KR102295470B1 - Secure usb dongle for usb memory without security - Google Patents

Abstract

The present invention discloses a secure USB dongle for a USB memory without a security function. A secure USB dongle connected between a host and a USB memory to mediate transmission and reception of data according to an aspect of the present invention includes: a USB connector physically connected to the host and the USB memory to transmit and receive data; and maintaining data confidentiality by encrypting or decrypting the transmitted and received data, or manipulates/reversely manipulates the file system so that only an authorized user or owner can access the memory by intermittently controlling access to the USB memory from the host. a security setting unit;

Description

SECURE USB DONGLE FOR USB MEMORY WITHOUT SECURITY

The present invention relates to a secure USB dongle for a USB memory without a security function, and more particularly, a secure USB dongle for a USB memory without a security function that can ensure the confidentiality of data stored in a USB memory without a security function. is about

As data types become diversified and the amount of data increases, various storage devices are being developed. Among them, USB memory is one of the most used portable storage devices as a storage medium because it is light and small in size. However, when the USB memory is lost, an accident in which information stored in the memory is leaked may occur. In order to prevent such a problem, a software and hardware security USB memory in which a security element is added to the USB memory has been developed. However, such a secure USB memory is expensive compared to a conventional USB memory without a security function, and there is a problem that there is a vulnerability in which authentication information such as a password is exposed through reverse engineering.

Korean Patent Registration No. 10-1644925 (Announced on August 12, 2016)

The present invention has been proposed to solve the above problems. A USB without security function that separates the security function to safely protect the security module and provides data confidentiality by easily connecting a general USB memory without a security function. It aims to provide a secure USB dongle for memory.

Other objects and advantages of the present invention may be understood by the following description, and will be more clearly understood by an embodiment of the present invention. Further, it will be readily apparent that the objects and advantages of the present invention can be realized by the means and combinations thereof indicated in the claims.

A secure USB dongle that is connected between a host and a USB memory to mediate transmission and reception of data according to an aspect of the present invention for achieving the above object is a USB connector that is physically connected to the host and the USB memory to transmit and receive data ; and maintaining data confidentiality by encrypting or decrypting the transmitted and received data, or manipulates/reversely manipulates the file system so that only an authorized user or owner can access the memory by intermittently controlling access to the USB memory from the host. a security setting unit;

The security setting unit may include: an encryption unit that encrypts data input from the host through an encryption algorithm according to a preset protocol process when a data write request is input from the host; and a decryption unit that decrypts the encrypted data stored in the general USB memory through a decryption algorithm according to a preset protocol process when a data read request is input from the host.

The security setting unit selectively manipulates a part of the system area among the file system components of the USB memory 300 to directly insert the USB memory 300 into the host 100 so that information in the USB memory 300 is transferred to the host 100 ) so that it cannot be recognized.

The security setting unit includes an access control unit that controls access from the host to the USB memory according to a process of a preset access control protocol to protect data stored in the USB memory so that only authorized users can access the memory characterized in that

The USB connector may include a first USB connector having a male shape for connection with a host; and a second USB connector in which the USB connector for connection with the USB memory has a female shape.

A security system for a USB memory without a security function according to another aspect of the present invention for achieving the above object is a USB connector that is physically connected to a host and a USB memory to transmit and receive data and encrypt or A security function including a security setting unit that maintains the confidentiality of data by decryption or manipulates/reverses the file system so that only authorized users or owners can access the memory by intermittently controlling access to the USB memory from the host Secure USB dongle for missing USB memory; and a USB memory that is connected to the secure USB dongle and divides the memory area into a CD area, which is a read-only medium that cannot change or remove an internal file, and a general memory area where data can be stored.

According to one aspect of the present invention, only the security function is separated from the secure USB memory having the memory storage function and the security function, and vulnerabilities such as bypass through physical methods, fingerprint authentication bypass, password exposure using memory dump, etc. are supplemented, It has the effect of guaranteeing the confidentiality of the contents written in the USB memory.

In addition, the security module can be safely protected by separating the security function, and since it can be used in connection with various types of general USB memory with a single USB dongle, the cost is more economical than that of a USB memory with a security function.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description. .

The following drawings attached to this specification illustrate preferred embodiments of the present invention, and serve to further understand the technical spirit of the present invention together with specific contents for carrying out the invention, so the present invention is in such drawings It should not be construed as being limited only to the stated matters.
1 shows a connection relationship between a secure USB dongle and a host and a general USB memory according to an embodiment of the present invention;
2 is a schematic configuration diagram of a secure USB dongle according to an embodiment of the present invention;
3 is an example showing an encryption/decryption protocol process through a secure USB dongle according to an embodiment of the present invention;
4 is an example showing an access control protocol process through a secure USB dongle according to an embodiment of the present invention;
5 is an example showing the flow of an encryption process according to an embodiment of the present invention;
6 is an example illustrating a flow of a decoding process according to an embodiment of the present invention.

The above-described objects, features and advantages will become more apparent through the following detailed description in relation to the accompanying drawings, and accordingly, those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in the description of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the accompanying drawings.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated. In addition, the “… The term “unit” means a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software.

A dongle is a small piece of hardware that is connected to a computer. It is similar in size to a USB memory and can be connected to a computer's USB port to perform various functions. Initially used to authenticate computer software, it has recently been used to refer to an adapter used for wireless Internet on a Raspberry Pi without a LAN card or Internet function.

1 illustrates a connection relationship between a secure USB dongle and a host and a general USB memory according to an embodiment of the present invention.

Referring to FIG. 1 , the secure USB dongle 200 is connected to a host 100 and a general USB memory 300 .

The host 100 may be a personal computer having a USB connection port. The host 100 may execute various programs and set security for stable communication with the USB-connected device. In FIG. 1 , the host 100 is described as a personal computer, but is not limited thereto, and may be a laptop computer, a server, or the like.

The USB memory 300 is a portable storage device that is easy to move and has a simple operation method. It is a storage device that can move or store files when connected to a USB port such as a computer. It does not require a battery and can store a large amount of information depending on the storage capacity. A flash memory is used for the USB memory 300 . In flash memory, stored information is not erased even when the power is cut off, and information can be freely stored or deleted while being used differently from CD or DVD. The USB memory 300 according to this embodiment does not have a security function, is a USB memory 300 having only a memory function, is connected to a secure USB dongle 200 to be described later, and is connected to a computer and data connected to the secure USB dongle 200 . can send and receive On the other hand, the USB memory 300 according to the present embodiment can divide the existing memory area into a CD area, which is a read-only medium that cannot change or remove internal files, and a general memory area where data can be stored. This utilizes the characteristics of the CD, and as described above, it is possible to block an attack within the CD area by separating the area. In addition, the division of the CD area and the general memory area minimizes the possibility of exposing the internal area by concealing and disguising the CD area as a CD drive separately from the USB memory 300 when the USB memory 300 is connected to the host 100 . can do.

The secure USB dongle 200 encrypts or decrypts data stored in the USB memory 300 , and is a security-enhanced connection medium for transmitting and receiving data between the computer and the USB memory 300 . That is, the secure USB dongle 200 may be connected to the computer and the USB memory 300 through the USB connector 210 to transmit/receive data. In this case, it is preferable that the USB connector 210 for connection with the computer is a male type, and the USB connector 210 for connection with the USB memory 300 is a female type. Meanwhile, the secure USB dongle 200 may transmit/receive data to and from a computer in a state in which security is set through Digital Right Management (DRM). For example, a security program capable of setting the secure USB dongle 200 may exist in the computer. Accordingly, when the administrator sets the secure USB dongle 200 to be connected through the computer's security program, the secure USB dongle 200 is connected to the computer and can transmit and receive data in a state in which security is set. In addition, when there is no security program in the computer, the secure USB dongle 200 may transmit/receive data to and from the computer in a state in which security is set through a password. For example, when the secure USB dongle 200 is set to be connected to the computer and then connected to the computer, the password between the secure USB dongle 200 and the computer is checked through the OTP (One Time Password) method to ensure security in a secure state. Data may be transmitted/received between the USB dongle 200 and the computer. Here, the OTP uses a one-time password of a randomly generated random number. For example, the secure USB dongle 200 encrypts the time to 128 bits to generate an OTP, and the user inputs a password corresponding to the OTP in the computer to authenticate the security between the secure USB dongle 200 and the computer. Here, encryption may be applied by selecting from various encryption methods, and preferably, a publicly verified encryption algorithm may be applied. Accordingly, the secure USB dongle 200 may transmit/receive data to and from the computer in a state in which security is set through the OTP method.

Hereinafter, the secure USB dongle 200 according to the present embodiment will be described in more detail with reference to FIG. 2 .

2 is a schematic configuration diagram of a secure USB dongle according to an embodiment of the present invention.

Referring to FIG. 2 , the secure USB dongle 200 according to the present embodiment includes a USB connector 210 and a security setting unit 220 .

The USB connector 210 is coupled to the USB port of the host 100 and/or the terminal of the USB memory 300 to connect the secure USB dongle 200 to the host 100 and/or the USB memory 300 . At this time, the USB connector 210 for connection to the computer is a first USB connector of a male type, and the USB connector 210 for connection with the USB memory 300 is a second USB connector and is a female type. can be brother In other words, the USB connector 210 is physically connected to the host 100 and the USB memory 300 to transmit and receive data. However, the present invention is not limited thereto, and the USB connector 210 is formed of only a male connector for connection to the host 100 , and the USB memory 300 may be separately connected to a USB terminal of a computer. That is, the USB connector 210 may be connected to the host 100 and the USB memory 300 to transmit/receive data between the host 100 and the USB memory 300 .

The security setting unit 220 may maintain confidentiality of data by encrypting and/or decrypting data transmitted and received through the USB connector 210 . The security setting unit 220, which is a module for encryption and/or decryption, is loaded on the secure USB dongle 200, and in order to write data to the USB memory 300, the data is encrypted through the secure USB dongle 200 to the USB memory. When the data is stored in 300 and read from the USB memory 300 , the data is decrypted through the secure USB dongle 200 and transmitted to the host 100 . At this time, the encryption/decryption protocol through the secure USB dongle 200 is as shown in FIG. 3 to be described later.

In addition, the security setting unit 220 may control access to the USB memory 300 from the host 100 so that only an authorized user can access the memory. On the other hand, since it is not easy for the user to operate the USB memory 300 generally produced and sold by the manufacturer, the user's access is improved by simply operating the USB memory 300 through the secure USB dongle 200 according to the present invention. can be controlled In other words, the user's access can be controlled using the access control protocol included in the USB dongle. At this time, the protocol for access control is as shown in FIG. 4 to be described later. In addition, the security setting unit 220 selectively manipulates a part of the system area among the file system components of the USB memory 300 to directly insert the USB memory 300 into the host 100 , the information in the USB memory 300 . may include a function to prevent it from being recognized by the host 100 . When this is used together with a dongle, the reverse operation is performed so that the USB memory 300 can be recognized. In such cases, strong encryption and decryption capabilities may or may not be used, and in some cases simplified encryption and decryption capabilities may be utilized.

Meanwhile, the security setting unit 220 includes an encryption unit 221 , a decryption unit 223 , and an access control unit 225 .

When a data write request is input from the host 100 , the encryption unit 221 encrypts data input through the host 100 through an encryption algorithm according to a preset protocol process.

When a data read request is input from the host 100 , the decryption unit 223 decrypts the encrypted data stored in the general USB memory 300 through a decryption algorithm according to a preset protocol process.

The access control unit 225 controls the access from the host 100 to the USB memory 300 according to a process of a preset access control protocol to protect data stored in the USB memory 300 so that only an authorized user accesses the memory. make it possible

3 is an example illustrating an encryption/decryption protocol process through a secure USB dongle according to an embodiment of the present invention.

Referring to FIG. 3 , a protocol process for encryption/decryption can be largely divided into a data writing process and a data reading process.

First, the process of writing data to the USB memory 300 will be described as follows.

(1) The host 100 sends a data write request to the USB memory 300 . Such a request may be automatically processed when data is copied from the host 100 to the USB memory 300 without going through another process.

(2) An encryption process is performed through the secure USB dongle 200 before data is stored in the USB memory 300 . In this case, various methods known in advance may be applied to the encryption algorithm used in the encryption process.

(3) As shown in FIG. 3 , when writing the test.txt file is requested, it is encrypted with test.CPR and the extension is changed, and the file contents are also changed and cannot be checked.

Next, a process of reading data from the USB memory 300 will be described as follows.

(1) The host 100 sends a data read request to the USB memory 300 . Such a request may be automatically processed when the USB memory 300 is connected from the host 100 without going through another process.

(2) A decryption process is performed through the secure USB dongle 200 before data is read from the USB memory 300 . In this case, various methods known in advance may be applied to the decoding algorithm used in the decoding process.

(3) As shown in FIG. 3 , when the test.CPR file is requested to be read, it is decoded into test.txt, the extension is changed, and the file contents can be checked.

As such, the secure USB dongle 200 according to an embodiment of the present invention includes a module for encryption and decryption, and since the security strength varies according to the encryption algorithm, an appropriate encryption module is selectively adopted according to confidentiality and availability can be implemented by

4 is an example illustrating an access control protocol process through a secure USB dongle according to an embodiment of the present invention.

Referring to FIG. 4 , an access control protocol for protecting data in the USB memory 300 can be largely divided into a registration process and a connection process.

First, a process for registering the USB memory 300 will be described as follows.

(1) The host 100 stores the unique information of the USB memory 300 for identifying the USB memory 300 in the secure USB dongle 200 . Such information may be used as a key for access control of the USB memory 300 .

(2) The unique information of the USB memory 300 is changed to make it generally unusable. This process only needs to be performed once for each USB memory 300 .

Next, a connection process for using the USB memory 300 will be described as follows.

(1) The USB memory 300 sends a connection request to the host 100 .

(2) In order to use the USB memory 300 , it is necessary to connect to the host 100 by utilizing information stored in the secure USB dongle 200 rather than the existing information in the USB memory 300 .

(3) When the USB memory 300 is normally recognized, data can be transmitted.

As described above, if the secure USB dongle 200 according to an embodiment of the present invention is used, since the security module is divided, there is an advantage that any general USB memory 300 can be used. That is, the secure USB memory 300 is more expensive than the conventional USB memory 300 without a security function, but by separating the security function and mounting it on the secure USB dongle 200, various USB memories 300 are connected. Since it can be used, the secure USB dongle 200 according to the present embodiment is economical and has the advantage of providing confidentiality of data by easily connecting the general USB memory 300 without a security function.

5 is an example illustrating the flow of an encryption process according to an embodiment of the present invention.

Referring to FIG. 5 , the encryption process of the secure USB dongle 200 is as follows.

First, when the secure USB dongle 200 is connected to the host 100, the USB encryption/decryption dongle program is automatically executed. In this case, the USB encryption/decryption dongle program may be stored in a separate storage space of the USB dongle, or may be stored in a separate storage space in which the area of the USB memory 300 is separated as described above. Next, when the USB memory 300 to be encrypted is connected to the host 100, a list of files existing in the memory is output as a list. When the general USB memory 300 initialized once by the secure USB dongle 200 is inserted into the host 100 without the secure USB dongle 200 installed, the encrypted file is displayed or no file is displayed, or the format is not performed. It is also possible to output an inducing phrase.

6 is an example illustrating a flow of a decoding process according to an embodiment of the present invention.

Referring to FIG. 6 , the decryption process of the secure USB dongle 200 is as follows.

First, when the secure USB dongle 200 is connected to the host 100, the USB encryption/decryption dongle program is automatically executed. In this case, the USB encryption/decryption dongle program may be stored in a separate storage space of the USB dongle, or may be stored in a separate storage space in which the area of the USB memory 300 is separated as described above.

The secure USB dongle 200 as described above performs encryption/decryption of the USB memory 300 without a security function. If the USB memory 300 encrypted through the secure USB dongle 200 is lost and/or stolen, since decryption can be performed only through the secure USB dongle 200, the acquirer or the stealer of the USB memory 300 Since the user does not own the secure USB dongle 200 , it is difficult to check the contents stored in the USB memory 300 because it cannot be decrypted. That is, when the secure USB dongle 200 according to the present embodiment is used, confidentiality of data stored in the USB memory 300 can be maintained, and data leakage can be minimized to protect privacy.

In addition, the secure USB dongle 200 as described above separates only the security function, so that vulnerabilities of the existing secure USB memory 300 such as bypass through physical methods, fingerprint authentication bypass, password exposure through memory dump, etc. can be supplemented, and since it is possible to encrypt/decrypt general USB memories 300 without a security function with only one secure USB dongle 200, it is economical because costs can be reduced.

Methods according to an embodiment of the present invention may be implemented as an application or implemented in the form of program instructions that may be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the computer-readable recording medium are specially designed and configured for the present invention, and may be known and used by those skilled in the art of computer software. Examples of the computer-readable recording medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as a CD-ROM, a DVD, and a magneto-optical medium such as a floppy disk. media) and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

While this specification contains many features, such features should not be construed as limiting the scope of the invention or the claims. Also, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment herein may be implemented in various embodiments individually, or may be implemented in appropriate combination.

Although operations have been described in a particular order in the drawings, it should not be understood that such operations are performed in the specific order as illustrated, or that all described operations are performed in a continuous sequence, or to obtain a desired result. Multitasking and parallel processing can be advantageous in certain circumstances. In addition, it should be understood that the division of various system components in the above-described embodiments does not require such division in all embodiments. The app components and systems described above may generally be implemented as a package in a single software product or multiple software products.

The present invention described above, for those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible without departing from the technical spirit of the present invention. It is not limited by the drawings.

100 : host
200 : Secure USB Dongle
210: USB connector
220: security setting unit
221: encryption unit
223: decryption unit
225: access control
300: USB memory

Claims (6)

A secure USB dongle connected between a host and a USB memory to mediate transmission and reception of data,
a USB connector physically connected to the host and the USB memory to transmit and receive data; and
Security that maintains data confidentiality by encrypting or decrypting the transmitted and received data, or manipulates/reverses the file system so that only authorized users or owners can access the memory by intermittently controlling access to the USB memory from the host setting unit; including,
The security setting unit,
If the host has a security program, it allows sending and receiving of data in a state where security is set through DRM (digital right management),
If the host does not have a security program, when connecting to the host, the password between the host and the USB dongle is checked through the OTP method.
The security setting unit,
Optionally, when inserting the USB memory 300 directly into the host 100 by manipulating a part of the system area among the file system components of the USB memory 300 , the information in the USB memory 300 may be recognized by the host 100 . not to,
The security setting unit,
Security for USB memory without security function, characterized in that the information in the USB memory cannot be recognized by the host when the USB memory is directly inserted into the host by selectively manipulating a part of the system area among the file system components of the USB memory USB dongle. The method of claim 1,
The security setting unit,
an encryption unit for encrypting data input from the host through an encryption algorithm according to a preset protocol process when a data write request is input from the host; and
When a data read request is input from the host, a decryption unit that decrypts the encrypted data stored in the general USB memory through a decryption algorithm according to a preset protocol process; USB dongle. delete The method of claim 1,
The security setting unit,
Security comprising an access control unit that allows only authorized users to access the memory by controlling access from the host to the USB memory according to the process of a preset access control protocol to protect data stored in the USB memory Secure USB dongle for non-functional USB memory. The method of claim 1,
The USB connector is
a first USB connector having a male form for connection with a host; and
The USB connector for connection with the USB memory is a second USB connector having a female shape; a security USB dongle for a USB memory without a security function, comprising: a. delete

Images