perform data storage is executed in the host, the authentication request to the security chip 240, if the user authentication in the security chip 240 is successful, the application program of the host transmits the data to be stored. The security chip 240 encrypts the received data and transmits the encrypted data to the flash memory 230 via the controller 220. In this case, it is also possible to encrypt and store only a part of the received data. Meanwhile, without encrypting the data in the security chip 240, the data may be encrypted and transmitted in advance according to an encryption program built in the host, and the received encrypted data may be stored in the flash memory 230. The encryption program may be included in the application.

In the above-described example, the example of encrypting and decrypting data is described in more detail. The encryption may be performed by a secret key of the security chip, and the decryption may be performed by a public key of the host. Encryption algorithms that may be used include both the Data Encryption Standard (DES) and the Rivest-Shamir-Adleman (RSA) algorithm, as well as the general encryption algorithm.

3 is a detailed configuration diagram of the secure data storage device of FIG. 2.

The USB connector 210 is connected to a USB port of a host, for example, a PC, to perform data communication. The USB controller 220 is connected to the USB connector 210 to analyze information received from the USB connector 210 to generate a memory selection signal, an address, and a control signal for accessing the flash memory 230. In addition, when data is stored in the secure data storage unit 330 of the security chip 240, data communication with the security chip control unit 310 is performed. The flash memory 230 stores general data that does not require encryption, or stores secure data encrypted by the encryption processing unit 320 of the security chip 240.

In more detail, the security chip 240 includes a security chip controller 310, an encryption processing unit 320, a security data storage unit 330, and an RF interface unit 340. The security chip controller 310 controls to store data received from the USB controller 220 in the security data storage unit 330 without an encryption process according to a user's security data storage command, or encrypts an encryption signal 320. Pass it to encrypt the data. In addition, the data stored in the secure data storage unit 330 to be transmitted to the RF transceiver 250 through the RF interface unit 340.

The encryption processing unit 320 encrypts the received data according to a predetermined encryption algorithm, or decrypts and outputs the encrypted data. The secure data storage unit 330 receives and stores the unencrypted data through the USB controller 220 and the security chip controller 310, or stores the data encrypted by the encryption processor 320 in the secure chip controller 310. Receive and save through. An example of data stored in the secure data storage unit 330 may include a public certificate, account information, and credit card information. The RF interface unit 340 transmits the data stored in the secure data storage unit 330 through the RF transceiver 250 in accordance with a command from an external RF reader for functions such as a traffic card or an electronic wallet.

4 is a flowchart of a data storage method according to a preferred embodiment of the present invention.

When the application program of the host is executed, a user interface is provided, and through this, the user receives data to be stored, information on whether to encrypt and store it, and information on whether or not to store the encrypted data (S410). If it is determined whether or not to store the data encrypted (S420), if the data to be stored is received as an important data to encrypt and receive a command to be stored to perform a security algorithm to encrypt the data to be stored (S430) . If no encryption is to be performed, the encryption process is omitted. Next, it is determined whether the encrypted data or the general data is stored in the secure area (S440), and according to the result, the data is stored in the secure area (S450) or stored in the general area (S460). The security area becomes the memory inside the security chip, and the general area becomes the flash memory.

5 is a flowchart of a data reading method according to a preferred embodiment of the present invention.

When the application program is executed, the data to be read is selected through the user interface accordingly (S510). For example, the information may be information such as a file name to be read. And. Check the storage area where the read data is stored (S520). If the data to be read is stored in the security area, authentication is performed (S530). If the authentication is successful, the data stored in the security area is read (S540). . On the other hand, if the data to be read is data stored in the general area, the data is read from the general area (S550). It is determined whether the data stored in the read security area or the general area is encrypted data (S560), and if it is encrypted data, decryption is performed (S570). On the other hand, in performing the authentication in step S530, if the authentication fails more than a certain number of times, for example three or more times, it can be locked so that no more data can be read.

On the other hand, the above-described security data storage method can be created by a computer program. Codes and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the program is stored in a computer readable media, and read and executed by a computer to implement a secure data storage method. The information storage medium includes a magnetic recording medium, an optical recording medium, and a carrier wave medium.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

As described above, according to the present invention, it is possible to more securely store the authentication certificate, individual account number or credit card data, important ID and password data, and other data for requesting user authentication. It can also function as a transportation card.

Claims (10)

delete delete delete delete delete A USB connector for receiving data via a USB interface; A controller which determines a storage area of the received data according to information on which area to store the received data in, and delivers the received data; A flash memory accessible for storing the received data without an authentication process; And And a security chip accessible through an authentication process for storing the received data. The method of claim 6, And transmitting and receiving data stored in the security chip in an RF signal, and receiving and receiving data from an external RF device through an RF signal. The method according to claim 6 or 7, The security chip encrypts the received data and stores it in a memory included in the security chip, or encrypts the received data and transmits the data to the flash memory. The method of claim 6 or 7, wherein the security chip A security chip controller for controlling the transfer of the received data; An encryption processing unit for encrypting the received data according to a predetermined encryption algorithm; And And a secure data storage unit for storing the received data as it is or storing data encrypted by the encryption processing unit. delete

Images