KR102153317B1 - Encryption apparatus based on quantum random number - Google Patents

Abstract

The present invention relates to a quantum random number sequence-based encryption device, comprising: a quantum random number generator for generating a quantum random number sequence, a security area accessible through a specific access right, and a memory divided into a general area storing at least one application program And accessing the security area based on the specific access right to obtain an encryption key or a decryption key, and receiving a quantum random number from the quantum random number generator to generate a random number based on any one of a plurality of encryption algorithms, electronic signature, and key. It includes a processor that performs matching or authentication. Accordingly, the present invention can enhance security by operating an encryption device based on a quantum random number sequence generated by a quantum random number generator.

Description

Encryption device based on quantum random number sequence {ENCRYPTION APPARATUS BASED ON QUANTUM RANDOM NUMBER}

The present invention relates to a quantum random number sequence-based encryption technology, and more particularly, a quantum random number sequence-based encryption device capable of enhancing security by operating an encryption device based on a quantum random number sequence generated by a quantum random number generator. It is about.

Recently, as the Internet of Things (IoT) is widely spread, the importance of IoT security is being emphasized, and the importance of cryptographic technology using a quantum random number generator is increasing. Quantum random numbers correspond to a system of random numbers generated by extracting from the physical system of pure natural phenomena, not humans. Quantum mechanics refers to uncertain phenomena observed in the microscopic world of less than 10 nanometers (nm, 1 billionth of a meter). Unlike predictable physical phenomena that can be observed in everyday life, quantum mechanics has a characteristic that depends on probability. Utilizes quantum mechanical phenomena.

Korean Patent Laid-Open Publication No. 10-2008-0025151 (2008.03.19) relates to a quantum random number generator, wherein an optical coupler includes an input port and two output ports; A single photon source connected to the input port and emitting a single photon transmitted from the input port to the output ports; A single photon detector connected to each of the two output ports to detect a photon coming out of one of the output ports; And means for generating random numbers according to the detection result of the single photon detector.

Korean Patent Laid-Open Publication No. 10-2003-0085094 (2003.11.01) relates to an encryption device. A random number sequence is generated in advance by a data hiding function f8 that generates a random number sequence and stored in a random number column storage unit (buffer). When data (message) is input, the random number column stored in the random number column storage unit is obtained and the data (message) is encrypted in the exclusive OR operation circuit to create a ciphertext, or when the ciphertext is input, the exclusive OR operation circuit The random number sequence is read from the random number sequence storage unit (buffer) and decoded into data (message).

Korean Patent Application Publication No. 10-2008-0025151 (2008.03.19) Korean Patent Application Publication No. 10-2003-0085094 (2003.11.01)

An embodiment of the present invention is to provide a quantum random number sequence-based encryption apparatus capable of enhancing security by performing an encryption process using a quantum random number sequence generated by a quantum random number generator.

An embodiment of the present invention is to provide a quantum random number sequence-based encryption device capable of performing a random number generation, electronic signature, or key generation process based on a noise source and a quantum random number required in a cryptographic operation process.

An embodiment of the present invention is to provide a quantum random number sequence-based encryption device capable of enhancing security by limiting encryption algorithms used for memory access and encryption/decryption.

Among the embodiments, a quantum random number sequence-based encryption device includes a quantum random number generator for generating a quantum random number sequence, a memory divided into a security area accessible through a specific access right and a general area storing at least one application program, and By accessing the security area based on the specific access right, an encryption key or a decryption key is obtained, and a quantum random number is received from the quantum random number generator to generate a random number based on any one of a plurality of encryption algorithms, digital signature, and key matching. Or a processor that performs authentication.

The memory is divided into a first secure partition accessible through a first access right and a second secure partition accessible through a second access right requiring higher security than the first access right. It can include areas.

The memory may store an encryption key in the first secure partition and a decryption key in the second secure partition.

The processor may perform the electronic signature on input and output data related to the at least one application program.

The processor may generate the encryption key and the decryption key based on at least one quantum random number selected from the quantum random number sequence and store the generated encryption key and the decryption key in the secure area.

The processor may generate the random number by selecting any one of the plurality of DRBGs (Deterministic Random Bit Generators) based on the quantum random number.

The processor may store the random number generation, the electronic signature, the key match, or a noise source generated during an authentication process in a third security partition of the security area.

The processor may provide the noise source as an input to the quantum random number generator and perform the authentication on the entity or message based on the output quantum random number.

The disclosed technology can have the following effects. However, since it does not mean that a specific embodiment should include all of the following effects or only the following effects, it should not be understood that the scope of the rights of the disclosed technology is limited thereby.

The encryption apparatus based on a quantum random number sequence according to an embodiment of the present invention may perform a random number generation, an electronic signature, or a key generation process based on a noise source and a quantum random number required in a cryptographic operation process.

The encryption device based on a quantum random number sequence according to an embodiment of the present invention may enhance security by limiting encryption algorithms used for memory access and encryption/decryption.

1 is a diagram illustrating an encryption apparatus based on a quantum random number sequence according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating functional elements of the processor in FIG. 1.
3 is a flowchart illustrating a quantum random number sequence-based encryption process performed by the encryption device of FIG. 1.
4 is a flowchart illustrating an encryption process performed in an encryption apparatus based on a quantum random number sequence according to an embodiment of the present invention.
5 is a diagram illustrating a configuration for combining an encryption device based on a quantum random number sequence with an external device according to an embodiment of the present invention.

Since the description of the present invention is merely an embodiment for structural or functional description, the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, since the embodiments can be variously changed and have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea. In addition, since the object or effect presented in the present invention does not mean that a specific embodiment should include all of them or only those effects, the scope of the present invention should not be understood as being limited thereto.

Meanwhile, the meaning of terms described in the present application should be understood as follows.

Terms such as "first" and "second" are used to distinguish one component from other components, and the scope of rights is not limited by these terms. For example, a first component may be referred to as a second component, and similarly, a second component may be referred to as a first component.

When a component is referred to as being "connected" to another component, it should be understood that although it may be directly connected to the other component, another component may exist in the middle. On the other hand, when it is mentioned that a certain component is "directly connected" to another component, it should be understood that no other component exists in the middle. On the other hand, other expressions describing the relationship between the constituent elements, that is, "between" and "just between" or "neighboring to" and "directly neighboring to" should be interpreted as well.

Singular expressions are to be understood as including plural expressions unless the context clearly indicates otherwise, and terms such as “comprise” or “have” refer to implemented features, numbers, steps, actions, components, parts, or It is to be understood that it is intended to designate that a combination exists and does not preclude the presence or addition of one or more other features or numbers, steps, actions, components, parts, or combinations thereof.

In each step, the identification code (for example, a, b, c, etc.) is used for convenience of explanation, and the identification code does not describe the order of each step, and each step has a specific sequence clearly in context. Unless otherwise stated, it may occur differently from the stated order. That is, each of the steps may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be embodied as computer-readable codes on a computer-readable recording medium, and the computer-readable recording medium includes all types of recording devices storing data that can be read by a computer system. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage devices.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the field to which the present invention belongs, unless otherwise defined. Terms defined in commonly used dictionaries should be construed as having meanings in the context of related technologies, and cannot be construed as having an ideal or excessive formal meaning unless explicitly defined in the present application.

Unlike private key cryptography, public key cryptography allows the sender and receiver to perform secret communication using different keys. The sender can encrypt data using the information corresponding to the receiver's public key and transmit it through the network, and the receiver can restore the plaintext by decrypting the data encrypted with the private key corresponding to his public key. Public key cryptography has the advantage of enabling secure communication through cryptography even if the key is not shared with other users.

In the case of using public key encryption, each user can disclose a key to be used for transmission to himself/herself and secretly hold a key capable of decrypting information encrypted with the public key information. Therefore, although anyone can encrypt public key cryptography, it has the characteristic that only the party with the private key corresponding to the public key can decrypt it. Representative public key cryptographic algorithms include RSA (Rivest, Shamir and Adleman), ElGamal, ECC (Elliptic Curve Cryptosystem), and electronic signatures.

Symmetric key cryptography has the characteristic that the encryption key used for encryption and the decryption key used for decryption are the same, and this key must be managed as a secret so that it is not exposed to anyone other than the sender and receiver. Symmetric key cryptography is called secret-key cryptography in the sense that the key must be kept secret. Symmetric key cryptography has the advantage of constructing an efficient cryptographic system because the cryptographic operation speed is fast.

Symmetric key cryptography has a combination of simple substitution and transposition in the internal structure of the algorithm, so it is easy to develop an algorithm and can be operated quickly in a computer system. Since the symmetric key cryptography needs to share the same key between the sender and the receiver, there is a difficulty in generating, maintaining, and managing many keys when exchanging information with many people. Symmetric key ciphers can be classified into block ciphers and stream ciphers depending on how data is converted. Typical block ciphers include DES (Data Encryption Standard), AES (Advanced Encryption Standard), SEED, HIGHT (HIGh security and light weigHT), LEA (Lightweight Encryption Algorithm), ARIA, etc. Typical stream ciphers are A5/1, A5 /2, A5/3, etc.

1 is a diagram illustrating an encryption apparatus based on a quantum random number sequence according to an embodiment of the present invention.

Referring to FIG. 1, an encryption device based on a quantum random number sequence (hereinafter, referred to as an encryption device) 100 may include a memory 110, a quantum random number generator 130, and a processor 150.

The memory 110 is implemented as a nonvolatile memory such as a solid state disk (SSD) or a hard disk drive (HDD), and may include an auxiliary storage device used to store all data necessary for the encryption device 100, and RAM A main memory device implemented with volatile memory such as (Random Access Memory) may be included.

In an embodiment, the memory 110 may be divided into a security area accessible through a specific access right and a general area storing at least one application program. The security area may correspond to a specific area of the memory 110 for storing data whose confidentiality is to be guaranteed, and may be divided into a plurality of security partitions according to the security of the stored data. The secure partition may correspond to a partial area of the memory 110 that can be accessed only in an accessible state under the management of the processor 150.

The general area may correspond to the remaining area of the memory 110 in which data can be read and written by freely accessing without special access rights. The encryption device 100 may provide portability to the encryption device 100 by allowing at least one application program to be stored through the general area of the memory 110.

In one embodiment, the memory 110 has a first security partition that can be accessed through a first access right and a second security that can be accessed through a second access right that requires higher security than the first access right. It may include a security area divided by a partition. The security area of the memory 110 may be divided into a plurality of security partitions. The first security partition can be accessed only with the first access right, and the second security partition can be accessed only with the second access right. In addition, the second access right may require higher security than the first access right. Accordingly, data stored in the second security partition may correspond to data that needs to be more carefully protected than data stored in the first security partition.

In one embodiment, the memory 110 may store the encryption key in the first secure partition and the decryption key in the second secure partition. The encryption device 100 may perform random number generation, electronic signature, key matching, or authentication using a plurality of encryption algorithms. The encryption key and the decryption key may correspond to a secret key used when the encryption device 100 performs random number generation, digital signature, key matching, or authentication.

In one embodiment, the memory 110 may be implemented as physically independent hardware for the security area and the general area, and a plurality of partitions constituting the security area may be implemented as physically independent hardware. Accordingly, even if the second access right has higher security than the first access right, it may be impossible to access the first secure partition through the second access right.

The quantum random number generator 130 may correspond to a hardware chip capable of providing a quantum random number sequence as an output. For example, the quantum random number generator 130 may configure the encryption device 100 as a hardware chip having a size of 3 (cm) * 3 (cm) or 4 * 4. The quantum random number generator 130 corresponds to a device that generates a random number using quantum mechanical properties, and more specifically, may be implemented by using randomness of light or natural decay of radioactive isotopes.

In an embodiment, the quantum random number generator 130 may be implemented to generate a quantum random number through an independent operation without a separate external noise source, and may be implemented to generate a quantum random number using an external noise source. The quantum random number generator 130 may provide a sequence of quantum random numbers so that the encryption device 100 can use it to generate random numbers, electronic signatures, key matching, or authentication.

The processor 150 can execute the encryption procedure based on the quantum random number sequence of the encryption device 100, manage the memory 110 that is read or written throughout the process, and can manage the volatile memory in the memory 110 You can schedule the synchronization time between the and nonvolatile memory. The processor 150 may control the overall operation of the encryption device 100 and may be electrically connected to the memory 110 and the quantum random number generator 130 to control data flow between them. The processor 150 may be implemented as a micro controller unit (MCU) of the encryption device 100.

In an embodiment, the processor 150 may control access to the secure area of the memory 110. When a specific process requests access to the security area of the memory 110, the processor 150 may determine whether to allow access by checking the access rights of the process. More specifically, when a specific process requests access to the security area of the memory 110, the processor 150 receives the access request, determines a specific area on the security area subject to the access request, and secures the specific area. Can judge sex. The processor 150 may determine access rights necessary for access to the specific area based on the security of the specific area, check whether the process requesting access has access rights, and finally determine whether to access the corresponding process. .

If the process requesting the access does not have the necessary access rights for accessing the security area, the processor 150 may determine the need for access to the process and grant the access rights. For example, the processor 150 can check the identification information of the process requesting access to the security area, the location and time of creation, etc. for granting access rights, and utilize information such as the program or user account that created the process. So you can judge the need for access. Detailed functions of the processor 150 will be described in more detail in FIG. 2.

FIG. 2 is a block diagram illustrating functional elements of the processor in FIG. 1.

Referring to FIG. 2, the processor 150 may include an encryption key obtaining unit 210, a quantum random number receiving unit 230, an encryption operation performing unit 250, and a control unit 270.

The encryption key acquisition unit 210 may obtain an encryption key or a decryption key by accessing the security area of the memory 110 based on a specific access right. The encryption key or decryption key may correspond to a secret key used in an encryption algorithm, and the encryption key may correspond to a term including both an encryption key or a decryption key. The encryption key acquisition unit 210 may access the security area of the memory 110 through access rights of a process for performing random number generation, electronic signature, key matching, or authentication. The access right of the process may be automatically granted when the corresponding process is created, or may be newly granted by the processor 150 based on the access point of the memory 110.

The encryption key acquisition unit 210 may determine an encryption key or a decryption key stored in the security area of the memory 110 based on the type of encryption algorithm used by the process of performing random number generation, electronic signature, key matching, or authentication. In order to obtain the corresponding encryption key, it is possible to request access right. When there is a request for granting access permission, the processor 150 may determine whether to grant access permission based on the location of the security area of the memory 110 requested for access, process information, and encryption algorithm information.

In one embodiment, the encryption key acquisition unit 210 generates an encryption key and a decryption key based on at least one quantum random number selected from the quantum random number sequence received by the quantum random number receiving unit 230 to secure the memory 110 Can be saved in the area. When using the encryption algorithm for the first time, the encryption key obtaining unit 210 may generate a new encryption key or a decryption key based on a corresponding time point, and perform encryption or decryption based on the generated encryption key.

The encryption key acquisition unit 210 may utilize a quantum random number generated by the quantum random number generator 130 to generate a new encryption key. The encryption key acquisition unit 210 may use not only quantum random numbers but also other noise sources to generate the encryption key. The noise source may correspond to an unpredictable physical source that can be used as a seed for random number generation, and may correspond to, for example, time information, keyboard, mouse, memory value, network status, thermal noise, and the like.

The quantum random number receiver 230 may receive a quantum random number sequence from the quantum random number generator 130. The quantum random number receiver 230 may utilize the quantum random number sequence in order, and may select and use an arbitrary quantum random number from the quantum random number sequence. In an embodiment, the quantum random number receiver 230 may select a quantum random number according to a predetermined period from a sequence of quantum random numbers, and in this case, the predetermined period may mean a predetermined interval between quantum random numbers. That is, the quantum random number receiver 230 may select and use only quantum random numbers separated by a predetermined interval from the quantum random number sequence.

In an embodiment, the quantum random number receiver 230 may select and use a quantum random number according to a sampling period calculated through the following equation from a quantum random number sequence.

[Equation]

Here, P denotes a sampling period, M denotes a memory address storing an encryption key, Tsec denotes a second (sec) at a time point of using an encryption algorithm, and k denotes a sampling period constant. The sampling period P may correspond to the interval of the quantum random number in the quantum random number sequence. For example, when P = 10, the first, 11th, and 21st quantum random numbers in the quantum random number sequence can be sampled and used. . Sampling period P is calculated using the address in the memory where the encryption key (encryption key or decryption key) used in the encryption algorithm using quantum random numbers is stored and the logarithm of the square of the second (sec) at the time the encryption algorithm is used. Can be. The sampling period constant k may be preset in the encryption device 100.

The encryption calculation unit 250 may generate a random number, electronic signature, key match, or authentication based on any one of a plurality of encryption algorithms. The encryption operation performing unit 250 may generate random numbers, electronic signatures, key matching, or authentication based on encryption algorithms, encryption keys, and quantum random numbers. In one embodiment, the cryptographic operation unit 250 may separate and use cryptographic algorithms used for random number generation, digital signature, key matching, or authentication, and cryptographic algorithms used for decryption, signature generation, or key generation. Can be more restricted than the cryptographic algorithms used for encryption, signature verification, or key authentication. Considering that the decryption key used for decryption requires higher security than the encryption key, the encryption operation execution unit 250 restricts the encryption algorithm used for decryption to a specific number, thereby storing only a limited number of decryption keys for security. Sex can be guaranteed.

In an embodiment, the cryptographic operation unit 250 may generate a random number, electronic signature, key match, or authentication based on any one of a population of cryptographic algorithms composed of a Korea Cryptographic Module Validation Program (KCMVP). Here, KCMVP falls under the Korean cryptographic module verification system and is being implemented by the National Intelligence Service to secure the safety of commercial security products introduced to the state and public institutions. The cryptographic operation execution unit 250 may enhance the security of the cryptographic device 100 by performing random number generation, electronic signature, key matching, or authentication using only a cryptographic algorithm population composed of cryptographic algorithms that have passed KCMVP verification. .

In one embodiment, the cryptographic operation unit 250 is a KCMVP cryptographic algorithm population composed of cryptographic algorithms that have passed KCMVP (Korea Cryptographic Module Validation Program) verification based on a quantum random number and cryptographic algorithms that have not performed KCMVP verification. Any one of the configured general cryptographic algorithm population may be determined, and random number generation, digital signature, key matching, or authentication may be performed based on the cryptographic algorithm belonging to the corresponding cryptographic algorithm population. A population of KCMVP encryption algorithms and a general encryption algorithm may be stored and managed in the processor 150, and may be stored and managed in a general area of the memory 110.

In an embodiment, the cryptographic operation unit 250 may select a first quantum random number from the quantum random number sequence received by the quantum random number receiver 210 and determine a specific cryptographic algorithm population based on the first quantum random number. . The cryptographic operation unit 250 may select a second quantum random number from a quantum random number sequence and determine a specific cryptographic algorithm within a specific cryptographic algorithm population determined based on the second quantum random number. The cryptographic operation unit 250 may generate a random number, electronic signature, key match, or authentication based on the determined specific cryptographic algorithm.

In one embodiment, the cryptographic operation unit 250 may select the first quantum random number from the quantum random number sequence received by the quantum random number receiver 210 to determine the first encryption algorithm population, but the first encryption algorithm population is selected from the quantum random number sequence. 2 Depending on the quantum random number, random number generation, digital signature, key matching, or authentication may be performed by selecting a specific algorithm from among the remaining cryptographic algorithm population rather than the first cryptographic algorithm population. The first cryptographic algorithm population may correspond to a cryptographic algorithm population determined by the cryptographic operation unit 250 based on a first quantum random number among the KCMVP cryptographic algorithm population and the general cryptographic algorithm population.

The first quantum random number is a criterion for selecting a cryptographic algorithm population, and the second quantum random number corresponds to a criterion for selecting a cryptographic algorithm in the cryptographic algorithm population, but when the second quantum random number satisfies a specific condition, the cryptographic operation execution unit 250 ) May select a cryptographic algorithm from a cryptographic algorithm population other than the cryptographic algorithm population selected based on the first quantum random number. Here, the specific condition corresponds to a case in which the second quantum random number falls within a specific range preset by the encryption device 100 or the absolute value of the difference between the first quantum random number and the second quantum random number falls within a specific range. can do.

In an embodiment, the cryptographic calculation unit 250 may perform an electronic signature on input and output data related to at least one application program stored in the general area of the memory 110. The encryption device 100 may receive external data as an input, digitally sign the external data, and output a result of adding the digital signature to the external data. In addition, the encryption device 100 may electronically sign input and output data of an application program stored and operated in the memory 110 included therein and provide it to the outside of the encryption device 100.

Here, the digital signature may correspond to information in an electronic form attached to the corresponding electronic document or logically combined to be used to verify the signer and indicate that the signer has signed a specific electronic document. For example, the digital signature may correspond to conversion (encryption) of a hash value of an electronic document into a signer's private key. The digital signature may consist of a key generation algorithm that generates a public key pair, an algorithm that generates a signature using the signer's private key, and an algorithm that verifies the signature using the signer's public key.

In an embodiment, the cryptographic operation unit 250 may generate a random number by selecting any one of a plurality of cryptographic Deterministic Random Bit Generators (DRBGs) based on a quantum random number. The cryptographic operation unit 250 may use the quantum random number received by the quantum random number receiving unit 230 for random number generation, electronic signature, key matching, or authentication, but selects DRBG used for random number generation based on the quantum random number. You can also use it. In another embodiment, the cryptographic operation unit 250 generates a random number using a noise source selected based on a quantum random number among noise sources stored in the memory 110 and a DRBG selected based on a quantum random number among a plurality of DRBGs. I can.

In an embodiment, the cryptographic operation unit 250 may store a random number generation, an electronic signature, a key match, or a noise source generated during an authentication process in the third secure partition of the security area of the memory 110. Here, the third security partition may correspond to any one of a plurality of security partitions constituting the security area, is distinguished from the first security partition and the second security partition, and has lower security than the first access right. It may correspond to a secure partition that can be accessed through the required third access right. In another embodiment, the cryptographic operation unit 250 may store a random number generation, an electronic signature, a key match, or a noise source generated during an authentication process in a general area of the memory 110.

The cryptographic operation unit 250 may generate random numbers, electronic signatures, key matching, or authentication using both noise sources as well as quantum random numbers, and various noise sources generated in the cryptographic operation process are stored in a specific area of the memory 110. It can be stored and used in the next encryption operation process. The encryption operation performing unit 250 may delete the existing noise source stored in the third security partition and replace it with a new noise source, and may update the existing noise source by integrating the new noise source.

In an embodiment, the encryption operation execution unit 250 may access the third security partition of the security area of the memory 110 when the first access right or the second access right is granted. The third secure partition of the memory 110 can be accessed only when the third access right is granted, but in some cases, the first access right or the second access right having a higher security than the third access right is granted. If received, the third security partition can be accessed without the process of granting the third access right. Therefore, when the encryption operation unit 250 is granted access rights to the security area of the memory 110 during random number generation, electronic signature, key matching, or authentication process, the noise source stored in the third security partition can be accessed without a third access right. Can be used.

In an embodiment, the cryptographic operation unit 250 may provide a noise source to the quantum random number generator 130 as an input to perform authentication on an entity or message based on the output quantum random number. The quantum random number generator 130 may generate an independent quantum random number without an external noise source, and may generate a quantum random number using an external noise source. Accordingly, the cryptographic operation unit 250 may provide the noise source stored in the memory 110 to the quantum random number generator 130 to allow the quantum random number generator 130 to generate a quantum random number using the noise source.

Even if the quantum random number generator 130 generates an independent quantum random number, if an external noise source is provided as an input by the processor 150, it may be automatically switched to generate a quantum random number using the external noise source. In another embodiment, the encryption operation unit 250 may periodically input a noise source to the quantum random number generator 130 and perform authentication on an object or message based on the output quantum random number. For example, if the previous quantum random number is a quantum random number generated without a noise source at the time of using the quantum random number in the repeated encryption operation process, the cryptographic operation unit 250 provides the noise source to the quantum random number generator 130 and outputs the result. A quantum random number may be used, and when the previous quantum random number is a quantum random number generated using a noise source, a quantum random number independently generated through the quantum random number generator 130 may be used without providing a noise source.

The control unit 270 may control the overall operation of the processor 150 and may manage a control flow or data flow between the encryption key acquisition unit 210, the quantum random number receiving unit 230, and the cryptographic operation unit 250.

3 is a flowchart illustrating a quantum random number sequence-based encryption process performed by the encryption device of FIG. 1.

Referring to FIG. 3, the encryption device 100 may obtain an encryption key or a decryption key by accessing a security area based on a specific access right through the encryption key acquisition unit 210 of the processor 150 (step S310. ). The encryption apparatus 100 may receive a quantum random number sequence from the quantum random number generator 130 through the quantum random number receiving unit 230 of the processor 150 (step S330). The encryption apparatus 100 may generate a random number, electronic signature, key match, or authentication based on any one of a plurality of encryption algorithms through the encryption operation unit 250 of the processor 150 (step S350). .

4 is a flowchart illustrating an encryption process performed in an encryption apparatus based on a quantum random number sequence according to an embodiment of the present invention.

Referring to FIG. 4, random number generation, electronic signature, key matching, or authentication process performed in the encryption device 100 according to an embodiment of the present invention can be checked. The quantum random number generator 410 may provide a quantum random number sequence to the processor 430, and the processor 430 uses the quantum random number sequence to generate a random number, an electronic signature, an encryption key or a decryption key to be used for authentication. Can be created.

The processor 430 may store the generated encryption key or decryption key in a secure area of the memory 450. More specifically, the processor 430 may grant access rights to access the first security partition or the second security partition to the process of generating a random number, digital signature, key matching, or authentication. The encryption key may be stored in the first secure partition and the decryption key may be stored in the second secure partition according to the access rights granted by the processor 430. The processor 430 may control the second access right for accessing the second secure partition to have higher security than the first access right for accessing the first secure partition.

The processor 430 may perform an electronic signature, random number generation, key matching, or authentication using the quantum random number sequence received from the quantum random number generator 410 and the encryption key stored in the secure area of the memory 450. In an embodiment, the processor 430 may store a noise source generated in the encryption process in a secure area of the memory 450. The processor 430 may receive and use a quantum random number used for a random number generation, an electronic signature, a key match, or a cryptographic operation that is repeated in the authentication process from the quantum random number generator 410, and at the time of use of the quantum random number, A quantum random number generated based on the noise source may be used by providing the stored noise source to the quantum random number generator 410.

5 is a diagram illustrating a configuration for combining an encryption device based on a quantum random number sequence with an external device according to an embodiment of the present invention.

Referring to FIG. 5, an encryption device 510 according to an embodiment of the present invention may be implemented in the form of a hardware chip. In order to attach the encryption device 510 to an external system or device, a device in the form of a socket 530 may be fixed and coupled to one side of the external system or device, and the encryption device 510 is coupled to the socket 530. It can be attached to an external system or device. The combination method and configuration of the encryption device 510 and the socket 530 that can be seen in FIG. 5 corresponds to an embodiment for description, and does not necessarily correspond to this, and the encryption device 510 and the socket 530 are various It can be implemented in various appearances and configurations according to the coupling method.

Although described above with reference to preferred embodiments of the present invention, those skilled in the art will variously modify and change the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. You will understand that you can do it.

100: a quantum random number sequence based encryption device
110: memory 130: quantum random number generator
150: processor
210: encryption key acquisition unit 230: quantum random number reception unit
250: encryption operation execution unit 270: control unit
410: quantum random number generator 430: processor
450: memory
510: encryption device 530: socket

Claims (8)

A quantum random number generator that generates a quantum random number sequence;
A memory divided into a security area accessible through a specific access right and a general area storing at least one application program; And
Access to the security area based on the specific access right to obtain an encryption key or a decryption key, receive a quantum random number from the quantum random number generator, and generate a random number based on any one of a plurality of encryption algorithms, digital signature, and key matching Or a processor that performs authentication,
The memory includes a third security partition separated from an area storing the encryption key or the decryption key among the security areas,
The processor stores the random number generation, the digital signature, the key matching, or a noise source generated in the authentication process in the third security partition, and provides the noise source as an input to the quantum random number generator, and the at least one application program An encryption device based on a quantum random number sequence, characterized in that the electronic signature is performed on the related input and output data.
The method of claim 1, wherein the memory
Includes the security area divided into a first secure partition accessible through a first access right and a second secure partition accessible through a second access right requiring higher security than the first access right A quantum random number sequence-based encryption device, characterized in that.
The method of claim 2, wherein the memory
An encryption device based on a quantum random number sequence, comprising storing an encryption key in the first secure partition and a decryption key in the second secure partition.
delete The method of claim 1, wherein the processor
And generating the encryption key and the decryption key based on at least one quantum random number selected from the quantum random number sequence, and storing the encryption key and the decryption key in the secure area.
The method of claim 1, wherein the processor
An encryption apparatus based on a quantum random number sequence, characterized in that for generating the random number by selecting any one of the plurality of DRBGs based on the quantum random number.
delete The method of claim 1, wherein the processor
A quantum random number sequence-based encryption device, characterized in that the noise source is provided to the quantum random number generator as an input to perform the authentication on an object or message based on the output quantum random number.

Images