KR20090053162A - Storage security system and method using communication network - Google Patents

Abstract

A storage security device and method are provided. The storage security apparatus of the present invention receives a host interface unit for transmitting and receiving data to a host, storage for storing data received via the host interface unit, and authentication information via a communication network, and based on the received authentication information. It characterized in that it comprises an authentication unit for authenticating the access to the storage, through which it is possible to authenticate the access to the data to the storage using a communication network. In addition, during the authentication process of the storage, by storing the access records in the authentication server, it is possible to check whether others have accessed the storage when the storage is lost or stolen.

Storage Security, Portable Storage, Removable Storage, Mobile Networks, Authentication

Description

Storage security device and method using communication network {STORAGE SECURITY SYSTEM AND METHOD USING COMMUNICATION NETWORK}

FIELD OF THE INVENTION The present invention relates to security devices and methods of storage, and more particularly to the security of removable or portable storage. This study was conducted as part of the core technology development project for IT new growth engines of the Ministry of Information and Communication and the ICT Research Promotion Agency. [2006-S-040-01, Development of Embedded Memory Software Technology based on Flash Memory]

Storage for storing data may include a magnetic disk, a semiconductor memory, and the like. As storage has become smaller due to advances in storage manufacturing technology, various forms of portable storage have been developed.

Portable storage has been widely used as a USB memory drive having a universal serial bus (USB) interface, a secure digital card (SD card), an external hard disk drive, and a micro drive.

The user of the portable storage is convenient because a large amount of data can be stored and carried in the portable storage, but when the user loses the portable storage, there is a problem that the learner can easily access the data stored in the portable storage.

That is, since data stored in conventional portable storage can be copied, modified, and deleted without restriction by the person carrying it, the demand for the security method of the portable storage is increasing.

Recently, a security method in which data is not accessible when a wrong password is input by assigning a password to the portable storage and a security method using biometric information such as fingerprint recognition or iris recognition to access data on the portable storage have been proposed. .

In the case of a security method using biometric information, a device for recognizing biometric information is required and a large amount of calculation is required to read biometric information, which makes the configuration of portable storage complicated and increases the cost of portable storage. Although a security method has been proposed to rely on the computing power of a host using software to reduce costs, the risk of software hacking remains.

The security method of giving passwords to portable storage is likely to expose passwords due to user's carelessness.

In addition, the conventionally proposed security methods have no way of knowing whether the data of the portable storage has been leaked to others when the portable storage is lost or stolen. In addition, the conventionally proposed methods can generate a password in every case to decrypt the password, or access data stored in the portable storage by using forged biometric information in advance.

In addition, others who have acquired portable storage can try various methods without any limitation to access the data stored in the portable storage, for example, the memory chip of the portable storage can be removed and read directly.

In this specification, storage security devices and methods are proposed that enhance the security of portable storage without increasing costs.

The present invention has been made to solve the problems of the prior art as described above, and an object thereof is to provide an apparatus and method for authenticating access to data stored in storage using a communication network.

Further, an object of the present invention is to provide a system and method for authenticating whether data stored in a storage can be accessed when power is applied to the storage, and storing an access record of the storage in an authentication server.

It is also an object of the present invention to provide an apparatus and method for verifying whether data stored in the storage has been accessed by another person when the storage is lost or stolen.

In order to achieve the above object of the present invention, a storage security device according to an aspect of the present invention includes a host interface for transmitting and receiving data to a host, storage for storing data received via the host interface, and a communication network. And an authentication unit configured to receive authentication information via the authentication information and to authenticate access to the storage based on the received authentication information.

In addition, a storage security system according to another aspect of the present invention includes an authentication server; And storage for requesting authentication information to the authentication server via a communication network, wherein the authentication server transmits the authentication information to the storage via the communication network when the storage requests the authentication information. The storage may receive the transmitted authentication information and determine whether to transmit data to the host according to the received authentication information.

In addition, the storage security method according to another aspect of the present invention is a storage security method for controlling access to storage for transmitting and receiving data to a host, comprising the steps of: requesting authentication information to an authentication server via a communication network; Receiving the requested authentication information; And determining whether to transmit data to the host according to the received authentication information.

According to the present invention, it is possible to implement an apparatus and method for authenticating access to data stored in storage using a communication network.

In addition, the present invention enables the implementation of a system and method for authenticating whether data stored in the storage can be accessed when the storage is powered, and storing the access record of the storage in the authentication server.

In addition, the present invention enables the implementation of an apparatus and method for verifying whether data stored in the storage has been accessed by another person when the storage is lost or stolen.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in detail. However, the present invention is not limited or limited by the embodiments. Like reference numerals in the drawings denote like elements.

1 is a diagram illustrating a storage security system according to an embodiment of the present invention.

Referring to FIG. 1, the storage security system includes an authentication server 110 and a storage 130.

The storage 130 requests authentication information from the authentication server 110 via the mobile communication network 120. When the storage 130 requests authentication information, the authentication server 110 transmits the authentication information to the storage 130 via the mobile communication network 120.

Authentication information corresponding to the storage 130 is previously stored in the authentication server 110. The authentication server 110 may update authentication information corresponding to the storage 130 as necessary.

The storage 130 receives the transmitted authentication information and determines whether to transmit data to the host according to the received authentication information.

According to an embodiment, the mobile communication network 120 may be a mobile communication network based on a cellular scheme.

According to an embodiment, the mobile communication network 120 may be a code division multiple access (CDMA) network or a global system for mobile communication (GSM) network.

The storage security system uses a CDMA network or a GSM network having the largest accessible range among current mobile communication methods, so that the data of the storage 130 may be secured regardless of where the storage 130 is connected to the host.

When the storage 130 requests authentication information, the authentication server 110 may store a record in response to the request. The record of the request may include a date and time when the storage 130 requests authentication information. The record of the request may include location information of the time when the storage 130 requests authentication information, and the current location of the storage 130 may be tracked based on the location information.

When a legitimate user is lost or stolen, when a third party attempts to access the storage 130, the authentication server 110 stores a request record of authentication information for the storage 130. The legitimate user can know the fact that the third party attempted to access the storage 130 and the date, time, and location of the access based on the request record of the authentication information for the storage 130 stored in the authentication server 110. have.

If a legitimate user is lost or stolen, the legitimate user may notify the authentication server 110 of the identification information of the storage 130 and the fact that it is lost or stolen to block third party access to the storage 130. Can be.

If a third party attempts to access the storage 130 after the third party's access to the storage 130 is blocked, the authentication server 110 stores the authentication information including the content of "No Access". To send.

When the storage 130 receives authentication information including the content of “prohibit access”, the storage 130 may block access to the storage 130 of the third party by blocking access to the storage 130 of the host side.

According to an embodiment, when the storage 130 is connected to the host side and power is supplied from the host side to the storage 130, the storage 130 may request authentication information from the authentication server 130. At this time, since the storage 130 requests authentication information at the moment the power is applied, the fact of attempting to access the storage 130 remains in the authentication server 110.

According to an embodiment, whenever the host accesses data stored in the storage 130, the storage 130 may request authentication information from the authentication server 110. In this case, the authentication server 110 may store an access record for every access attempt for the storage 130.

When the communication network is a cellular mobile communication network such as a CDMA network or a GSM network, the authentication server 110 may determine the spatial location of the cell where the storage 130 is currently located. Accordingly, the authentication server 110 may know the visual and spatial location where the access to the storage 130 is attempted. Referring to the access record stored in the authentication server 110, the legitimate user can know the time and place where the access to the storage 130 is attempted.

The present invention does not allow the user to intervene in the authentication process since authentication via the communication network is automatically performed by the hardware in the storage. Therefore, since it is impossible for the user to imitate authentication falsely and the user does not directly access the authentication information, there is no possibility that the authentication information is easily exposed.

In addition, since it can be applied together with other storage security techniques proposed in the related art, the security function can be further enhanced.

The host includes any terminal capable of accessing data stored in the storage 130, such as a personal computer, work station, desktop computer, laptop computer or personal digital assistant. .

2 is a diagram illustrating a storage security device 200 according to another embodiment of the present invention.

Referring to FIG. 2, the storage security device 200 includes a host interface 210, a controller 220, an authenticator 230, and a storage 240.

The host interface 210 transmits data to the host and receives data from the host.

The storage 240 stores data received via the host interface 210. When the storage 240 receives the read command from the host interface 210, the storage 240 transmits data corresponding to the read command to the host interface 210.

The authenticator 230 receives authentication information via a communication network and authenticates access to the storage 240 based on the received authentication information. The authenticator 230 may request authentication information from the authentication server via a communication network. At this time, the authenticator 230 may receive the requested authentication information from the authentication server.

According to an exemplary embodiment, when power is applied to the storage security device 200, the authenticator 230 may request authentication information from the authentication server.

According to an embodiment, the authenticator 230 may request authentication information from the authentication server whenever the host accesses the storage 240.

When the authenticator 230 requests authentication information from the authentication server, a record of the request may be stored in the authentication server. The record of the request may include the date and time the request was made. Also, the record of the request may include the place where the request was made.

The controller 220 determines whether to transmit data stored in the storage 240 to the host according to the authentication information received by the authenticator 230. The controller 220 may receive data to be stored in the storage 240 from the host interface 210. The controller 220 may encrypt the data received from the host interface 210 and store the data in the storage 240. By the data encryption process of the controller 220, the security of the data stored in the storage 240 may be further strengthened.

The authentication information may include whether access to the storage 240 is allowed. If the authentication information received by the authenticator 230 is “access prohibited”, the authenticator 230 may determine that authentication of access to the storage 240 of the host has failed. If the authentication information received by the authenticator 230 is “access prohibited”, the controller 220 may prevent the data stored in the storage 240 from being transmitted to the host side.

If the authentication information received by the authenticator 230 is “access allowed”, the authenticator 230 may determine that authentication of access to the storage 240 of the host is successful. If the authentication information received by the authenticator 230 is “access allowed”, the controller 220 may transmit data stored in the storage 240 to the host side.

In the present invention, in the access authentication of the storage 240, the authentication process is automatically performed by the authentication unit 230 and the control unit 220 and the access record for the communication network of the authentication unit 230 is stored in the authentication server. . Therefore, since the user cannot intervene in the authentication process, it is impossible to imitate authentication falsely, and the authentication information can be secured.

In addition, since the authentication process of the authentication unit 230 and the control unit 220 is processed in hardware, there is less risk of software hacking.

In addition, since the authentication server is managed by a network service provider, it is very difficult for a third party to imitate the authentication environment. Even if a third party forcibly separates and reads the memory chip of the storage 240, since the controller 220 encrypts and stores the data, it is difficult to interpret the stored data.

3 is an operation flowchart illustrating a storage security method according to an embodiment of the present invention.

The storage security method controls access to storage that sends data to and receives data from the host.

Referring to FIG. 3, the storage security method requests authentication information from the authentication server via a communication network in operation S310.

The storage security method receives the requested authentication information from the authentication server (S320).

The storage security method determines whether to transmit data to the host according to the received authentication information.

The storage security method determines whether the received authentication information is "storage access allowed" (S330).

The storage security method transmits data to the host when the received authentication information is "storage access permission" (S340).

The storage security method prohibits access of the host to the storage unless the received authentication information is “storage access allowed” (S350).

According to an embodiment, the storage security method may, when authentication information is requested to the authentication server, the authentication server may store a record of the request.

According to an embodiment, step S310 may request authentication information from the authentication server when the host accesses data stored in the storage.

4 is an operational flowchart illustrating a storage security method according to another embodiment of the present invention.

Referring to FIG. 4, the storage security method detects power supply to the storage (S410).

If the storage security method is detected that the power supply for the storage, the authentication information is requested to the authentication server via the communication network (S420).

In the storage security method, when authentication information is requested, the authentication server stores a record of the request (S470).

The storage security method receives authentication information from an authentication server via a communication network (S430).

The storage security method determines whether the received authentication information is "storage access allowed" (S440).

The storage security method allows the host to access the storage when the received authentication information is "storage access permission" (S450).

The storage security method prohibits the host's access to the storage if the received authentication information is not “storage access allowed” (S460).

The storage security method according to the present invention can be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

1 is a diagram illustrating a storage security system according to an embodiment of the present invention.

2 is a diagram illustrating a storage security device 200 according to another embodiment of the present invention.

3 is an operation flowchart illustrating a storage security method according to an embodiment of the present invention.

4 is an operational flowchart illustrating a storage security method according to another embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: authentication server 120: mobile communication network

130: storage

210: host interface unit 220: control unit

230: authentication unit 240: storage

Claims (17)

A host interface for transmitting and receiving data to and from the host; Storage for storing data received via the host interface unit; And An authentication unit that receives authentication information via a communication network and authenticates access to the storage based on the received authentication information. Storage security device comprising a. The method of claim 1, A controller for determining whether to transmit data stored in the storage to the host according to the authentication information Storage security device further comprising. The method of claim 2, The control unit And encrypting the data received from the host interface unit and storing the data in the storage. The method of claim 1, The authentication unit Requesting the authentication information to an authentication server via the communication network, And receiving the authentication information from the authentication server. The method of claim 4, wherein The authentication unit And requesting the authentication information when power is applied. The method of claim 4, wherein And when the authentication unit requests the authentication information to the authentication server, a record of the request is stored in the authentication server. The method of claim 6, The record of the request is And at least one of the date, time, or place where the request was made. The method of claim 1, The authentication information is And whether access to said storage is permitted. Authentication server; And Storage for requesting authentication information to the authentication server via a communication network Including, When the storage server requests the authentication information, the authentication server transmits the authentication information to the storage via the communication network. And the storage receives the transmitted authentication information and determines whether to transmit data to a host according to the received authentication information. The method of claim 9, The authentication server And when the storage requests the authentication information, stores a record of the request. The method of claim 9, The storage is When the power is applied, the storage security system, characterized in that for requesting the authentication information to the authentication server. The method of claim 9, The communication network Storage security system, characterized in that the cellular communication based mobile communication network. In the storage security method for controlling access to the storage to send and receive data to the host, Requesting authentication information from the authentication server via a communication network; Receiving the requested authentication information; And Determining whether to transmit data to the host according to the received authentication information Storage security method comprising a. The method of claim 13, Requesting authentication information to the authentication server And requesting the authentication information to the authentication server when power is applied to the storage. The method of claim 13, Requesting authentication information to the authentication server And when the host accesses data stored in the storage, requesting the authentication information from the authentication server. The method of claim 13, If authentication information is requested to the authentication server, storing the record of the request by the authentication server Storage security method further comprising. A computer-readable recording medium in which a program for executing the method of any one of claims 13 to 16 is recorded.

Images