KR101070766B1 - Usb composite apparatus with memory function and hardware security module - Google Patents

Abstract

The present invention relates to a USB composite device having a memory function and a security token function, wherein a USB memory interface method and a USB security token interface method are defined in an interface descriptor of a descriptor information function included in a USB interface function block. Endpoint 0 for sending a descriptor to the descriptor, two endpoints for reading and writing data to the USB memory, two endpoints for reading and writing data to the USB security token, and two USB secure tokens are normally connected to the host. An endpoint, an interrupt that transmits an interrupt signal, is defined.UFI commands sent from the host to the USB memory section are transferred to the NAND flash file system block of the USB memory section so that data read / write of the USB memory section is processed. A delivered to USB Security Token The processing result of the PDU command and APDU command is exchanged between the USB security token unit and the host by a 2-wire communication method between two input / output pins of the GPIO block of the USB memory unit and two input / output pins of the GPIO block of the USB security token unit. It includes a function selection unit that allows authentication or security authentication to be processed.
The present invention can be used not only for user authentication during financial transactions, security authentication of corporations or public institutions, but also conveniently used as a USB memory.

Description

USB COMPOSITE APPARATUS WITH MEMORY FUNCTION AND HARDWARE SECURITY MODULE}

The present invention relates to a universal serial bus (USB) composite device, and more particularly, to a USB composite device having a memory function and a hardware security module (HSM) function.

The security token is used for user authentication in financial transactions such as bank transfer through internet banking with the Internet banking certificate of the financial institution, or as an intranet or network login device with a security certificate of a company or a public institution.

Such security token is mainly developed as a USB type, for example, a type similar to a portable USB memory, so that it is not only easy to carry and easy to use, but also has a CPU and a cryptographic device inside the device to generate an electronic signature key, Since it is possible to generate and verify electronic signatures, even if a security token is connected to the PC, the encrypted private key in the security token can never be taken out by hacking, and its stability is recognized by financial institutions, etc. In addition to the one-time password generator called), it is widely used as a first-class security medium.

1 is a block diagram showing the configuration of a general USB type security token.

As shown in FIG. 1, a general USB type security token 100 includes a security token CPU 110, a code memory unit 120, and a data memory unit 130. In general, these (110, 120, 130) are combined into a COB. It is in the form of (CHIP ON BOARD).

The secure token CPU 110 may include a main CPU 111, a CRYPTO CPU 112, a USB block 113, a general purpose input / output pins (GPIO) block 114, and a clock block 115. It is configured to include).

The main CPU 111 includes registers for controlling the overall operation of the security token 100 while communicating with the host through the USB pin 111a.

The host means a product to which various USB host functions including a PC are added.

The crypto CPU 112 supports cryptography-related functions such as registers for performing encryption-related instructions and RSA (Rivest Shamir Adleman) (1024bit / 2048bit) and DES (Data Encryption Standard) / 3-DES. It has a Crypto-coprocessor.

The USB block 113 includes endpoints, which are control registers used for USB communication between the secure token 100 and the host.

The endpoint is a logical port through which the USB device and the host exchange data through USB communication. Typically, one USB device basically transmits descriptor information of the USB device to the host or commands of the host in a plug and play manner. You must have at least one endpoint for sending descriptors (called 'endpoint 0') to receive the signal, and depending on the characteristics, you can have more than one endpoint for reading, writing, and so on. In addition, these endpoints are bulk in-endpoints storing data to be sent to the host and bulk out-endpoints storing data received from the host, depending on the direction of data transmission. Separated by.

Unlike the general USB device, the secure token 100 has an interrupt IN endpoint that transmits an interrupt signal indicating that the endpoint 0 and the secure token 100 are normally connected to the host. Depending on the characteristics, it can have more than two endpoints for reading and writing data.

The descriptor is a data structure that contains information about the role of a USB device. When the USB device is inserted into a USB port of a host, the descriptor is transmitted to the host first, and the device having existing information of the device (Device ) Descriptor, configuration descriptor with device details, interface descriptor that defines the interface method, and endpoint descriptor that defines how the endpoint is used.

For reference, the first process of exchanging a descriptor with the host after the USB device is inserted into a USB port of the host is called enumeration. The host registers the USB device when such enumeration is completed. From then on, USB devices exchange data with the host through the bulk in-end and bulk out-end points set in the descriptor.

Unlike the general USB device, the secure token 100 as described above completes the enumeration process on the host and registers the secure token 100. Then, the secure token 100 notifies the host of the normal connection state through the interrupt-in endpoint immediately after that. It sends an interrupt signal, and then exchanges data with the host through the bulk in-end and bulk out-end points set in the descriptor.

The GPIO block 114 includes input / output pins that can set input / output of another device according to a user's purpose of the security token 100, and generally, an ON / OFF or other device of an LED indicating a power supply state of a USB device. Can be used for communication with.

The clock block 115 includes registers for separately setting clock frequencies used in the main CPU 111, the crypto CPU 112, the USB block 113, and the GPIO block 114.

The code memory unit 120 mainly stores software for implementing a function of the security token 100. The data is written once instead of being stored only when power is applied, such as RAM. It is a ROM that is not erased even if power is lost.

The code memory unit 120 controls the secure token file system block 121, the USB interface function block 122, and the encryption / decryption function block to directly control the values of the registers of the secure token CPU 110 for each function. 123, GPIO control function block 124.

The secure token file system block 121 is a system block that directly manages data stored in the data memory unit 130, and is called a COS (Smart Card Operating System) block, and is a USB smart card class (USB SCC). Application Protocol Data Unit (APDU) commands (e.g., private key generation, file reading, file writing, encryption) in accordance with ISO 7816-4, the smart cart international standard protocol, on the host in accordance with the specifications of the Serial Bus Smart Card Class. , Decryption, signature, signature authentication, etc.) is driven when the main CPU 111 is transferred. In general, since the host does not know the actual address of the data memory unit 130, the host transmits an APDU command of a file read or write operation using a file index value or a record number. In this case, the secure token file system block 121 accesses the actual data by analyzing the file index or record number in the received APDU command and changing the file index or record number to the actual address of the data memory unit 130. All APDU commands corresponding to ISO 7816-4 related to the security token 100 as well as APDU commands for file read and write operations are processed by the security token file system block 121, and commands related to decryption and decryption (eg, personal Key generation, encryption, decryption, signing, signature authentication, etc.) is delivered, a function related to the corresponding decryption of the decryption function block 123 is called to request processing to the crypto CPU 112, and the crypto CPU Receiving a result of the 112 performing the command related to decryption and decryption, it is transmitted to the host side as needed or stored in the data memory unit 130.

The USB interface function block 122 has a function of transferring data using endpoint registers of the USB block 113 of the secure token CPU 110 and a function having descriptor information necessary for USB enumeration. It includes.

The decryption function block 123 is a function related to decryption called by the secure token file system block 121 when the APDU command transmitted from the host is a decryption related command (eg, a private key generation function, an RSA). , Encryption and decryption functions such as DES, signature and signature authentication functions).

The GPIO control function block 124 includes an input / output control function for setting the input / output of the input / output pins of the GPIO block 114 to set the input / output of another device according to the purpose of the user of the security token 100.

The data memory unit 130 may include data (eg, private key, read / write data, encryption) related to an APDU command (eg, private key generation, file reading, file writing, encryption, decryption, signature, signature authentication, etc.) of a host. Data, decrypted data, signature key, signature authentication key, etc.).

The conventional security token 100 configured as described above operates as follows.

When the USB pin 111a of the secure token 100 is inserted into a USB port of a host such as a PC, the main CPU 111 first operates to receive a descriptor request of the host to secure the file system. Transfer to block 121.

Accordingly, the secure token file system block 121 calls the descriptor information function of the USB interface function block 122 and stores the device descriptor, configuration descriptor, interface descriptor, and endpoint descriptor set in the descriptor information function. The enumeration process is performed by transferring the CPU 111 and the USB pin 111a to the host.

At this time, the main CPU 111 also transmits a power-on signal to the GPIO block 114 to turn on the LED connected to any one of the output pins of the GPIO block 114 to secure the current security token 100. Inform the user that it is on.

At this time, the main CPU 111 is driven and the clock block 115 is driven to be used for the main CPU 111, the crypto CPU 112, the USB block 113, and the GPIO block 114. Generate a clock frequency.

As such, when the enumeration process between the security token 100 and the host is completed, the host registers the security token 100, and immediately after that, the security token 100 is an interrupt of the USB block 113. Sends an interrupt signal to the host through the endpoint to indicate normal connection status.

As described above, after the secure token 100 transmits an interrupt signal indicating a normal connection state to the host through the interrupt in endpoint of the USB block 113, the USB block 113 set in the endpoint descriptor thereafter. Data exchanges with the host through bulk in-endpoints and bulk out-endpoints.

For example, when an APDU command for reading or writing a file is transmitted from the host to the main CPU 111 of the secure token 100, the main CPU 111 transfers the command to the secure token file system block 121. do.

Accordingly, the secure token file system block 121 transfers data from the host to the data memory unit 130 while reading or writing data using the endpoint registers of the USB block 113 or the data memory unit. Forward to host at 130.

For example, when a host transmits a command related to decryption (for example, a private key generation, encryption, decryption, signature, signature authentication, etc.) to the main CPU 111 of the security token 100, the main CPU 111 reads this. The command is transmitted to the secure token file system block 121.

Accordingly, the secure token file system block 121 is a function related to the corresponding decryption of the decryption function block 123 (e.g., a decryption function such as a private key generation function, RSA, DES, signature and signature authentication function). Call) to request processing to the crypto CPU 112, and receive the result of the crypto CPU 112 performing the encryption and decryption related command, and transfer the result to the host side as necessary or store it in the data memory unit 130. do.

On the other hand, since the security token 100 that operates as described above is developed in a type similar to a USB type, for example, a portable USB memory, and used entirely for user authentication during financial transactions, or used for security authentication of corporations or public institutions, The disadvantage is that it does not provide the USB memory function that the user needs.

For reference, FIG. 2 is a block diagram showing the configuration of a general USB memory.

As shown in FIG. 2, a general USB memory 100 ′ is composed of a memory CPU 110 ′, a code memory unit 120 ′, and a data memory unit 130 ′, and the memory CPU 110 ′ and a code. The memory unit 120 ′ is formed in a one chip form, and a NAND flash memory is mainly used as the data memory unit 130 ′.

The memory CPU 110 'includes a main CPU 111', a USB block 112 ', a GPIO block 113', and a clock block 114 '.

The main CPU 111 ′ includes registers for controlling overall operation of the USB memory 100 ′ while communicating with a host through the USB pin 111 a ′.

The host means a product to which various USB host functions including a PC are added.

The USB block 112 'includes endpoints, which are control registers used for USB communication between the USB memory 100' and the host, and basically the endpoint 0 and data for the enumeration. You can have more than one endpoint for reading, writing, and so on.

When the USB memory 100 'is completed with the enumeration process at the host and registers the USB memory 100', the USB memory 100 'is then connected with the host through the bulk in-end point and the bulk out-end point set in the descriptor. You exchange data.

The GPIO block 113 'includes input / output pins that can set input / output of another device according to a user's purpose of the USB memory 100', and generally, an on / off of an LED indicating a power supply state of a USB device or It can be used for communication with other devices.

The clock block 114 'includes registers for separately setting clock frequencies used in the main CPU 111', the USB block 112 ', and the GPIO block 113'.

The code memory unit 120 'mainly stores software for implementing the functions of the USB memory 100', and once written, the data is a ROM that is stored without being erased even if power is lost.

The code memory unit 120 ′ is configured to directly manage data stored in the data memory unit 130 ′, the NAND flash file system block 121 ′, a USB interface function block 122 ′, and a GPIO control function block ( 123 ').

The NAND flash file system block 121 ′ is a system block that directly manages read / write of data stored in the data memory unit 130 ′, and is a USB mass storage class (USB MSC; Universal Serial Bus Mass Storage Class). In accordance with the specification, UFI commands (for example, data read, data write, etc.) according to the standard of UFI (USB Floppy Interface) are transmitted to the host through the main CPU 111 '. For reference, the host transfers UFI commands in the form of logical addresses based on the file system used in the PC to the USB memory 100 ', not the actual physical addresses of the NAND flash standard. . In addition, the file system used in the PC is 512 Bytes, the minimum unit of read / write operation is sector, and N48 flash memory is 2048 Bytes, the minimum unit of read / write operation is page. Therefore, in order to solve the problems in which the minimum unit of the read / write operation is different from each other, the logical address coming down from the host through the NAND flash file system block 121 'must be replaced with a physical address. This is because when the USB memory 100 'is connected to a USB port of a host such as a PC, the USB memory 100' can be used by the host only if it is formatted as a NAND flash file system compatible with the PC file system. In addition, the NAND flash file system does not merely perform address translation, but NAND flash has a limited number of read / write operations per block due to its nature, and a bad block may occur during use. For this reason, a Flash Translation Layer (FTL), which periodically translates a physical address into a logical address, must also be implemented. When the NAND flash file system including the flash translation layer (FTL) is implemented, the USB memory 100 'is connected to a host and is recognized as a hard disk and can be used as a removable disk.

The USB interface function block 122 'has a function of transferring data using endpoint registers of the USB block 112' of the USB memory 100 'and a function having descriptor information necessary for USB enumeration. It is included.

The GPIO control function block 123 'includes an input / output control function for setting the input / output of the input / output pins of the GPIO block 113' that can set the input / output of another device according to the user's purpose of the USB memory 100 '. do.

The data memory unit 130 ′ stores data (eg, read / write data, etc.) related to a UFI command (eg, data read, data write, etc.) of the host.

The conventional USB memory 100 'configured as described above operates as follows.

When the USB pin 111a 'of the USB memory 100' is inserted into a USB port of a host such as a PC, the main CPU 111 'is driven first to receive a descriptor request from the host to the NAND. Transfer to the flash file system block 121 '.

Accordingly, the NAND flash file system block 121 'calls the descriptor information function of the USB interface function block 122' to determine the device descriptor, configuration descriptor, interface descriptor, and endpoint descriptor set in the descriptor information function. The enumeration process is performed to the host via the main CPU 111 'and the USB pin 111a'.

At this time, the main CPU 111 ′ also transmits a power-on signal to the GPIO block 113 ′ and turns on the LED connected to any one of the output pins of the GPIO block 113 ′. ') Notifies the user that the power is on.

At this time, the main CPU 111 'is driven and the clock block 114' is driven to drive the main CPU 111 ', the USB block 112', and the GPIO block 113 '. Generate frequency.

As such, when the enumeration process between the USB memory 100 'and the host is completed, the host registers the USB memory 100', and thereafter, the bulk of the USB block 113 'set in the endpoint descriptor. Data is exchanged with the host through in-end points and bulk out-end points.

For example, when a UFI command for reading or writing data from a host is transferred to the main CPU 111 ′ of the USB memory 100 ′, the main CPU 111 ′ sends the command to the NAND flash file system block 121. ') To pass.

Accordingly, the NAND flash file system block 121 'is transferred from the host to the data memory unit 130' while reading or writing data using the endpoint registers of the USB block 112 ', or The data is transferred from the memory unit 130 'to the host.

The present invention is to solve the conventional problems as described above, an object of the present invention is to define the USB memory interface method and USB security token interface method in the interface descriptor of the descriptor information function included in the USB interface function block, The endpoint descriptor of the descriptor information function contained in the USB interface function block, endpoint 0, which is the endpoint for transferring the descriptor, and two endpoints for reading and writing data for the USB memory, and two for reading and writing data for the USB security token. Endpoints are defined, and an interrupt-in endpoint that transmits an interrupt signal indicating that the USB security token is normally connected to the host, and UFI is distinguished whether the command transmitted from the host to the USB memory unit is a UFI command or an APDU command. Command is USB memory part The data read / write of the USB memory part is processed by the flash file system block, and the result of processing the APDU command and APDU command is 2 input / output pins and the USB security token set as the clock pin and the data pin in the GPIO block of the USB memory part. Memory function including a function selection unit for allowing user authentication or security authentication to be processed by sending and receiving between the USB security token unit and the host by a 2-wire communication method between two input / output pins configured as clock pins and data pins in a negative GPIO block. It is to provide a USB composite device with a security token function.

In order to achieve the object of the present invention as described above, a USB composite device having a memory function and a security token function according to the present invention, when a UFI command is transmitted from the host to perform a data read or write function, USB memory unit for transmitting to the outside when the APDU command is transmitted; And a USB security token unit (HIM) which performs a user authentication or security authentication function with a host through the USB memory unit when receiving the APDU command transmitted from the USB memory unit to the outside.

The present invention can be used not only for user authentication during financial transactions, security authentication of corporations or public institutions, but also conveniently used as a USB memory.

1 is a block diagram showing the configuration of a general USB type security token.
2 is a block diagram showing a configuration of a general USB memory.
Figure 3 is a block diagram showing the configuration of a USB composite device having a memory function and a security token function according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 3, the USB composite apparatus 200 according to the present invention performs a function of reading or writing data when a UFI command is transmitted from a host, and transmitting the data to an external device when the APDU command is transmitted from the host. ) And a USB security token unit (HSM) that performs a user authentication or security authentication function with a host through the USB memory unit MEM when the APDU command transmitted from the USB memory unit MEM is externally received.

The USB memory unit MEM includes a memory CPU 210, a code memory unit 220, and a data memory unit 230, and the memory CPU 210 and the code memory unit 220 are in a single chip form. The NAND flash memory is mainly used as the data memory unit 230.

The memory CPU 210 includes a main CPU 211, a USB block 212, a GPIO block 213, and a clock block 214.

The main CPU 211 includes registers that communicate with the host through the USB pin 211a to receive the host's UFI command and the APDU command, and control the overall operation of the USB memory unit MEM.

The USB block 212 includes endpoints, which are control registers used for USB communication between the USB memory unit MEM and the host, and basically reads and writes data for endpoint 0 and USB memory, which are endpoints for descriptor transfer. It has two endpoints for it, two endpoints for reading and writing data for the USB security token, and an interrupt-in endpoint that sends an interrupt signal indicating that the USB security token unit (HSM) is normally connected to the host. .

The GPIO block 213 includes input / output pins for setting input / output of another device according to a user's purpose, and generally for the purpose of ON / OFF of an LED indicating a power supply state of a USB device or for communication with another device. Can be used.

The GPIO block 213 includes two input / output pins configured as a clock pin and a data pin for communication between the USB memory unit MEM and the USB security token unit HSM.

The clock block 214 includes registers for separately setting clock frequencies used in the main CPU 211, the USB block 212, and the GPIO block 213.

The code memory unit 220 includes a function selection unit 221, a NAND flash file system block 222, a USB interface function block 223, and a GPIO control function block 224.

The function selector 221 distinguishes whether a command transmitted from the host to the USB memory unit MEM is a UFI command or an APDU command, and the UFI command is transmitted to the NAND flash of the USB memory unit MEM through the main CPU 211. The data is transferred to the file system block 222 so that data read / write of the USB memory unit MEM is processed.

The function selector 221 clocks the APDU command and the processing result of the APDU command in two input / output pins of the GPIO block 213 of the USB memory unit MEM and the GPIO block 244 of the USB security token unit HSM. User authentication or security authentication is processed by sending and receiving between USB security token unit (HSM) and host by 2 wire communication method between two I / O pins configured as pin and data pin.

The NAND flash file system block 222 is a system block that directly manages read / write of data stored in the data memory unit 230, and includes a USB MSC (Universal Serial Bus Mass Storage Class). In accordance with the specification, UFI commands (eg, data read, data write, etc.) according to a standard of the USB Floppy Interface (UFI) are driven by the host through the main CPU 211. For reference, the host transfers UFI commands in the form of logical addresses based on the file system used in the PC to the USB memory unit (MEM), not the actual physical addresses of NAND flash standards. . In addition, the file system used in the PC is 512 Bytes, the minimum unit of read / write operation is sector, and N48 flash memory is 2048 Bytes, the minimum unit of read / write operation is page. Therefore, in order to solve the problems in which the minimum unit of the read / write operation is different from each other, the logical address coming out of the host through the NAND flash file system block 222 must be replaced with a physical address. This is because when the USB memory unit (MEM) is connected to a USB port of a host such as a PC, it can be used by the host only if it is formatted as a NAND flash file system compatible with the PC file system. In addition, the NAND flash file system does not merely perform address translation, but NAND flash has a limited number of read / write operations per block due to its nature, and a bad block may occur during use. For this reason, a Flash Translation Layer (FTL), which periodically translates a physical address into a logical address, must also be implemented. When the NAND flash file system including the flash translation layer (FTL) is implemented, the USB memory unit (MEM) is recognized as a hard disk when connected to a host and can be used as a removable disk.

The USB interface function block 223 includes a function of transferring data using endpoint registers of the USB block 212 of the USB memory unit MEM and a function having descriptor information required for USB enumeration. .

In particular, the USB interface function block 223 has a USB memory interface method and a USB security token interface method defined in an interface descriptor of a function having descriptor information, and an endpoint for transmitting a descriptor in an endpoint descriptor of the descriptor information function. Point 0 and two endpoints for reading and writing data to the USB memory, reading and writing data for the USB security token, two endpoints for writing and sending an interrupt signal indicating that the USB security token is normally connected to the host. An interrupt in endpoint is defined.

The GPIO control function block 224 includes two input / output pins of the input / output pins of the GPIO block 213 that can set the input / output of another device according to the user's purpose of the USB memory unit MEM, respectively. Contains input and output control functions.

The data memory 230 stores data (eg, read / write data, etc.) related to a UFI command (eg, data read, data write, etc.) of the host.

The USB security token unit (HSM) is composed of a security token CPU 240, a code memory unit 250 and a data memory unit 260, and these (240, 250, 260) are combined into a COB (CHIP ON BOARD) form It is preferable.

The secure token CPU 240 includes a main CPU 241, a crypto CPU 242, a GPIO block 243, and a clock block 244.

The main CPU 241 includes registers for controlling the overall operation of the USB security token unit HSM while communicating with the host through the USB memory unit MEM.

The crypto CPU 242 supports cryptography-related functions such as registers that perform encryption-related instructions and RSA (Rivest Shamir Adleman) (1024 bit / 2048 bit), DES (Data Encryption Standard) / 3-DES, and the like. It has a Crypto-coprocessor.

The GPIO block 243 includes input / output pins for setting input / output of another device according to a user's purpose, and includes a clock pin and a data pin for communication between the USB memory unit MEM and the USB security token unit HSM. Contains two input and output pins.

 The clock block 244 includes registers for separately setting a clock frequency used for the main CPU 241, the crypto CPU 242, and the GPIO block 243.

The code memory unit 250 includes a secure token file system block 251, a decryption function block 252, and a GPIO control function block 253.

The secure token file system block 251 is a system block that directly manages data stored in the data memory unit 260, and is called a COS block, and is a USB Smart Card Class (USB SCC). Application Protocol Data Unit (APDU) commands (e.g., private key generation, file reading, file writing, encryption, decryption, signing, signature authentication, etc.) according to ISO 7816-4, a smart cart international standard protocol When it is delivered through the main CPU 241 is driven. In general, since the host does not know the actual address of the data memory unit 260, the host transmits an APDU command of a file read or write operation using a file index value or a record number. At this time, the secure token file system block 251 serves to access the actual data by analyzing the file index or record number in the received APDU command and changing it to the actual address of the data memory unit 260. Security token file system block 251 processes all APDU commands corresponding to ISO 7816-4 related to USB Security Token (HSM) as well as APDU commands for file read and write operations. , Private key generation, encryption, decryption, signature, signature authentication, and the like), when a function related to the decryption of the decryption function block 252 is called and requested to be processed by the crypto CPU 242, and The crypto CPU 242 receives a result of performing a command related to decryption and transfers the result to the host side as needed, or stores the result in the data memory unit 260.

The decryption function block 252 is a function related to decryption called by the secure token file system block 251 when the APDU command transmitted from the host is a decryption related command (eg, a private key generation function, an RSA). , Encryption and decryption functions such as DES, signature and signature authentication functions).

The GPIO control function block 253 includes two input / output pins of the input / output pins of the GPIO block 243, which can set the input / output of another device according to the user's purpose of the USB security token unit (HSM), respectively. Contains input and output control functions that are set by pins.

The data memory unit 260 may include data (eg, private key, read / write data, encryption) related to APDU commands (eg, private key generation, file reading, file writing, encryption, decryption, signature, signature authentication, etc.) of a host. Data, decrypted data, signature key, signature authentication key, etc.).

GPIO block 213 and USB security of the USB memory unit MEM including two input / output pins configured as clock pins and data pins for communication between the USB memory unit MEM and the USB security token unit HSM. The GPIO block 243 of the token unit HSM transfers data through the data pin in synchronization with the clock pin by a 2-wire communication method.

The header HEADER means that data communication is started when the GPIO block 213 of the USB memory unit MEM and the GPIO block 243 of the USB security token unit HSM exchange data. The information is first transmitted to one side, and then the data size (DATASIZE), which means the total number of data to be communicated, is sent, and finally the actual data is transmitted.

For example, the UFI command transferred from the host to the USB memory unit MEM is transferred directly to the NAND flash file system 222, but the APDU command transferred from the host to the USB memory unit MEM is a USB security token unit (HSM). Before transmitting data to the GPIO block 243 of the USB security token unit (HSM) to communicate with the GPIO block 213 of the USB memory unit MEM. Data size representing the total number of data of the data is sent to the GPIO block 243 of the USB security token unit (HSM), and finally, the APDU command received from the host is sent to the GPIO block 243 of the USB security token unit (HSM). ).

The USB composite device 200 having a memory function and a security token function according to the present invention configured as described above operates as follows.

When the USB pin 211a of the USB composite device 200 is inserted into a USB port of a host such as a PC, first of all, the main CPU 211 and the USB security token unit HSM of the USB memory unit MEM are first connected. The CPU 241 is driven, and then the USB memory unit MEM receives a descriptor request from a host and transfers the request to the NAND flash file system block 222.

Accordingly, the NAND flash file system block 222 calls the descriptor information function of the USB interface function block 223, and sets the device descriptor, configuration descriptor, interface descriptor, and endpoint descriptor set in the descriptor information function to the main descriptor. The enumeration process is performed by transferring the CPU 211 and the USB pin 211a to the host.

At this time, the main CPU 211 of the USB memory unit MEM also transmits a power-on signal to the GPIO block 213 to turn on the LED connected to any one of the output pins of the GPIO block 213. Notifies the user that the USB composite device 200 is in a power-on state.

At this time, the main CPU 211 of the USB memory unit MEM is driven and the clock block 214 is driven to be used for the main CPU 211, the USB block 212, and the GPIO block 213. To generate a clock frequency.

At this time, the main CPU 240 of the USB security token unit (HSM) is driven and the clock block 244 is driven to the main CPU 241, the crypto CPU 242, and the GPIO block 243. Generates the clock frequency used.

As such, when the enumeration process between the USB composite apparatus 200 and the host is completed, the host registers the USB composite apparatus 200, and immediately after that, the USB composite apparatus 200 is a USB memory unit MEM. An interrupt signal of the normal connection state is transmitted to the host through an interrupt in endpoint of the USB block 212.

As described above, after the USB composite apparatus 200 transmits an interrupt signal indicating a normal connection state to the host through the interrupt in endpoint of the USB block 212 of the USB memory unit MEM, the USB interface function block thereafter. Data is exchanged with the host through the bulk in-end point and the bulk out-end point of the USB block 212 of the USB memory unit MEM set in the endpoint descriptor of 223.

At this time, if the host transfers UFI commands for reading or writing data to the main CPU 211 of the USB memory unit MEM, or the APDU commands for reading or writing files from the host are stored in the USB memory unit MEM. The APDU command (for example, private key generation, encryption, decryption, signing, signature authentication, etc.) related to encryption or decryption at the host to the main CPU 211 of the USB memory unit MEM. If so, the main CPU 211 transfers all these instructions to the function selector 221.

Accordingly, the function selector 221 distinguishes whether a command transmitted from the host to the USB memory unit MEM is a UFI command or an APDU command.

At this time, the UFI command distinguished by the function selection unit 221 is transferred to the NAND flash file system block 222 through the main CPU 211 of the USB memory unit MEM to read data of the USB memory unit MEM. / Write is processed.

In this case, the NAND flash file system block 222 transfers data from the host to the data memory unit 230 while reading or writing data using the endpoint registers of the USB block 212, or the data memory unit. Forward to host at 230.

In contrast, the APDU command and the APDU command processing result distinguished by the function selector 221 may include two input / output pins of the GPIO block 213 of the USB memory unit MEM and a GPIO block of the USB security token unit HSM. At 244, the USB security token unit (HSM) and the host are exchanged between the host and the host by a 2-wire communication method between two input / output pins configured as a clock pin and a data pin, thereby processing user authentication or security authentication.

For example, as shown in FIG. 3, the APDU command distinguished by the function selector 221 may transmit and receive data through its data pin in synchronization with its clock pin by a 2-wire communication method. Is transmitted to the main CPU 241 of the USB secure token unit HSM through communication between the GPIO block 213 of the USB security token unit HSM and the GPIO block 243 of the USB security token unit HSM. The APDU command is transmitted to the secure token file system block 251.

In this case, when the secure token file system block 251 receives an APDU command for reading or writing a file from the host, the secure token file system block 251 is a GPIO block 213 of the USB memory unit MEM. The data memory unit at the host while reading or writing data using the endpoint registers of the USB block 212 of the USB memory unit MEM through communication between the GPIO block 243 of the USB security token unit (HSM). 260, or the data memory unit 260 to the host.

In addition, when the secure token file system block 251 receives an APDU command (eg, private key generation, encryption, decryption, signature, signature authentication, etc.) related to decryption from the host, the secure token file system block 251 is received. Calls a function related to the corresponding decryption of the decryption function block 252 (for example, a private key generation function, an encryption / decryption function such as RSA, DES, a signature and a signature authentication function), and processes it to the crypto CPU 242. Requesting, receiving the result of the encryption / decryption and the related command from the crypto CPU 242, and via the main CPU 241, the GPIO block 213 and the USB security token unit of the USB memory unit MEM as necessary. The GPIO block 243 of the HSM communicates with the host or stores the data in the data memory unit 260.

The USB composite device having the memory function and the security token function according to the present invention described above is not limited to the above-described embodiment, and the present invention belongs without departing from the gist of the present invention as claimed in the following claims. To those skilled in the art, the technical spirit is to the extent that anyone can make various changes.

<Description of the symbols for the main parts of the drawings>
100: security token 100 ': USB memory
110: security token CPU 110 ': memory CPU
111,111 ': Main CPU 111a, 111a': USB pin
112: Crypto CPU 113,112 ': USB block
114,113 ': GPIO block 115,114': clock block
120,120 ': code memory section 121: secure token file system block
121 ': NAND Flash File System Block
122,122 ': USB interface function block
123: encryption block 124,123 ': GPIO control function block
130,130 ': data memory 200: USB composite device
210: memory CPU 211: main CPU
211a: USB Pin 212: USB Block
213: GPIO block 214: clock block
220: code memory unit 221: function selection unit
222: NAND flash file system block
223: USB interface function block
224: GPIO control function block 230, 260: data memory section
240: secure token CPU 241: main CPU
242: crypto CPU 243: GPIO block
244: clock block 250: code memory section
251: Secure Token File System Block
252: decryption function block 253: GPIO control function block
MEM: USB memory section HSM: USB security token section

Claims (5)

A USB memory unit (MEM) that performs data read or write function when a UFI command is transmitted from the host, and transmits externally when the APDU command is transmitted from the host; And
A USB security token unit (HSM) for performing a user authentication or security authentication function with a host through the USB memory unit (MEM) when receiving the APDU command transmitted from the USB memory unit (MEM) to the outside; In the USB composite device equipped with a security token function,
The USB memory unit (MEM) is
A main CPU 211 that receives registers for controlling the overall operation of the USB memory unit MEM while receiving a host UFI command and an APDU command while communicating with the host through the USB pin 121a; It includes endpoints, which are control registers used for USB communication between the USB memory section (MEM) and the host, basically endpoint 0 for descriptor transfer, two endpoints for reading and writing data for USB memory, A USB block 212 having two endpoints for reading and writing data for the USB security token, and an interrupt in endpoint for transmitting an interrupt signal informing that the USB security token unit (HSM) is normally connected to the host; A GPIO block 213 including two input / output pins configured as clock pins and data pins for communication between the USB memory unit MEM and the USB security token unit HSM; And a clock block (214) including registers for separately setting clock frequencies used in the main CPU (211), the USB block (212), and the GPIO block (213).
The UFI command is transmitted to the NAND flash file system block 222 of the USB memory unit MEM through the main CPU 211 by distinguishing whether the command transmitted from the host to the USB memory unit MEM is a UFI command or an APDU command. The data read / write of the USB memory unit MEM is processed, and the result of processing the APDU command and the APDU command is the two input / output pins of the GPIO block 213 of the USB memory unit MEM and the USB security token unit (HSM). In the GPIO block 243, the user can make a user authentication or security authentication by sending and receiving between the USB security token unit (HSM) and the host by a 2-wire communication method between two input / output pins configured as clock pins and data pins. A selection unit 221; As a system block that directly manages read / write of data stored in the data memory unit 230, the USB Floppy Interface (UFI) is used in the host according to the specification of the USB MSC (Universal Serial Bus Mass Storage Class). A NAND flash file system block 222 which is driven when UFI instructions according to the criteria of the present invention are transmitted through the main CPU 211; Interface descriptor of a function having descriptor information necessary for USB enumeration, and a function having data transfer function using endpoint registers of the USB block 212 of the USB memory unit MEM. The USB memory interface method and the USB security token interface method are defined in the endpoint descriptor of the descriptor information function, endpoint 0, which is a descriptor for transferring a descriptor, two endpoints for reading and writing data for a USB memory, and USB security. A USB interface function block 223 which defines two endpoints for reading and writing data for the token, and an interrupt in endpoint for transmitting an interrupt signal informing that the USB security token is normally connected to the host; And an input / output control function for setting two input / output pins of the input / output pins of the GPIO block 213 that can set input / output of another device according to a user's purpose of the USB memory unit MEM as clock pins and data pins, respectively. A code memory unit 220 including a GPIO control function block 224; And
A data memory unit 230 storing data related to a UFI command of the host;
USB composite device having a memory function and a security token function, characterized in that configured to include.
delete The method of claim 1, wherein the USB security token unit (HSM)
A main CPU 241 including registers for communicating with the host through the USB memory unit MEM and controlling the overall operation of the USB security token unit HSM; A crypto CPU 242 having registers for performing decryption related instructions and a processor supporting a decryption related function; A GPIO block 243 including two input / output pins configured as clock pins and data pins for communication between the USB memory unit MEM and the USB security token unit HSM; And a clock block (244) including registers for separately setting clock frequencies used in the main CPU (241), the crypto CPU (242), and the GPIO block (243).
As a system block that directly manages data stored in the data memory unit 260, an ISO 7816-4, which is an international standard protocol for smart carts in a host, meets the specifications of a universal serial bus smart card (USB SCC). A security token file system block 251 that is driven when APDU (Application Protocol Data Unit) instructions are transmitted through the main CPU 241; A decryption function block 252 including a function related to decryption called by the secure token file system block 251 when the APDU command transmitted from the host is a decryption related command; And an input / output control function for setting two input / output pins of the input / output pins of the GPIO block 243 that can set the input / output of another device according to the user's purpose of the USB security token unit (HSM) as clock pins and data pins, respectively. Code memory unit 250 including; GPIO control function block 253; And
A data memory unit 260 for storing data related to an APDU command of a host;
USB composite device having a memory function and a security token function, characterized in that configured to include. The method according to claim 1 or 3,
GPIO block 213 and USB security of the USB memory unit MEM including two input / output pins configured as clock pins and data pins for communication between the USB memory unit MEM and the USB security token unit HSM. GPIO block 243 of the token unit (HSM) is a USB composite device having a memory function and a security token function, characterized in that for transferring data through the data pin in synchronization with the clock pin by a 2-wire communication method. 5. The method of claim 4, wherein the GPIO block 213 of the USB memory unit MEM and the GPIO block 243 of the USB security token unit HSM start data communication when data is transmitted and received in a 2-wire communication method. Memory function and security, characterized in that the header (HEADER) information is first sent to one side, and then the data size (DATASIZE), which means the total number of data to be communicated, is transmitted and finally the actual data is transmitted. USB composite device with token function.

Images