KR101829423B1 - Apparatus for encrypting or decrypting and method for encrypting or decrypting using the same - Google Patents

Abstract

 The encryption / decryption apparatus according to an exemplary embodiment of the present invention is included in a terminal apparatus, the terminal apparatus further includes a communication unit for communicating with the outside and an input unit for receiving data from a user of the terminal apparatus, A key storage unit connected to the input unit, the input unit receiving data input from the user from the input unit, and transmitting the received data to a first key, which is one of the plurality of keys, A port unit for receiving the encrypted data encrypted by the encryption / decryption unit from the encryption / decryption unit and transferring the encrypted data to the communication unit, and an encryption / decryption unit for storing the same key as the plurality of keys, And a connection unit used when the key storage unit is physically connected Keys are generated and stored when the encryption / decryption apparatus is connected to the other encryption / decryption apparatus by the connection unit.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to an encryption / decryption apparatus,

The present invention relates to an encryption / decryption apparatus and an encryption method using the same. More specifically, when the encryption / decryption devices for encrypting / decrypting data are physically connected to each other, the key used for encryption / decryption of data is shared, thereby blocking the possibility of deception and hacking of a key by a malicious agent. To a device for providing a technique for blocking the occurrence of malicious activity by an infected terminal device when the terminal device is infected with a malicious code or the like.

With the development of the Internet, most of the services available in modern society can be carried out online. For example, it is possible to process transactions such as financial transaction, purchase and sale of goods, as well as civil complaints handling resident registration etc. through online.

These services deal with information related to an individual's personal or financial transactions. Therefore, in order to transmit and receive information under such a service, a technique for enhancing security is indispensably required.

As a well-known technique for enhancing security in information transmission and reception, there is a technique using RSA, which is a system for encrypting and decrypting data using an asymmetric key. In the RSA system, data is encrypted based on public and private keys and transmitted over the network. However, the public key is disclosed and shared on the Internet. Thus, if a secret key is found based on the public key, the encrypted data can be hacked. Of course, it is known to be very difficult to find a secret key based on a public key, but it is not impossible when mathematically judged. Therefore, it can be said that such an RSA system has a weakness in security.

Meanwhile, various security media such as an official certificate, OTP (one time password), a security card, an I-PIN, and the like are utilized in order to further improve security.

However, even if the security medium including OTP is utilized, if the terminal device used by the user is infected with malicious code, perfect security may not be secured. For example, if a user's terminal device is infected to connect to a phishing site, it is difficult for the user to notice even if the user uses both the RSA system and the OTP. Therefore, financial transaction accidents or leakage of personal information may occur.

Korean Patent Publication No. 2005-0017493, published on February 22, 2005

A problem to be solved by the present invention is to prevent a malicious agent from stealing a key used for encryption and decryption of data, and to prevent a malicious behavior by an infected terminal device To prevent the occurrence of the above-mentioned problems.

However, the problem to be solved by the present invention is not limited to this.

The encryption / decryption apparatus according to an exemplary embodiment of the present invention is included in a terminal apparatus, the terminal apparatus further includes a communication unit for communicating with the outside and an input unit for receiving data from a user of the terminal apparatus, A key storage unit connected to the input unit, the input unit receiving data input from the user from the input unit, and transmitting the received data to a first key, which is one of the plurality of keys, A port unit for receiving the encrypted data encrypted by the encryption / decryption unit from the encryption / decryption unit and transferring the encrypted data to the communication unit, and an encryption / decryption unit for storing the same key as the plurality of keys, And a connection unit used when the key storage unit is physically connected Keys are generated and stored when the encryption / decryption apparatus is connected to the other encryption / decryption apparatus by the connection unit.

In a case where the input unit includes at least two input keys and each of the at least two input keys is assigned a corresponding identification value, the encryption / decryption unit decrypts the input key input from the at least two input keys The encryption can be performed using the first key with respect to the identification value corresponding to the key.

When the counter is incremented every time the input key is input to each of the at least two input keys, the encryption / decryption unit combines the identification value and the counter, and outputs the combined result to the first key Can be used to perform encryption.

Also, the encryption / decryption unit is connected to the key storage unit through a key bus, and can perform the encryption based on a key received from the key storage unit via the key bus.

Also, the port unit may be connected to the encryption / decryption unit through a data bus, and the encryption / decryption unit may transmit the encryption result to the communication unit of the terminal device through the port unit via the data bus. have.

The encryption / decryption unit may combine the data with a key identifier known by both the encryption / decryption apparatus and the encryption / decryption apparatus to generate combined data, encrypt the combined data based on the first key, Can transmit the encrypted combined data to the communication unit of the terminal device.

Also, the encryption / decryption unit may generate the key identifier based on at least two keys among the plurality of keys that are both known to the encryption / decryption apparatus and the other encryption / decryption apparatus.

The random number generating unit may further include a random number generator for generating a random number, wherein the key identifier is composed of a predetermined number of bits, and a part of the plurality of bits is a value obtained by at least two keys among the plurality of keys. And the remaining bits of the plurality of bits can be determined by the generated random number.

The encryption / decryption unit separates the encrypted key identifier, which is used to identify the first key, from the encrypted data, and transmits the encrypted key identifier to each of the plurality of keys, And decrypts the encrypted data using the key in the case where the decryption result is the same as the key identifier stored in the encryption / decryption apparatus.

The apparatus may further include a protection unit that recognizes that an action defined as abnormal is applied to the encryption / decryption device, and deletes the key when it is recognized that the action is applied.

In the encryption / decryption method performed by the encryption / decryption apparatus included in the terminal apparatus according to an exemplary embodiment, the terminal apparatus further includes a communication unit for communicating with the outside and an input unit for receiving data from a user of the terminal apparatus, The method comprising: receiving data received from the input unit by the input unit from the input unit; performing encryption using a first key, which is one of a plurality of predetermined keys, Wherein the predetermined encryption key is transmitted to the other encryption / decryption device storing the same key as the plurality of keys through the connection part included in the encryption / decryption device, And stored.

According to one embodiment, a malicious agent can not access and steal a key used for encryption / decryption of data. Therefore, the malicious actor can not decrypt the encrypted data and can not modulate the data.

In addition, even when a terminal device held by a user is infected with a malicious code or the like, a request for a user's server can be transmitted to a server without being tampered with. Therefore, accidents such as financial transaction accidents or personal information disclosure that may originate from terminal devices infected with malicious code may be blocked in advance.

1A and 1B are conceptual diagrams of a system to which an encryption / decryption apparatus according to an embodiment is applied.
FIG. 2 is a diagram illustrating a configuration of an encryption / decryption apparatus according to an embodiment.
FIG. 3 is a diagram illustrating a plurality of encryption / decryption apparatuses according to an embodiment, which are physically connected to each other.
4 is a diagram conceptually showing that a key storage unit and a port unit are configured separately in the encryption / decryption apparatus according to an exemplary embodiment.
Figures 5A and 5B are conceptual diagrams of key identifiers in one embodiment.
FIG. 6A is a diagram illustrating a process in which an encryption / decryption apparatus according to an embodiment is applied to the system shown in FIG. 1A to process a user's request.
FIG. 6B is a diagram illustrating a process in which an encryption / decryption apparatus according to an embodiment is applied to the system shown in FIG. 1B to process a user's request.
7 is a diagram illustrating each step of the encryption / decryption method according to an embodiment

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

FIG. 1A is a conceptual diagram of a system to which an encryption / decryption apparatus according to an embodiment is applied.

Referring to FIG. 1A, a system is configured by a terminal device 200 and a server 300. The terminal device 200 and the server 300 are connected by the network 500. The network 500 may be a wireless communication network such as CDMA, 3G, 4G, LTE-A, Bluetooth, Wi-Fi, NFC or IR or otherwise a wired communication network such as a LAN.

The terminal device 200 receives a request for the server 300 of the user 10 such as a financial transaction request or a personal information request from the user 10 and transmits the request to the server 300. [ The terminal device 200 may be a computing device, such as a PC or a smart device.

The terminal device 200 includes an input unit 210 for accepting a request from the user 10 to the server 300 of the user 10. The input unit 210 may be a variety of input means for receiving data from the user 10, such as a keypad, a keyboard, and a touch screen provided in the terminal device 200. [ The input unit 210 may include at least two input keys, and each input key may be assigned a corresponding identification value. For example, an identification value of '11011' may be assigned to the input key alphabet 'A', and an identification value of '11100' may be assigned to the input key alphabet 'B'. The identification value may be ASCII (ASCII) code according to the embodiment.

The terminal device 200 includes a control unit 230 for controlling the operation of the terminal device 200. The control unit 230 may be implemented by a microprocessor or the like. The control unit 230 is connected to the input unit 210. The control unit 230 receives the input received from the user 10 by the input unit 210 from the input unit 210 and processes the input and outputs the processed result to the communication unit 220 And the like.

The terminal apparatus 200 includes the encryption / decryption apparatus 100. [ The encryption / decryption apparatus 100 can encrypt a request (or data related to such a request) that the input unit 210 has received from the user 10. [ The encryption / decryption apparatus 100 is directly connected to the input unit 210 in hardware. Accordingly, when the user 10 inputs data through the input unit 210, the inputted data is transmitted to the encryption / decryption apparatus 100 through the hardware connection and encrypted.

The terminal device 200 includes a communication unit 220 for performing communication with the server 300. [ The communication unit 220 may receive the encrypted data from the encryption / decryption apparatus 100 and transmit the encrypted data to the server 300. Or the communication unit 220 may transmit the unencrypted data to the server 300. [ The communication unit 220 may be a wireless communication module such as CDMA, 3G, 4G, LTE-A, Bluetooth, Wi-Fi, NFC or IR, or a wired communication module such as a LAN.

The server 300 receives the request of the user 10 through the terminal device 200 and provides the service according to the request to the user 10 through the terminal device 200. [

The server 300 includes an encryption / decryption apparatus 310 or is connected to the encryption / decryption apparatus 310. The encryption / decryption apparatus 310 may be configured in hardware (in the form of a dongle, for example) connected to (attached to) the server 300, But it is not limited to this. Meanwhile, the encryption / decryption apparatus 310 of the server 300 may perform encryption or decryption in the same manner as the encryption / decryption apparatus 100 of the terminal apparatus 200.

The server 300 and the terminal device 200 process the request of the user 10 while exchanging encrypted data or unencrypted data with each other. This will be described in more detail in FIG. 6A.

1B is a conceptual diagram illustrating a system to which an encryption / decryption apparatus according to an embodiment is applied.

Referring to FIG. 1B, the terminal device 200, the server 300, and the network 500 included in the system are identical to those of FIG. 1A, and a description thereof will be omitted.

In the system of FIG. 1B, the security management apparatus 400 is further configured in comparison with FIG. 1A. The security management apparatus 400 is connected to the terminal apparatus 200 or the server 300 through the network 500.

The security management apparatus 400 includes an encryption / decryption apparatus 410 or is connected to the encryption / decryption apparatus 410.

The security management apparatus 400 receives the data encrypted by the encryption / decryption apparatus 100 from the terminal apparatus 200, and decrypts the received encrypted data using the encryption / decryption apparatus 410. In addition, the security management apparatus 400 encrypts data to be transmitted to the terminal apparatus 200 by using the encryption / decryption apparatus 410. At this time, the encrypted data encrypted by the encryption / decryption apparatus 410 can be decrypted by the encryption / decryption apparatus 100 or the encryption / decryption apparatus 310, which will be described later.

The security management apparatus 400 receives data encrypted by the encryption / decryption apparatus 310 from the server 300, and decrypts the received encrypted data. In addition, the security management apparatus 400 encrypts the data to be transmitted to the server 300 using the encryption / decryption apparatus 410.

Based on this, the security management apparatus 400 exchanges encrypted data with the terminal device 200 and the server 300 between the terminal device 200 and the server 300, decrypts the encrypted data, A request for the server 300 can be relayed between the terminal device 200 and the server 300. That is, the security management apparatus 400 can relay a request to the server 300 of the terminal device 200 between the terminal device 200 and the server 300. Take financial transactions as an example. The security management apparatus 400 analyzes the financial transaction for the server 300 from the terminal apparatus 200 and then communicates with the server 300 by itself to determine whether the terminal management apparatus 400 requests Financial transactions can be carried out. That is, after the security management apparatus 400 receives the financial transaction from the terminal apparatus 200, the security management apparatus 400 itself can perform a financial transaction with the server 300 on behalf of the terminal apparatus 200 have. This will be described in more detail in FIG. 6B.

As shown in FIGS. 1A and 1B, the input unit 210 is directly connected to the encryption / decryption apparatus 100 in hardware. Therefore, the data input by the user 10 through the input unit 210 is transmitted to the encryption / decryption apparatus 100 and encrypted. The data input by the user 10 through the input unit 210 may be transmitted to the control unit 230 without passing through the encryption and decryption apparatus 100 as shown in FIG. May be displayed on a display unit (not shown) of the terminal device 200.

At this time, the terminal apparatus 200 itself may be infected by a malicious code or the like. In this case, the input of the user 10 transmitted from the input unit 210 to the control unit 230 can be modulated by a malicious code or the like.

However, the input of the user 10 transferred from the input unit 210 to the encryption / decryption apparatus 100 is encrypted by the encryption / decryption apparatus 100 regardless of the control unit 230. In addition, as will be described later, the encrypted data encrypted by the encryption / decryption apparatus 100 can not be decrypted by a malicious code or a third party, and thus, it is also impossible to perform modulation. Therefore, the encrypted data encrypted by the encryption / decryption apparatus 100 is transmitted to the server 300 through the communication unit 220 (FIG. 1A) or the server 300 (FIG. 1A) via the security management apparatus 400 (Fig. 1B). That is, since the encrypted data transmitted to the server 300 is not tampered, an accident such as a financial transaction accident or personal information disclosure by the infected terminal device 200 or a third party can be blocked in advance.

Hereinafter, an encryption / decryption apparatus 100 according to an exemplary embodiment of the present invention which can not be decrypted by an infected terminal apparatus 200 or other third party will be described in more detail. It is assumed that the following description is also applied to the encryption / decryption apparatus 310 and the encryption / decryption apparatus 410.

FIG. 2 is a diagram illustrating a configuration of an encryption / decryption apparatus according to an embodiment.

First, the encryption / decryption apparatus 100 can be implemented by a memory (e.g., ROM) that stores the above-described functions and instructions programmed to perform the functions described below, and a processor that executes such a command. The encryption / decryption apparatus 100 may be implemented in the form of a semiconductor chip, but is not limited thereto.

The encryption / decryption apparatus 100 may be connected to each of at least two input keys included in the input unit 210. In this case, the encryption / decryption apparatus 100 encrypts the identification value corresponding to the input key for each input key.

Alternatively, the encryption / decryption apparatus 100 may be connected to the terminal apparatus 200 by one. Hereinafter, a description will be made on the assumption that one of the encryption / decryption apparatuses 100 is connected to the terminal apparatus 200 and connected thereto.

2, the encryption / decryption apparatus 100 includes a port unit 110, a key storage unit 120, an encryption / decryption unit 130, and a connection unit 150. The random number generation unit 160 2, and may further include a general configuration or other various configurations included in the electronic device, or may include any of the components shown in FIG. 2 But may not include at least one or more.

Referring to the connection unit 150, the connection unit 150 physically connects the plurality of the encryption / decryption apparatuses 100 with each other. For example, the connection unit 150 may be a hardware-implemented connector. The encryption and decryption apparatus 100 of the terminal device 200 can be connected to the encryption and decryption apparatus 310 of the server 300 or the encryption and decryption apparatus 410 of the security management apparatus 400 by the connection unit 150.

3 is a view conceptually showing that a plurality of the encryption / decryption apparatuses 100 are connected to each other through a connection unit 150 belonging thereto. 3, the reference numeral of the encryption / decryption apparatus is denoted by '100', but the encryption / decryption apparatus having the reference numeral 310 (the encryption / decryption apparatus of the server 300) or the encryption / (The encryption / decryption apparatus of the security management apparatus 400) may also be included in the plurality of encryption / decryption apparatuses shown in FIG. 3, and the description thereof will be provided below.

3, the plurality of encryption / decryption apparatuses 100 are physically connected to each other when the apparatus is physically connected to the factory at the time when the encryption / decryption apparatus 100 is manufactured or when the encryption / decryption apparatus 100 May be physically connected at the point of purchase when the user of the encryption / decryption apparatus 100 purchases the terminal, but the present invention is not limited thereto.

Referring again to FIG. 2, the port unit 110 exchanges data with the terminal device 200. The port unit 110 may be connected to the encryption / decryption unit 130 of the encryption / decryption apparatus 100. The data inputted by the user 10 through the input unit 110 is transmitted to the encryption and decryption unit 130 of the encryption and decryption apparatus 100 and the encrypted data is transmitted from the encryption and decryption unit 130 to the port unit 110, To the communication unit 220 via the communication unit 220. [

The key storage unit 120 stores a key, which may be a plurality of keys. Each of the plurality of keys is used for encrypting or decrypting the data. These keys may each be composed of a plurality of bits.

The plurality of keys may be generated based on a random number generated by the random number generation unit 160, for example, a value of 1000 random numbers. At this time, the value of an arbitrary number of random numbers may be a plurality of keys. Alternatively, the value processed by the predetermined algorithm of the random number may be a plurality of keys. The random number generation unit 160 at this time can implement its function by a microprocessor.

The reset unit 180 generates a seed - a value used when generating a random number - and provides it to the random number generation unit 160. The random number generation unit 160 generates a random number based on the seed.

The seed generated by the reset unit 180 may be transmitted to the encryption / decryption apparatuses 310 and 410 when the encryption / decryption apparatus 100 is physically connected to the encryption / decryption apparatuses 310 and 410. That is, the seed is not transmitted through the wireless communication or the wired communication method but is transmitted when the devices (encryption / decryption devices 100, 310, and 410 in this embodiment) involved in encryption / decryption are physically connected. Therefore, since the seed is not transmitted through the communication method, such a seed can not be deodorized by a hacker or the like.

The encryption / decryption apparatuses 310 and 410 receiving the seed can generate a random number using the same seed as the random number generation unit 160 of the encryption / decryption apparatus 100. Therefore, the random number stored in the key storage unit 120 is the same as the random number stored in the encryption / decryption units 310 and 410.

Here, the reset unit 180 may include a button or the like for receiving an input by the user 10. [ The reset unit 180 is connected to the random number generation unit 160. Accordingly, when the encryption / decryption apparatus 100 is physically connected to the encryption / decryption apparatuses 310 and 410 and the button of the reset unit 180 is pressed, the reset unit 180 generates a seed and provides it to the random number generation unit 160 do.

As described above, the plurality of encryption / decryption apparatuses (100, 310, 410) generate and share a plurality of keys when they are physically connected to each other. That is, a process of transmitting a plurality of keys through a communication network, whether in a wire communication or a wireless communication, does not occur. Therefore, unlike the existing RSA, there is no risk of key leakage or hacking in the process of distributing and sharing the key.

The plurality of keys stored in the key storage unit 120 may be updated (updated). The encryption decryption apparatus 100 and the encryption / decryption apparatuses 310 and 410 may have the rules promised to each other at the time of updating, and thus, at the same time, a plurality of The key can be updated.

In this case, a plurality of keys can be generated based on the random number generated by the random number generation unit 160. In this case, When the key is updated, the seed transmitted to the random number generating unit 160 is transmitted to the random number generating unit 160 through a predetermined value known between the encryption / decryption apparatus 100 and the encryption / decryption apparatuses 310 and 410, for example, It can be key. That is, the encryption / decryption apparatus 100 and the encryption / decryption apparatuses 310 and 410 generate the plurality of keys with the same seed for updating the keys, and use the generated keys for updating. Therefore, even if a plurality of keys are updated, the encryption / decryption apparatus 100 and the encryption / decryption apparatuses 310 and 410 can share a plurality of keys having the same value.

The encryption / decryption unit 130 encrypts the data. In this case, the data to be encrypted may be data input by the user 10 through the input unit 210, but the present invention is not limited thereto. For example, when the user 10 inputs information for account transfer (account number, amount to be transferred, password, etc.) through the input unit 210, the encryption / decryption unit 130 can encrypt such information.

Let's take a closer look at the encryption process. The first key, which is one of the plurality of keys stored in the key storage unit 110, is selected. The subject selecting the first key may be the key storage unit 110 or the encryption / decryption unit 130. The encryption / decryption unit 130 encrypts data to be encrypted based on the first key. Here, a cryptographic algorithm for encrypting data based on the first key can use a conventionally known cryptographic algorithm, which can be stored in a ROM not shown in Fig. The encrypted data based on the first key is decryptable only by the first key.

The encryption / decryption unit 130 decrypts the encrypted data received from the server 300 or the security management apparatus 400 by the terminal device 200, and the algorithm for decrypting the encrypted data may also be stored in the above-described ROM. In more detail, the encryption / decryption unit 130 decrypts the encrypted data using a key, which is one of the plurality of keys stored in the key storage unit 110. [

Hereinafter, the encryption process and the decryption process will be described in more detail.

First, the encryption / decryption unit 130 generates a key identifier (also referred to as a control block) for identifying a key used for encryption. The generated key identifier is encrypted based on any one of the keys (the first key) together with the data to be encrypted.

Here, the key identifier will be described with reference to Figs. 5A and 5B. 5A is a diagram showing combined data in which a key identifier and data are combined. Referring to FIG. 5A, the key identifier 122 may be composed of a predetermined number, for example, n bits. These n bits may be filled in by the promised rules that the encryption / decryption apparatus 100 and the encryption / decryption apparatus 310 and 410 know each other. FIG. 5B is a view conceptually showing that n bits constituting the key identifier are filled in by these promised rules. Hereinafter, these promised rules will be discussed in more detail.

A specific value is assigned to a specific position of n bits using at least two predetermined keys that are known between the encryption / decryption apparatus 100 and the encryption / decryption apparatuses 310 and 410 among the plurality of keys. For example, the encryption / decryption apparatus 100 and the encryption / decryption apparatuses 310 and 410 generate key identifiers using 50 keys, that is, first to 50th keys, as two or more predetermined keys among the plurality of keys Suppose we know that If a value obtained by performing a modulo operation on the first key by n is a first value and a value obtained by performing a modulo operation on a second key by 2 is a second value, 2 < / RTI > Next, if a value obtained by performing a modulo operation on the third key by n is a third value and a value obtained by performing a modulo operation on the fourth key by 2 is a fourth value, then the third bit of the n bits To the fourth value. In this manner, 50 keys are used to assign specific values to specific positions of n bits. At this time, if another value is to be assigned to a position to which the value has already been assigned, the assigned value is assigned to the next position. Thereafter, there may be a bit among n bits that is not assigned a value. The bits generated by the random number generator 160 are allocated to the bits to which the values are not allocated. Here, according to the embodiment, n bits may be first assigned a random number, and then a value may be assigned using at least two keys.

FIG. 5B is a conceptual diagram illustrating generation of a key identifier by the above-described process. 5B, a bit to which a value is assigned by using at least two keys among n bits is represented by b, and a bit to which a random number generated by the random number generation unit 160 is allocated is represented by a.

The encryption method has been described so far. According to the embodiment, not only data but also counters can be combined and encrypted when encrypting. In more detail, data according to the input of the user 10 transmitted from the input unit 210 may be encrypted together with the key identifier and the counter.

As to the counter, the identification value is assigned to each of at least two input keys included in the input unit 210, as described above. When the input key is input by the user 10, the identification value corresponding to the input key is transmitted to the encryption / decryption unit 130. The encryption / decryption unit 130 may have a counter for counting the number of times the identification value is transmitted from the input unit 210 for each input key. Each time the identification value is transmitted, the value of the counter assigned to the corresponding identification value increases. For example, a counter is assigned to each of the input keys of the numbers '1' to '9', and each counter has a counter corresponding to the number '9' from the number of times the identification value corresponding to the number '1' And has the number of times the identification value is input as its value. Each time the identification value is input, the value of the counter assigned to the identification value increases. Incremented values can be defined by predefined or predefined algorithms.

By using such a counter, even if the same input key is repeatedly input and the input key repeatedly input is encrypted using the same key among a plurality of keys, the generated encrypted data can be prevented from being the same. For example, in the case where the input key inputted by the user 10 is 'A' and the input key is encrypted based on the first key, the input key inputted by the user 10 after this is 'A' And differs from the encrypted data in the case where the input key is again encrypted based on the first key and the counter. Therefore, even when the same key is repeatedly input, the encrypted data is generated so as not to be the same, so that it is possible to prevent a third party such as a hacker from recognizing the pattern of the encrypted data by repeated input of the same input key.

In addition, the data according to the input of the user 10 can be transmitted to the server 300 by encrypting not only the key identifier and the counter but also the authentication mark. Referring to the authentication mark, the authentication mark is a kind of bit sequence promised among the encryption / decryption devices 100, 310, and 410. Such an authentication mark may be placed between the data and the counter. An authentication sign is a means by which the recipient of the data is aware that the received data has been received normally. For example, if the encrypted data is modulated in the process of being transmitted / received due to a communication error or the like, the value of the authentication mark may also change. Accordingly, the receiver can check whether the data including the encrypted data is normally transmitted or not by checking the authentication mark.

Each time the user 10 presses the input key, the encryption / decryption unit 130 encrypts the identification value corresponding to the input key one by one. The communication unit 220 transmits the encrypted data to the server 300, And so on, but this is merely an example, so the idea of the present invention is not limited thereto. The encryption / decryption unit 130 may combine a plurality of identification values and encrypt them all at once. For example, when at least two input keys are input at the same time, when a plurality of input keys are input in the predefined order, or when a special key is separately pressed in the input unit 210, When a plurality of input keys are input, a plurality of identification values may be combined and encrypted at once.

Next, the process of decrypting will be described.

The encryption / decryption unit 130 separates the encrypted key identifier part from the encrypted data encrypted by the encryption / decryption devices 310 and 410. [ The decrypted key identifier is decrypted using the plurality of keys stored in the key storage unit 120, respectively. (Or known) key identifier only for the bit position b where the value is assigned to the decoded result. As a result of the comparison, if the same value is found for b, the bit position to which the value is assigned, the key used to decrypt the encrypted key identifier is regarded as the key used for encryption. Therefore, the encryption / decryption unit 130 decrypts the remaining part of the encrypted data using the key considered to be used for encryption. Here, since the point at the bit position a is a random number, it is not compared.

When encrypting and decrypting data using the key identifier in this way, the malicious agent must know all of the plurality of keys, and all of the methods described above that are used when generating at least two keys and key identifiers used to generate the key identifier The encrypted data can be decrypted. However, as described above, since the plurality of keys are shared when the encryption / decryption apparatus 100 is physically connected to the encryption / decryption apparatuses 310 and 410, there is no fear of being deodorized / leaked by the hacker. In addition, since the program for generating the key identifier is planted in the ROM or the like during the initial production process of the encryption / decryption apparatus 100 or the encryption / decryption apparatus 310 or 410, it is also impossible for the hacker to approach the communication and to find out .

On the other hand, the encryption method and the decryption method described above are also performed in the encryption / decryption devices 310 and 410 as well. Accordingly, the encrypted data encrypted by the encryption / decryption apparatuses 310 and 410 can be decrypted by the encryption / decryption apparatus 100, and the data encrypted by the encryption / decryption apparatus 100 is decrypted by the encryption / decryption apparatuses 310 and 410 It is possible. In addition, the encryption / decryption unit 130 may be embodied by a ROM that stores instructions programmed to perform the above-described functions, and a microprocessor that executes such instructions.

Referring to FIG. 4, the port unit 110 and the encryption / decryption unit 130 are connected through a data bus 115. The data bus 115 is a path through which data is transmitted and received. Encrypted data or unencrypted data is transferred between the port unit 110 and the encryption / decryption unit 130 via the data bus 115.

In addition, the encryption / decryption unit 130 and the key storage unit 120 are connected to each other via a key bus 125. The encryption / decryption unit 130 receives the key from the key storage unit 120 and encrypts or decrypts the data.

Hereinafter, the encryption / decryption unit 130 encrypts data. The encryption / decryption unit 130 receives data to be encrypted from the port unit 110 and also receives a key to be used for encryption from the key storage unit 120. The encryption / decryption unit 130 encrypts the data using the key, and then transmits the encrypted data to the port unit 110.

That is, there is no path through which the key stored in the key storage unit 120 is transmitted to the outside through the port unit 110. In addition, the key storage unit 110 can not be directly accessed from the outside through the port unit 110. Accordingly, the key stored in the key storage unit 120 is not disclosed to the outside, and a hacker or the like can not seize the key stored in the key storage unit 120 by communication.

FIG. 6A is an exemplary diagram illustrating a process in which such a request is executed in the system shown in FIG. 1A, for example, if the user's request is a financial service.

A user 10 who wants to receive a financial service or the like from the server 300 inputs data related to the financial service through the input unit 210 of the terminal device 200 (S100). Data input by the user 10 is transferred from the input unit 210 to the control unit 230 and displayed on a display unit (not shown) of the terminal device 200. In addition, the data inputted by the user 10 is transmitted to the encryption / decryption unit 130 of the encryption / decryption apparatus 100.

The encryption / decryption unit 130 encrypts data received from the input unit 210 to generate encrypted data (S110).

The encrypted data generated in step S110 is transmitted to the server 300 through the communication unit 220 of the terminal device 200 (S120). The encryption / decryption apparatus 310 of the server 300 decrypts the received encrypted data (S130). In addition, the server 300 confirms whether there is no abnormality in the data transmission / reception process based on the authentication mark of the decrypted data. If there is no abnormality, the server 300 executes the request of the user 10 based on the data (S140).

The input of the user 10 transmitted from the input unit 210 to the encryption / decryption apparatus 100 is encrypted by the encryption / decryption apparatus 100 regardless of the control unit 230. In addition, as has been described, the encrypted data encrypted by the encryption / decryption apparatus 100 is not decryptable by a malicious code or other third party, and thus it is also impossible to modulate the encrypted data. Accordingly, the encrypted data encrypted by the encryption / decryption apparatus 100 is transmitted to the server 300 through the communication unit 220 in a state that the encrypted data is not modulated. That is, since the encrypted data transmitted to the server 300 is not tampered, an accident such as a financial transaction accident or personal information disclosure by the infected terminal device 200 or a third party can be blocked in advance.

FIG. 6B is an exemplary diagram illustrating a process in which the request is a financial service and the request is executed in a system including the security management apparatus shown in FIG. 1B.

A user 10 who wishes to receive a financial service or the like from the server 300 inputs data related to the financial service through the input unit 210 of the terminal 200 in operation S200. Data input by the user 10 is transferred from the input unit 210 to the control unit 230 and displayed on a display unit (not shown) of the terminal device 200. In addition, the data inputted by the user 10 is transmitted to the encryption / decryption unit 130 of the encryption / decryption apparatus 100.

The encryption / decryption unit 130 encrypts data received from the input unit 210 to generate encrypted data (S210).

The encrypted data generated in step S210 is transmitted to the security management apparatus 400 through the communication unit 220 of the terminal device 200 (S220). The encryption / decryption unit 410 of the security management apparatus 400 decrypts the received encrypted data (S230). In addition, the security management apparatus 400 interprets the decrypted data to determine what financial service the user 10 requested to the server 300. Thereafter, the encryption / decryption unit 410 encrypts the request again (S240).

The encrypted data generated in step S240 is transmitted to the server 300 (S250). The encryption / decryption apparatus 310 of the server 300 decrypts the received encrypted data (S260). In addition, the server 300 confirms whether there is no abnormality in the data transmission / reception process based on the authentication mark of the decrypted data. If there is no abnormality, the server 300 executes the request of the user 10 based on the data (S270).

The input of the user 10 transmitted from the input unit 210 to the encryption / decryption apparatus 100 is encrypted by the encryption / decryption apparatus 100 regardless of the control unit 230. In addition, as has been described, the encrypted data encrypted by the encryption / decryption apparatus 100 is not decryptable by a malicious code or other third party, and thus it is also impossible to modulate the encrypted data. Therefore, the encrypted data encrypted by the encryption / decryption apparatus 100 is transmitted to the security management apparatus 400 through the communication unit 220 in a state that the encryption data is not modulated. That is, since the encrypted data transmitted to the security management apparatus 400 is not tampered, an accident such as a financial transaction accident or personal information disclosure by the infected terminal device 200 or a third party can be blocked in advance.

7 is a diagram illustrating each step of the encryption / decryption method according to an embodiment. Each step shown in FIG. 7 can be performed by the above-described encryption / decryption apparatus.

Referring to FIG. 7, a step S300 of receiving data input by the user 10 from the input unit 210 is performed.

Thereafter, step S310 is performed to encrypt the data received from the input unit 210 using the first key, which is one of a predetermined plurality of keys.

Thereafter, the step of transmitting the encrypted encrypted data to the communication unit 220 (S320) is performed.

Here, the encryption / decryption method shown in FIG. 7 is the same as that performed by the encryption / decryption apparatus described above, so a detailed description of the encryption / decryption method will be omitted.

Combinations of each step of the flowchart and each block of the block diagrams appended to the present invention may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

The above description is merely illustrative of the technical idea, and various modifications and changes may be made without departing from the essential characteristics of a person skilled in the art to which the present invention belongs. Therefore, the embodiments disclosed in the present invention are intended to be illustrative rather than limiting, and the scope of technical thought is not limited by these embodiments. The scope of protection is to be interpreted by the following claims, and all technical ideas within the scope of equivalents should be interpreted as being included in the scope of the right.

100: encryption / decryption device
200: terminal device
300: server
400: security management device

Claims (11)

1. An encryption / decryption apparatus included in a terminal apparatus,
The terminal device further includes a communication unit for performing communication with the outside and an input unit for receiving data from a user of the terminal device,
The encryption /
A connection unit that is connected to the connection unit included in the other device,
A key storage unit for generating and storing a plurality of keys when the connection unit of the encryption / decryption unit is connected to the connection unit of the other encryption / decryption device, and for sharing the plurality of keys with the customer side encryption / decryption device;
The input unit receives the data input from the user from the input unit, generates an identifier based on at least two keys among the plurality of keys, and combines the received data with the identifier An encryption / decryption unit for generating the combined data, receiving the first key, which is one of the plurality of keys, from the key storage unit, and encrypting the combined data based on the received first key,
And a port unit that receives the encrypted combined data from the encryption / decryption unit and transfers the encrypted combined data to the communication unit,
Wherein the identifier comprises:
Wherein the other encryption decryption apparatus determines whether the first key used for encrypting the combined data is a key among the plurality of keys
An encryption / decryption device.
The method according to claim 1,
Wherein if the input unit includes at least two input keys and each of the at least two input keys is assigned an identification value corresponding thereto,
The encryption /
Encrypting an identification value corresponding to an input key input by the user from among the at least two input keys using the first key
An encryption / decryption device.
3. The method of claim 2,
Wherein each of the at least two input keys is assigned a counter whose value is incremented each time a corresponding input key is input,
The encryption /
An identification value corresponding to the input key input by the user and a counter allocated to the input key input by the user are encrypted using the first key
An encryption / decryption device.
The method according to claim 1,
The encryption /
The key storage unit is connected to the key storage unit via a key bus and performs the encryption based on the key received from the key storage unit via the key bus
An encryption / decryption device.
5. The method of claim 4,
The port unit is connected to the encryption / decryption unit through a data bus,
The encryption / decryption unit performs encryption and transmits the encryption result to the communication unit of the terminal device through the port unit via the data bus
An encryption / decryption device.
delete delete The method according to claim 1,
And a random number generator for generating a random number,
Wherein the key identifier comprises:
Wherein at least a part of bits of the plurality of bits are defined by the at least two keys among the plurality of keys and the remaining bits of the plurality of bits are assigned to the generated random number Valued by
An encryption / decryption device.
delete The method according to claim 1,
Further comprising a protection unit that recognizes that an action defined as abnormal is applied to the encryption / decryption device, and deletes the key when it is recognized that the action is applied
An encryption / decryption device.
1. An encryption / decryption method performed by an encryption / decryption apparatus included in a terminal apparatus,
The terminal apparatus further includes a communication unit for communicating with the outside and an input unit for receiving data from a user of the terminal apparatus,
Receiving the data received from the user by the input unit from the input unit,
Encrypting the received data using a first key, which is one of a predetermined plurality of keys;
And transmitting the encrypted data to the communication unit,
Wherein the predetermined plurality of keys include:
The apparatus is generated and stored when the encryption / decryption apparatus is connected to the other encryption / decryption apparatus through a connection unit included in the encryption / decryption apparatus, and is shared with the other encryption / decryption apparatus,
Wherein the encrypting comprises:
Generating an identifier based on at least two keys among the plurality of keys, combining data received from the input unit with the identifier to generate combined data, and transmitting, from the key storage unit, 1 key, encrypts the combined data based on the received first key,
Wherein the identifier is used by the other encryption / decryption apparatus to determine which one of the plurality of keys is the first key used to encrypt the combined data
Encryption method.

Images