KR20020052006A - Apparatus and Method of Preserving a PC Based on a Smart Card - Google Patents

Abstract

PURPOSE: A system and a method for the security of a PC by using a smart card are provided to simultaneously perform the security of a PC and the PKI(Public Key Infrastructure) authentication with a card by restraining the booting of the PC without a manager card and limitedly allowing the use of the PC to the user of a registered smart card. CONSTITUTION: The system comprises a power supply(21), a PC security processor(23), a key selecting unit(24), a protocol processor(25), a display(26), a PKI processor(28), a card reader(22), and an RS(Recommended Standard)-232 port(27). The PC security processor notices the genuineness of a card by reading the serial number of a smart card and comparing the serial number with the number of a registered card. The key selecting unit sets up or disconnects a communication line. The protocol processor transmits data to the PC security processor and a PC. The display indicates the security and unlocking of the security. The PKI processor determines the communication performance with the smart card and controls the reading and recording of data. The card reader performs the data reading and recording of the smart card. The RS-232 port transmits the data to the PKI processor and the PC.

Description

PC security device and method using smart card {Apparatus and Method of Preserving a PC Based on a Smart Card}

The present invention relates to a PC security device and method using a smart card, and in particular, when a plurality of users using a single PC to register the smart card to the PC to permit only the user of the registered card PC security and PKI authentication It relates to a PC security device and method using a smart card that can be performed at the same time.

In general, PCs are used in many places to collect, store, process, and input information in the information society, and as a result, it may be somewhat different depending on the characteristics of the user, but it is necessary to maintain the security of the information stored in the PC. Many countermeasures are being prepared.

There are three major security solutions for your PC: first, to prevent unauthorized users from booting your PC, and secondly, when users use input devices such as keyboards and mice. There are ways to prevent this, and the third way is to use a PC but not be able to see or copy material with high information value.

However, the above-mentioned methods are not only inconvenient to remember the password set in the PC and to check whether the password is valid by inputting the password one by one, and in case the password is exposed, the security state of the PC is unprotected. That is, there is a problem that an unjust user can obtain a password and boot a PC to leak information or damage various programs.

On the other hand, smart cards are rapidly increasing for various security purposes or as a substitute for currency payment means. For example, when complex encryption and decryption processes such as financial transactions are required, data can be transmitted at high speed using a contact type smart card. It can be used for convenience. Using such a smart card, it is possible to easily maintain the security of the PC. Until now, the security device of the PC using the smart card has not been developed.

In order to solve the problems as described above, the present invention is to register a smart card to the PC in a plurality of users using a PC and to register the administrator card in the PC password to boot the PC if there is no administrator card At the same time, only the user of the smart card registered in the PC allows the user to use the PC, so that only one card can perform PKI authentication as well as PC security.

In addition, the present invention is to provide a convenience of using the PC can be used by simply inserting the smart card registered in the PC used by a plurality of users in the card reader, the purpose of the PC.

In addition, the present invention improves the reliability of PC security by generating a log file to record the access of the user who used the PC, to perform a screen hiding function and to perform a file protect function at the time of security. have.

1 is a block diagram showing a personal computer (PC) security device using a smart card according to an embodiment of the present invention.

2 is a flowchart showing a PC security method using a smart card according to an embodiment of the present invention.

3 is a flowchart showing a serial number reading process in FIG. 2;

Explanation of symbols on the main parts of the drawings

21: power supply 22: card reader

23: PC security processor 24: Key selector

25: protocol processing unit 26: display unit

27: RS-232 port 28: PKI processor

PC security device using a smart card according to an embodiment of the present invention for achieving the above object and a power supply for supplying power applied through the keyboard; A PC security processor that analyzes a received command, determines a communication speed, reads the serial number of the smart card, and compares it with a registration card number to inform whether the card is a legitimate card; A key selector for setting or disconnecting a communication line under the control of the PC security processor; A protocol processor for transmitting data between the PC security processor and the PC according to a keyboard protocol; A display unit for displaying security or displaying security release under the control of the PC security processor; A PKI processor that determines to perform communication with a smart card or itself for PKI authentication processing, and analyzes a communication command of a PC and controls reading and writing of data according to the result of the analysis; A card reader unit which detects an insertion or removal of a smart card and notifies the PC security processor, and performs data reading and writing operations of the smart card according to the control of the PKI processor; It characterized in that it comprises an RS-232 port for transmitting data between the PKI processor and the PC.

On the other hand, PC security method using a smart card according to an embodiment of the present invention for achieving the above object is a step of checking whether there is a serial number of the currently registered smart card by reading the stored data; Setting the baud rate for PC security and prohibiting the use of keys; Confirming the insertion of the smart card and reading the serial number of the smart card; Checking whether the card is a normal card by comparing the read serial number with the registered number; It includes a process of releasing security by performing a smart card insertion processing operation by setting a baud rate for general use and allowing a key to be used.

The serial number reading process may include: activating the smart card after confirming the insertion of the smart card and setting an error for a predetermined number of times; Receiving and analyzing the ATR, selecting a file, and reading the serial number of the smart card. The security releasing process may further include transmitting a card insertion notification command to the PC after setting a retry count in the case of the normal card; Receiving a number reading command and transmitting the read serial number to a PC; Receiving a security release response signal after the second verification of the PC to set the communication line between the keyboard and the PC and at the same time characterized in that it comprises the step of displaying the security release.

Alternatively, the PC security method using a smart card according to an embodiment of the present invention includes the steps of increasing the registration number point and confirming the removal of the smart card when the normal card is not; And transmitting a card removal notification command to the PC, disconnecting the communication line between the keyboard and the PC, and simultaneously displaying a security indication. Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. Many specific details, such as specific process flows, are set forth in the following description and accompanying drawings to provide a more general understanding of the invention. It will be apparent to those skilled in the art that the present invention may be practiced without these specific details. In addition, detailed description of well-known functions and configurations that may unnecessarily obscure the subject matter of the present invention will be omitted.

Looking at the specifications of the PC security device using a smart card according to an embodiment of the present invention, the CPU as 'Atmel 89C52' and 'Atmel 89C2051' Micro Controller, 8 (Kbyte ) And 2 (Kbyte) ROM program area and 256 (Byte) and 128 (Byte) internal RAM area, and 5 (V) / It is 50 (mA) or less, the communication method is the synchronous communication method through the PC keyboard port, the bidirectional communication method, the IC card is the PKI330 smart card of Datakey, and the environmental temperature is- It is 5 ~ 45 (℃), the temperature at storage is -20 ~ 55 (℃), the humidity at operation is 10 ~ 90 (% Rh) and the humidity at storage is 5 ~ 95 (% Rh). 1, the power supply unit 21, the card reader unit 22, the PC security processor 23, the key selection unit 24, the protocol processing unit 25, And a display unit 26, an RS-232 port unit 27, and a PKI processor 28. The main function is to register a predetermined number (about 7) of user cards to Allow only the holder to use the license, register the administrator card with the PC ROM BIOS password to prevent the PC from booting without the administrator card, and create a log file to record the access of the person who used the PC, One card is used to perform the screen hiding function and file protect function, and to implement not only PC security but also PKI authentication.

The power supply unit 21 receives power through a keyboard and supplies power to each component block.

The card reader unit 22 detects the insertion or removal of the smart card and notifies the PC security processor 23, and performs the data reading and writing operation of the smart card according to the PKI authentication control of the PKI processor 28. do.

The PC security processor 23 is, for example, a micro controller of 'Atmel 89C52', which analyzes a command transmitted from the card reader unit 22 and determines a communication speed. After communicating with the card to read the serial number (Serial Number) and compares the card number registered in the serial EEPROM inside to check whether the card of the legitimate user, the legitimate smart card is inserted into the card reader unit 22 Command (hereinafter, referred to as a card insertion notification command) to inform the user that it has been sent to the PC via the protocol processing unit 25, and a command for reading the serial number of the smart card through the protocol processing unit 25 (hereinafter, reading a number). Command) and transmits the serial number to the PC, and applies a security indication signal or a security release indication signal to the display unit 26. In addition, drawings of other internal configurations, i.e., OSC, Q3 (transistor), serial EEPROM (Electrical Erasable & Programmable ROM), Q1 (transistor), K1 (relay), etc., may unnecessarily obscure the subject matter of the present invention. Omit to exclude.

The key selector 24 sets or disconnects the communication line between the keyboard and the PC and sets or disconnects the communication line between the PC security device and the PC according to the PKI authentication control of the PC security processor 23.

The protocol processor 25 transmits data between the PC security processor 23 and the PC in accordance with the keyboard protocol.

The display unit 26, for example, as an LED and a buzzer, displays security or releases security under the control of the PC security processor 23.

The RS-232 port unit 27 transmits data between the PKI processor 28 and the PC.

The PKI processor 28 is, for example, a micro controller of 'Atmel 89C2051', and it is determined whether to communicate with the smart card or the PKI processor 28 using the RTS signal line of the RS-232 port unit 27. In addition, it analyzes the communication command applied from the PC and performs the operation accordingly, and in particular, reads and writes data to the smart card to control the PKI authentication process. In addition, drawings of other internal configurations, i.e., internal connection circuits (e.g., 74HC02, 74HC125), Q2 (transistor), and the like are omitted to exclude the possibility of unnecessarily obscuring the subject matter of the present invention.

Referring to the operation of the PC security device using a smart card according to an embodiment of the present invention.

First, when the power of the PC used by a plurality of users (On) is sent to the keyboard side from the power supply block of the PC, the power supply unit 21 in the power supplied through the keyboard security PC security Provides power for each building block of the device.

When a plurality of users insert their smart cards (eg, ISO7816 type smart cards) into the card reader unit 22, the card reader unit 22 detects the insertion of the smart card and the PC security processor. The third pin P1.2 of (23) is converted into a 'low' state, and accordingly, does the PC security processor 23 change the third pin (P1.2) into a 'low' state? Check to see if the smart card is inserted.

At this time, when the smart card is recognized, the clock is activated. That is, the fourth pin P1.3 of the PC security processor 23 is converted into a low state to 3.579545 MHz. The clock of the OSC is applied to the smart card through the card reader 22. In addition, the power supplied from the power supply 21 (ie, 5V) is applied to the smart card, that is, the first pin (P1.0) of the PC security processor 23 'Low' It converts to a state and operates Q3 to apply the corresponding power to the smart card through the card reader 22. In addition, a reset is applied to the smart card, that is, the second pin P1.1 of the PC security processor 23 is kept in a 'low' state for a predetermined time to reset the smart card. Let it be.

Accordingly, when the smart card is reset, an ATR (Answer to Reset) is transmitted according to the standard of the smart card. At this time, the command is analyzed and the communication speed (for example, 9600, 19200, 38400, etc.) is determined. The serial number of the smart card is obtained by performing communication with the card. That is, the ATR from the smart card is analyzed and the file is selected to read out the serial number.

Here, the read serial number is provided by a company that manufactures each smart card, and is read in a form of application in an applied application using a COS library provided by the smart card. In addition, all communication is determined by the ISO standard, and serial communication is performed by connecting the tenth pin (P3.0), the receive data pin of the PC security processor 23, and the eleventh pin (P3.1), the transmit data pin, together. To read the contents of the data.

Then, after reading the serial number of the smart card as described above, by comparing the card number registered in the serial EEPROM with the read serial number to determine whether there is the same card number, that is, the card reader unit 22 Check that the inserted smart card is a legitimate user's card.

At this time, if the read serial number is not registered in the serial EEPROM, it means that the PC security device is in an initialized state so that a normal keyboard can be used without any reaction, whereas the read serial number is If it is registered in the serial EEPROM, the card insertion notification command is transmitted to the PC side via the protocol processing unit 25.

That is, the data is applied to the protocol processor 25 through the twelfth pin P3.2 and the thirteenth pin P3.3 of the PC security processor 23 and transmitted according to the keyboard protocol. The 14th pin (P3.4) of the security processor 23 is converted into a 'low' state to disconnect the communication line between the keyboard and the PC and set the line to enable communication only between the PC security device and the PC.

Then, when the card insertion notification command is transmitted to the PC, the PC transmits a number reading command, and upon receiving the number reading command, the serial number is transmitted to the PC.

Then, the PC is to release the PC security after the second verification of the received password. In addition, if any smart card is registered and the security function is activated, the smart card is inserted into the card reader unit 22 and the PC security is released as described above. The signal is applied to the display unit 26 to turn on the D2 LED of the display unit 26.

Accordingly, since the smart card is inserted into the card reader 22 and the PC security is released, the 14th pin P3.4 of the PC security processor 23 is converted into a 'high' state. A communication line is connected between the PC and the PC, and then it is continuously checked whether the smart card is removed from the card reader 22.

Accordingly, when the smart card is removed from the card reader 22, that is, the card reader 22 puts the third pin P1.2 of the PC security processor 23 into a 'high' state. When the PC security processor 23 detects this, the protocol processing unit 25 sends a command (hereinafter referred to as a card removal notification command) indicating that the smart card has been removed from the card reader unit 22. It transmits to PC and cuts off communication line between keyboard and PC.

That is, by converting the fourteenth pin (P3.4) of the PC security processor 23 to the 'low' state to make Q1 to be in an operation inhibited state to turn off the K1 connected to it, and then confirmed and The response to the task of the transmission is to be executed in the PC security device instead of the keyboard. At this time, the PC security processor 23 applies a security display signal to the display unit 26 to turn off the LED of the display unit 26.

When no smart card is registered in the PC security device and thus does not perform a security task operation, the LED of the display unit 26 is always turned off regardless of the insertion and removal of the smart card. In addition, when the smart card is inserted into the card reader unit 22 regardless of whether the smart card is registered or not, since the serial number of the smart card is unconditionally read, the serial number is read. The LED is turned on for about 1 second.

In addition, the registration or removal operations of the smart card are all performed according to the communication protocol standard of the keyboard and the PC, and a special protocol is used to prevent a conflict with other general commands, and the above-described communication format is as follows.

For example, if the command is from the host to the keyboard side, the secure start command is' 7Fh, "L", 00h 'and the Card ID Manual Set command is' 7Fh, "M", ID X 8byte, 00h ', the registration card ID deletion command is' 7Fh, "N", ID X 8byte, 00h, and the registration card ID deletion command is '7Fh, "O", 00h', and the registration buffer ( Buffer) ID reading command is '7Fh, "p", 00h', card ID reading command is '7Fh, "Q", 00h', and security end command is '7Fh, "R", 00h'. The command is '7Fh, "S", 00h', the password command is '7Fh, "T", 00h', and the password disable command is '7Fh, "U", 00h'. Command to prohibit is '7Fh,' V ', 00h'. In this case, two bytes are transmitted for each code, and a combination of 'F3h' and '7Fh' is transmitted. When inserting a card, a card insertion code is transmitted after an ESC key is input. When the card is removed, simultaneous key input of ALT and SPACE and a card removal code are transmitted.

In the case of a command from the keyboard side to the host, the card insertion notification command is '15', the card removal notification command is '16', the initial status notification command is '23', and the card ID transmission notification command is 'ID'. X 8byte, CR ', the normal response notification command is' 19', and the registration buffer ID transmission notification command is' ID X 8byte,. ' . , ID X 8byte, CR '.

In addition, referring to the above-described communication flow, when registering a card, the card ID manual set command is transmitted from the host to the keyboard side and receives a normal response thereto. Sends the registration card ID read command from the host to the keyboard and sends the registered ID for it from the keyboard when checking the registered contents and the host when checking the currently inserted card. Sends the card ID read command to the keyboard, sends the card ID for it on the keyboard, sends the security release signal to the host when the card is inserted, and sends the security start signal from the keyboard when the card is removed. To the host side When the current status request is requested, the host sends a status check command to the keyboard side, and the keyboard sends security, release, and initial states.

Meanwhile, the PKI processor 28 supports '# PKCS11 (TOKEN)' as a part that is necessarily applied when a plurality of users share a PC, and the operation of the PKI processor 28 is as follows.

First, the PC and RS-232 through the RS-232 port unit 27 using the second pin (P3.0) that is the receive data pin and the third pin (P3.1) that is the transmit data pin of the PKI processor 28. It performs communication and determines whether to communicate with the smart card or PKI processor 28 by using the RTS signal line of the corresponding RS-232 port portion 27.

At this time, if the RTS signal line is 'low' state, communication data from the PC is transmitted to the smart card, and the PKI processor 28 checks its thirteenth pin (P1.1) and does not respond by itself. Do not perform a response. On the other hand, when the RTS signal line is 'high', the PKI processor 28 analyzes the communication command and responds accordingly because the thirteenth pin P1.1 is 'high'.

Therefore, when a communication command is transmitted from a PC, the PKI processor 28 analyzes the communication command of the corresponding PC and performs an operation accordingly, that is, the command to supply the power of the smart card and of course there is no smart card. In the case, it responds with a non-responsive signal (Nack), performs a command to turn on the LED, performs a command to turn off the smart card, and performs a command to turn off the LED. Here, all instructions for performing operations follow the format defined above.

The PKI processor 28 then reads and writes data to the smart card for PKI authentication. In this case, when data is transmitted from the PC to the smart card, the data is transmitted through the sixth pin of the internal connection circuit (for example, 74HC02) and the Q2 is operated through the fourth pin, which is an output pin, to transmit the data to the smart card. In addition, the data transmission of the smart card is selected to the smart card by the operation of the ninth pin (P3.5) and the eleventh pin (P3.7) of the PKI processor 28 through an internal connection circuit (for example, 74HC125). It can only be transferred to the PC side.

In other words, briefly summarizing the operation of the PKI processor 28, after initializing the port, the internal RAM and the serial port, delaying for a predetermined time and selecting communication with the card reader unit 22; After checking and analyzing whether there is received data, it performs the operation accordingly. Here, the processing is performed separately according to the jumper (Jump) per command and the corresponding received data normal flag (Flag) is cleared.

At this time, when the smart card is removed, the port is initialized, the communication with the card reader unit 22 is reselected, and the received data is checked again. In addition, the interrupt of the received data confirms the presence or absence of the received data flag, checks whether the terminal is on the side, checks whether the parity is normal, checks whether the data is stored, and checks whether it is a start code. Later, save the data and increase the points.

After checking that the save operation is completed, set the received data normal flag.

The PC security method using a smart card according to an embodiment of the present invention will be described with reference to the flowchart of FIG. 2.

First, the PC security processor 23 receives power from the power supply unit 21 to perform an operation. The PC security processor 23 reads data stored in an internal serial EEPROM. In this case, the corresponding EEPROM Check whether there is a serial number of the currently registered smart card (step S1).

At this time, if the serial number of any smart card is not registered in the EEPROM in the first step (S1), that is, if there is no smart card registered in the PC security device to perform a security task operation, the baud rate Set (Baudrate) to 9600 sets (ie set the baud rate for general use) and allow the use of keys (step S2).

On the other hand, if the serial number of a smart card is registered in the EEPROM in the first step (S1), that is, there is a smart card registered in the PC security device to perform a security task operation, the baud rate For example, it sets to 38400 Set (i.e., sets the communication speed for PC security) and prohibits the use of keys (step S3).

Thus, by checking whether the smart card is inserted into the card reader unit 22 to read the serial number of the card (step S4). In other words, the fourth process S4 will be described in more detail with reference to the flowchart of FIG. 3.

After the smart card is inserted into the card reader 22 (step S4-1), an error is set for a predetermined number of times (for example, three times) (step S4-2), and the smart card is activated. That is, as described above, the power is turned on, the clock is activated, and the smart card is reset (step S4-3).

When the smart card is reset, the ATR is sent. At this time, the ATR is received (step S4-4), analyzed, the file is selected (step S4-5), and the serial number of the smart card is read out (step S4). -6).

Here, if the ATR is not received, the file is not selected, or the reading of the serial number is not completed (step S4-7), it is checked whether the smart card has been removed while reading the serial number of the smart card ( In step S4-8, if the smart card is not removed, the smart card is activated again after a predetermined time (step S4-9).

Then, after reading the serial number of the smart card and comparing the read serial number and the card number registered in the internal serial EEPROM to check whether the same card number, that is, inserted into the card reader unit 22 Check whether the smart card is a legitimate user's card (step S5).

At this time, if the serial number read in the fifth step S5 is not registered in the serial EEPROM, the registration number point is increased and the removal of the smart card is confirmed (step S6).

On the other hand, if the serial number read out in the fifth step S5 is registered in the serial EEPROM, the baud rate is set to 9600 sets, for example, the communication speed is set for general use, and the key is allowed to be used. To release the security by performing the smart card insertion processing operation (step S7). DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the drawings will be omitted and omitted to exclude the possibility of unnecessarily obscuring the subject matter of the present invention.

In other words, in the case of a smart card of a legitimate user, after setting the retry to a predetermined number of times (for example, five times), the card insertion notification command is transmitted to the PC side through the protocol processing unit 25, and from the PC. Upon receiving the read command, the serial number is transmitted to the PC. Therefore, after performing the secondary verification in the PC, when the PC security is released and a response signal is transmitted, the response signal is detected, the communication line between the keyboard and the PC is set, and the security release display signal is displayed. 26) to turn on the LED. If the response signal is not detected, the number of retries is increased by 1 after a predetermined time (for example, 2 seconds), and the card insertion notification command is resent to the PC until the maximum number of times (for example, 5 times).

On the other hand, when registering a new smart card, receives a card ID manual set command from the PC side, extracts the registration number and records the extracted registration number in the EEPROM. Only when the number is not registered in the EEPROM, the extracted registration number is recorded in the EEPROM, and it is set as registered and the smart card insertion processing operation is performed.

On the other hand, when deleting the registered smart card receives a registration card ID deletion command from the PC side to extract the deletion number and delete the extracted deletion number from the EEPROM, wherein the extracted deletion number remains in the EEPROM It checks whether there is no corresponding deleted number and clears the registered number only.

On the other hand, when the smart card is removed from the card reader unit 22, it detects this and sends a card removal notification command to the PC side through the protocol processing unit 25 and at the same time disconnects the communication line between the keyboard and the PC. The LED is turned off by applying a security indication signal to the display unit 26. In addition, the PC security processor 23 performs an operation of processing a dummy when a dummy occurs.

As described above, by registering the smart card in the PC and the administrator card in the PC password according to the present invention so that the PC can not be booted without the administrator card at the same time by allowing only the holder of the smart card registered in the PC One card can solve PC security and PKI authentication at the same time. In addition, since the PC can be used by simply inserting the smart card registered in the PC into the card reader unit, the PC can be conveniently provided to the PC user, and a log file can be generated to access the user who used the PC. It can record and perform screen hiding on security and file protect.

Claims (5)

A power supply unit supplying power applied through the keyboard; After analyzing the received command and determining the communication speed, it reads the serial number of the smart card and compares it with the registered card number and notifies whether it is a legitimate card, or after reading the serial number normally, it notifies the card that the card has been entered. A PC security processor for comparing with a registered card number; A key selector for setting or disconnecting a communication line under the control of the PC security processor; A protocol processor for transmitting data between the PC security processor and the PC according to a keyboard protocol; A display unit for displaying security or displaying security release under the control of the PC security processor; A PKI processor that determines to perform communication with a smart card or itself for PKI authentication processing, and analyzes a communication command of a PC and controls reading and writing of data according to the result of the analysis; A card reader unit which detects an insertion or removal of a smart card and notifies the PC security processor, and performs data reading and writing operations of the smart card according to the control of the PKI processor; PC security device using a smart card, characterized in that it comprises a RS-232 port for transmitting data between the PKI processor and the PC. Reading stored data to check whether a serial number of a currently registered smart card exists; Setting the baud rate for PC security and prohibiting the use of keys; Confirming the insertion of the smart card and reading the serial number of the smart card; Checking whether the card is a normal card by comparing the read serial number with the registered number; PC security method using a smart card comprising the step of setting the baud rate to general purpose and allowing the use of the key to perform the insertion processing operation of the smart card to release the security. The method of claim 2, The serial number reading process may include: activating the smart card after confirming the insertion of the smart card and setting an error for a predetermined number of times; Receiving and analyzing the ATR and selecting a file, and reading the serial number of the smart card PC security method using a smart card, characterized in that made. The method of claim 2, Increasing the registration number point and confirming removal of the smart card when the card is not the normal card; And a step of transmitting a card removal notification command to a PC, disconnecting a communication line between the keyboard and the PC, and simultaneously displaying a security indication. The method of claim 2, The security release process may include: transmitting a card insertion notification command to the PC side after setting a retry count in the case of the normal card; Receiving a number reading command and transmitting the read serial number to a PC; Receiving a security release response signal after the second verification of the PC to establish a communication line between the keyboard and the PC and at the same time comprising the step of displaying the security release, PC security method using a smart card.