KR20200098872A - Trustworthy remote erasure for unmanned aerial vehicle - Google Patents

Abstract

Disclosed is a reliability-guaranteed remote data deletion technology for an unmanned aerial vehicle. According to one embodiment of the present invention, a remote data deletion method performed by a remote data deletion system comprises the steps of: performing periodic authentication with a mutually authenticated user through an initialization process by an electronic device; and remotely deleting data stored in the electronic device based on a timer-based counter value changed in accordance with whether the authentication with the user succeeds from the electronic device.

Description

Reliable remote data erasure technology for unmanned aerial vehicles {TRUSTWORTHY REMOTE ERASURE FOR UNMANNED AERIAL VEHICLE}

The following description relates to a reliability guarantee type remote data deletion system for an electronic device and a method of providing the same.

As the area in which embedded devices are used is widely expanded, drones are actively used in the military area for the purpose of reducing manpower loss. Military drones are used as weapons to perform missions to strike key targets at long distances, or perform missions such as collecting intelligence on key enemy facilities and targets.

However, since drones performing missions often contain confidential information related to the military domain, if the military device is stolen or shot down and loses control over the device, the possibility of the stored confidential data being stolen increases. Accordingly, drones used in the military are required to completely delete embedded data so that it is impossible to recover when it is out of control of the user, and a guarantee technology that can verify that the deletion has been performed is required.

Reference materials: KR10-2015-0129601, KR10-1791351

It performs periodic authentication between the remotely existing drone and the user, and if the authentication cannot be performed until the specified time has elapsed, the data stored in the drone is safely deleted and the evidence that the deletion operation has been performed is delivered to the user and stored in the drone. A method and system can be provided that can ensure that data has been deleted.

When the data stored in the drone is deleted, it is possible to provide a method and system that makes it impossible to recover the data, thereby removing the risk that the user who has stolen or acquired the drone can recover the data later and use the data.

Despite the loss of communication between the drone and the user, the data stored in the drone is safely deleted, and evidence that the deletion operation has been performed is sent to the user so that a safe and verifiable deletion can be performed on a drone that has lost communication. Methods and systems can be provided.

The remote data deletion method performed by the remote data deletion system includes: performing, by an electronic device, periodic authentication with a mutually authenticated user through an initialization process; And remotely deleting data stored in the electronic device based on a timer-based counter value that is changed according to whether or not authentication with the user succeeds.

The remote data deletion method may further include verifying deletion of data by verifying a deletion operation on the remotely deleted data.

The performing of the periodic authentication may include exchanging an authentication message based on a hash chain between the user and the electronic device as mutual authentication with the user is performed.

The performing of the periodic authentication may include a counter of the electronic device when a result of calculating the authentication request message transmitted from the user in the electronic device and a comparison result obtained by comparing a hash value stored in the electronic device are identical. It may include resetting the value and updating the hash value.

The performing of the periodic authentication may include changing a count value every specific period when the electronic device does not receive the hash value of the user.

The performing of the periodic authentication may include retransmitting an authentication re-request message to the electronic device when the user does not receive an authentication success message in response to the authentication request message transmitted to the electronic device.

The remote deletion of the data may include performing an XOR operation on each data area to perform a deletion operation when the count value becomes a preset value as the count value of the electronic device changes.

The data area may be classified into a data area including cold data storing a fixed value, accumulated data storing data generated by performing a photographing in an electronic device, and hot data updating the modified data.

The step of remotely deleting the data may include deleting the cold data using a last hash value received from the user.

The remote erasing of the data may include performing a deletion operation using an accumulated data value for an arbitrary location among the accumulated data.

The remote deletion of the data may include performing a deletion operation using a hot data value for an arbitrary location among the hot data.

The step of verifying the deletion of the data may include transmitting to the user evidence that the deletion operation for the remotely deleted data has been performed on the basis of a hash chain. I can.

The verifying the deletion of the data may include repeatedly performing a deletion operation for each of the cold data, accumulated data, and hot data.

In verifying the deletion of the data, until the last block of each of the cold data, accumulated data, and hot data is changed to a new value, one round is defined, and the defined round is performed multiple times to Regardless of the type, the deletion operation may be performed, and the hash value of the last block of each data obtained by performing the plurality of rounds may be transmitted to the user as deletion evidence.

The performing of the periodic authentication includes sharing an encryption key to be used for the authentication between the electronic device and the user, and using the shared encryption key from the user, the maximum number of times ( The message generated by encryption based on n) is transmitted to the electronic device, and the electronic device decrypts the message using the shared encryption key to check the numeric data and the maximum number of times that can be authenticated, and the Calculate a hash value based on the verified numeric data and the maximum number of authentication possible to store the maximum number of authentication possible and the calculated hash value, and transmit the calculated hash value to the user, and the electronic device from the user And performing an initialization process of performing mutual authentication between the electronic device and the user by checking the arbitrary numeric data and the maximum number of times that can be authenticated based on the hash value received from.

The computer-implemented computing protection system includes at least one processor implemented to execute a command readable in the computer, and the at least one processor performs periodic authentication with a user whose electronic device mutually authenticates through an initialization process. The process of performing; And remotely deleting data stored in the electronic device based on a timer-based counter value that is changed according to whether or not authentication with the user succeeds.

Counter-based periodic authentication between the remotely existing drone and the user is performed, and if the authentication is not performed until a certain time has elapsed by the counter value built into the drone, the data stored in the drone can be deleted, and the drone is stolen. Even if communication with the user is impossible due to an unexpected accident, the data stored in the drone is deleted, so that the data cannot be used outside the user's control, thereby improving security.

In addition, when data is deleted, it is possible to prevent data from being used even if a drone that has terminated the deletion operation later by deleting the data so that it cannot be recovered is stolen by a malicious user or acquired accidentally.

In addition, after deleting the data, it is possible to verify whether the data has been deleted by transmitting evidence informing the user that the deletion operation has been performed.

1 is a diagram illustrating an environment to which a remote data deletion system according to an exemplary embodiment is applied.
2 is a block diagram illustrating a configuration of a remote data deletion system according to an embodiment.
3 is an example for explaining performing periodic authentication in a remote data deletion system according to an embodiment.
4 is a flowchart illustrating a timer-based remote data deletion method of an electronic device according to an exemplary embodiment.
5 is an example for explaining retransmission of an authentication request message in a remote data deletion system according to an embodiment.
6 is a flowchart illustrating a remote data deletion method of another electronic device according to an exemplary embodiment.
7 is a diagram illustrating a data structure of a remote data deletion system according to an exemplary embodiment.
8 to 11 are diagrams for explaining a deletion operation of a remote data deletion system according to an embodiment.
12 is an example for explaining transmission of evidence for a deletion operation in a remote data deletion system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The following embodiment enables counter-based periodic authentication between a remotely existing unmanned aerial vehicle (drone) and a user, and if the authentication is not performed within a set time, the data stored in the unmanned aerial vehicle cannot be recovered. After securely deleting the drone, it transmits evidence of deletion to the user so that the user can prove whether the data stored on the drone is deleted, and the data stored on the drone can be read or recovered even if the drone is lost or stolen. It relates to a system and a method of providing the same.

1 is a diagram illustrating an environment in which a reliability guaranteed remote data deletion system for a drone is applied according to an exemplary embodiment.

Reliability-guaranteed remote data deletion system for drones (hereinafter referred to as'remote data deletion system') is data between the electronic device 101 and the user 102 communicating with the electronic device 101 remotely. This can be done in an environment that performs transmission and reception. At this time, the user 102 may transmit the authentication message 104 to the electronic device 101, and as the electronic device 101 receives the authentication message 104 from the user 102, the authentication message 104 Thus, it is possible to respond with an authentication confirmation message 103.

The electronic device 101 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the electronic device 101 include a smart phone, a mobile phone, a navigation system, a computer, a notebook computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), and a tablet PC. The electronic device 101 may communicate with other electronic devices (user's electronic devices)/users through a network using a wireless or wired communication method. In the embodiment, the electronic device 101 may be a military device such as a drone (UAV), and a remote data deletion system in the electronic device 101 may be driven in the form of a platform or program. Likewise, the remote data deletion system can be operated in the form of a platform or program on other electronic devices to delete reliability-guaranteed remote data for drones through data transmission and reception between the user and the drone. For example, another electronic device may be a user terminal or a server that controls the electronic device 101. In the following description, it will be described as a user to help understand the description of other electronic devices. In addition, each variable used in the examples will be described first.

2 is a block diagram illustrating a configuration of a reliability guaranteed remote data deletion system for a drone according to an embodiment.

The remote data deletion system 100 may include a counter module 201, an authentication module 202, an encryption/decryption module 203, a communication module 204, and a deletion module 205. Depending on the implementation, the remote data deletion system may further include an auxiliary power module for stability.

The counter module 201 is used to count from the point when the drone is authenticated with the user.

The authentication module 202 and the communication module 204 are used for periodic authentication with a user.

The communication module 204 may provide a function for a user and an electronic device to communicate with each other. When a user and an electronic device communicate with each other, the communication method is not limited, and not only a communication method using a communication network (for example, a mobile communication network, wired Internet, wireless Internet, broadcasting network), but also a short distance between devices. Wireless communication may also be included. For example, the network is a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), and the Internet. May include any one or more of the networks of. In addition, the network may include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree, or a hierarchical network, but is not limited thereto. .

The encryption/decryption module 203 is used to perform an encryption operation and a hash operation used when an electronic device performs periodic authentication.

The deletion module 205 is used to perform a deletion operation and transmit the deletion evidence to the user when authentication is not performed until the counter value built in the electronic device reaches a specific value.

Additionally, an auxiliary power module for independently operating even after the electronic device is powered off may be included.

3 is an example for explaining performing periodic authentication in a remote data deletion system according to an embodiment.

In FIG. 3, periodic authentication between the user 102 and the electronic device 101 will be described. In this case, the electronic device 101 may be an unmanned aerial vehicle.

The encryption used in the remote data deletion system uses the same key for decrypting the encrypted message by the electronic device 101 and the user, and before performing periodic authentication, the electronic device 101 and the user 102 securely use the encryption key. 305 can be shared, and it can be assumed that the encryption key is not exposed.

)(306). 이때, 임의의 숫자 데이터를 시드값으로 사용할 수 있다. The user 102 may transmit the generated message 302 to the electronic device by encryption based on arbitrary numeric data (x) and the maximum number of times that can be authenticated (n) using the shared encryption key (

)(306). In this case, arbitrary numeric data can be used as a seed value.

)(304). 사용자(102)로부터 전자 기기(101)로부터 전달받은 해시값에 기반하여 임의의 숫자 데이터와 인증 가능한 최대 횟수를 확인하여 전자 기기(101)와 사용자(102)의 상호 인증을 수행하는 초기화 과정(305)을 수행할 수 있다. 이때, 사용자(102)와 동일한 키를 공유한 전자 기기(101)만이 암호화된 메시지를 복호화하여 인증 가능한 최대 횟수와 숫자 데이터를 알아낼 수 있으며, 해시 함수는 단방향 함수이므로 사용자(102)는 전자 기기(101)가 정확한 인증 가능한 최대 횟수와 숫자 데이터를 받았는지 확인하고 상대방이 전자 기기(101)임을 확신할 수 있다. The electronic device 101 decrypts the message 302 transmitted from the user 102 using a shared encryption key to check the numeric data and the maximum number of times that can be authenticated, and a hash based on the identified numeric data and the maximum number of times that can be authenticated. The value (h ⁿ (x)) can be calculated. The electronic device 101 may store 303 the maximum number of times that can be authenticated and the calculated hash value, and transmit the calculated hash value to the user (

) (304). Initialization process 305 of performing mutual authentication between the electronic device 101 and the user 102 by checking arbitrary numeric data and the maximum number of times that can be authenticated based on the hash value received from the electronic device 101 from the user 102 ) Can be performed. At this time, only the electronic device 101 that shares the same key as the user 102 can decrypt the encrypted message to find out the maximum number of times that can be authenticated and the numeric data. Since the hash function is a one-way function, the user 102 It is possible to confirm that the counterpart is the electronic device 101 by checking whether 101) has received the correct maximum number of authentication and numeric data.

)(306)가 전자 기기(101)에게 전송될 수 있다. 인증 요청 메시지를 수신한 전자 기기(101)가 인증 요청 메시지를 계산하여 결과값을 저장할 수 있다(307). 전자 기기(101)가 인증 요청 메시지를 계산한 결과값과 전자 기기(101)에 저장된 해시값을 비교한 비교 결과에 기초하여 인증 성공 메시지(

)(308)를 사용자(102)에게 전달할 수 있다. 다시 말해서, 전자 기기(101)는 카운트 값의 재설정을 완료한 것과 관련된 인증 성공 메시지를 사용자(102)에게 전달하게 된다. The electronic device 101 and the user 102 mutually authenticated through the initialization process 305 may perform periodic authentication. As mutual authentication between the electronic device 101 and the user 102 is performed, an authentication message based on a hash chain may be exchanged between the user 102 and the electronic device 101. For example, an authentication request message from the user 102 (

) 306 may be transmitted to the electronic device 101. The electronic device 101 receiving the authentication request message may calculate the authentication request message and store the result value (307 ). Based on the comparison result of comparing the result of calculating the authentication request message by the electronic device 101 with the hash value stored in the electronic device 101, the authentication success message (

) 308 to the user 102. In other words, the electronic device 101 transmits an authentication success message related to the completion of resetting the count value to the user 102.

Specifically, a timer-based remote data deletion method will be described with reference to FIG. 4. The electronic device may wait for communication while moving its location (idle state) 401. The electronic device may receive an authentication request message from the user (402). The electronic device may determine whether authentication is successful by comparing a result of calculating the authentication request message to the electronic device transmitted from the user with a hash value stored in the electronic device (403). In this case, if the result of comparing the authentication request message with the hash value stored in the electronic device does not match, the electronic device may return to the communication standby state. In addition, when the comparison result is identical, the counter value of the electronic device may be reset and the hash value may be updated (404). With the count value reset, if communication is good, the exchange of messages can be repeated several times (up to the maximum number of times that can be authenticated). In this case, when the maximum number of times that can be authenticated is exceeded, the user and the electronic device may exchange a new maximum number of times that can be authenticated and arbitrary numeric data.

As the electronic device resets the count value, the electronic device may change the count value every specific period (405). For example, if the electronic device does not receive the user's authentication request message until a specific time, the electronic device may change the count value every preset period. For example, the count value may decrease by 1 every second. In addition, the count value may increase or decrease periodically or aperiodically. In this case, if the periodic authentication of the electronic device and the user is continuously successfully performed, the electronic device does not reach a count value for performing a data deletion operation by repeatedly resetting a count value built into the electronic device.

When the electronic device reaches a preset value (eg, 0) as the count value changes, the data may be remotely deleted by performing a delete operation on each data area (406 ). In this case, the preset value may mean a count value at which the deletion operation is performed. The electronic device may verify whether the data is deleted by verifying the deletion operation on the remotely deleted data. In other words, the electronic device may transmit the deletion evidence to the user (407).

5 is an example for explaining retransmission of an authentication request message in a remote data deletion system according to an embodiment.

In FIG. 5, when communication between the user 102 and the electronic device 101 is disconnected, transmission of an authentication re-request message will be described. In other words, when message authentication fails in FIG. 4, an authentication re-request message may be transmitted. Communication may be cut off for some reason, such as loss of control of the electronic device from the user.

)(502)를 전자 기기(101)에게 전송하였으나, 전자 기기(101)가 인증 요청 메시지를 수신하지 못한 경우, 전자 기기에 저장된 값은 업데이트되지 않으며, 전자 기기에 내장된 카운터 값 역시 리셋되지 않는다(501). 이러한 인증을 수행하지 못한 전자 기기(101)는 사용자(102)에게 인증을 수행했음을 알리는 인증 확인 메시지를 보내지 않는다. In an environment assuming that authentication between the user and the electronic device is performed i (i is a natural number), the user 102 sends an authentication request message (

) 502 is transmitted to the electronic device 101, but the electronic device 101 does not receive the authentication request message, the value stored in the electronic device is not updated, and the counter value built in the electronic device is not reset. (501). The electronic device 101 that fails to perform such authentication does not send an authentication confirmation message to the user 102 informing that the authentication has been performed.

)(503)를 전송할 수 있다. 이때, 인증 재요청 메시지는 이미 메시지를 전송하였으나, 메시지에 대한 응답을 수신하지 못한 인증 요청 메시지(502)에 포함된 동일한 값과 함께 리플레이 공격을 방지하기 위한 넌스값, 재전송임을 알리는 비트(r 비트)가 암호화되어 포함될 수 있다. 사용자로부터 인증 재요청 메시지를 수신한 전자 기기(101)는 r 비트를 확인하고 재전송을 인식하여 전자 기기에 저장된 해시값과 수신된 결과값이 동일한지 확인할 수 있다. 이러한 값이 동일할 경우, 전자 기기는 다음 해시값에 대한 요청을 의미하는 값(n-i)를 다시 사용자에게 전송할 수 있다. 구체적으로, 사용자가 인증 요청 메시지를 보내고 전자 기기가 해당 메시지를 정상적으로 수신하여 해시값을 업데이트하고 카운트 값을 리셋시킨 후, 전자 기기가 응답 메시지를 보냈으나 사용자가 응답 메시지를 수신하지 못한 경우가 존재할 수 있기 때문에 재전송의 경우, 전자 기기는 사용자로부터 전달받은 값에 대한 해시 계산을 하지 않았음에도 불구하고 전자 기기에 저장되어 있는 값과 일치할 경우, 응답 메시지만을 전송할 수 있다. 이때, 해시값 및 카운트 값의 업데이트는 없다. 만약, 수신한 결과값의 해시 계산 결과값이 전자 기기에 저장된 값과 일치할 경우, 저장된 해시값과 카운트 값을 업데이트한다. 다시 말해서, 재전송의 상황에서는 저장된 해시값과 수신된 값이 동일할 경우, 카운트가 리셋되지 않는다. 사용자와 전자 기기는 다시 정상적인 통신을 시작할 수 있다. If the user who has not received the authentication confirmation message of the electronic device for the authentication request message transmitted from the user 102, the authentication re-request message for requesting authentication from the electronic device 101 again (

) 503 can be transmitted. At this time, the authentication re-request message is a nonce value for preventing replay attacks, along with the same value included in the authentication request message 502 that has already transmitted the message, but did not receive a response to the message, a bit indicating that the retransmission is ) May be encrypted and included. Upon receiving the authentication re-request message from the user, the electronic device 101 may check the r bits and recognize the retransmission to determine whether the hash value stored in the electronic device and the received result value are the same. If these values are the same, the electronic device may transmit the value ni indicating a request for the next hash value to the user again. Specifically, after the user sends an authentication request message and the electronic device normally receives the message, updates the hash value and resets the count value, there may be a case where the electronic device sends a response message but the user does not receive the response message. Therefore, in the case of retransmission, the electronic device can only transmit a response message if the value stored in the electronic device matches the value stored in the electronic device even though it has not calculated the hash of the value received from the user. At this time, there is no update of the hash value and the count value. If the hash calculation result value of the received result value matches the value stored in the electronic device, the stored hash value and the count value are updated. In other words, in the case of retransmission, if the stored hash value and the received value are the same, the count is not reset. The user and the electronic device can resume normal communication.

)(504)를 사용자(102)에게 특정 주파수를 사용하여 전송할 수 있다. 이때, 전자 기기(101)는 삭제 연산에 대한 삭제 증거 송신 메시지(504)를 전송한 이후에도, 다시 삭제 연산에 대한 검증을 수행함으로써 삭제 증거 송신 메시지(504)를 계속적으로 사용자(102)에게 전달할 수 있다. Also, the number of times the authentication re-request message is transmitted may be set. The number of times the authentication re-request message is transmitted can be changed without limitation depending on the purpose of using the system and the required security strength. For example, if the electronic device 101 does not receive an authentication re-request message transmitted once or multiple times by the user 102, the electronic device 101 can recover data stored in the electronic device 101. It is possible to perform a delete operation that is impossible and can identify that the user 102 has been deleted. A deletion evidence transmission message indicating that the deletion operation has been performed from the electronic device 101 (

) 504 can be transmitted to the user 102 using a specific frequency. At this time, the electronic device 101 may continuously transmit the deletion evidence transmission message 504 to the user 102 by performing verification on the deletion operation again even after transmitting the deletion evidence transmission message 504 for the deletion operation. have.

마다 전자 기기에게 메시지를 송신할 수 있다(602). 이때,

는 카운트 최대값(카운트가

에 도달하면 삭제 시작),

는 인증 재요청 횟수를 의미한다. 사용자는 메시지를 전자 기기에게 전달함에 따라 전자 기기로부터 메시지를 수신할 수 있다(603). 이때, 전자 기기로부터 수신된 메시지에 기초하여 인증 성공 여부를 판단할 수 있다(605). 예를 들면, 사용자는 전자 기기로부터 수신된 메시지가 인증 성공 메시지일 경우, 해시값을 업데이트할 수 있고(606), 통신을 대기할 수 있다(601). 또한, 사용자로부터

마다 전자 기기에게 메시지를 전송하였음에도

동안 전자 기기로부터 메시지를 미수신할 경우, 인증 재요청 메시지를 전송할 수 있다(604). 전자 기기가 인증 재요청 메시지를 수신할 경우, 인증 재요청 메시지에 대한 응답으로 메시지를 수신할 수 있다(603). 마찬가지로, 메시지에 기초하여 인증 성공 여부를 판단할 수 있다(605). Referring to FIG. 6, it is a flowchart illustrating a method of remote data deletion by a user. The deletion protocol that proceeds between the user and the electronic device will be described from the perspective of the user. The user can wait for communication (idle state) (601). User

A message can be transmitted to the electronic device every time (602). At this time,

Is the maximum value of the count (count is

To start deleting),

Means the number of re-requests for authentication. As the user transmits the message to the electronic device, the user may receive a message from the electronic device (603 ). In this case, it may be determined whether authentication is successful based on a message received from the electronic device (605). For example, if the message received from the electronic device is an authentication success message, the user may update the hash value (606) and wait for communication (601). Also, from the user

Even though I sent a message to the electronic device every time

If a message is not received from the electronic device during the process, an authentication re-request message may be transmitted (604). When the electronic device receives the authentication re-request message, it may receive a message in response to the authentication re-request message (603). Likewise, it may be determined whether authentication is successful based on the message (605).

7 is a diagram illustrating a data structure of a remote data deletion system according to an exemplary embodiment. The data area may be composed of an area including cold data 701, accumulated data 702, and hot data 703. In this case, it is assumed that the user is sure to confirm the address of each data area. The cold data 701 may mean data that is stored when the electronic device is operated by a user's control right and does not change when it exists remotely, and may correspond to, for example, firmware. The cold data 701 is a fixed value, and when the user is out of control, the value does not change from take-off to landing. In the remote data deletion system, it is assumed that the user knows the exact value of the cold data and its location in memory. Since this guarantees the proof power of the erasure evidence transmitted by the electronic device, cold data cannot be modified even once, so it can be implemented so that only read is possible by removing edit and write rights.

The accumulated data 702 is data for collecting information and means data generated by performing photographing. The accumulated data 702 is not modified after the data is generated remotely. Due to the characteristics of the accumulated data, it is not normally deleted after being recorded once, so the remote data deletion system separates the accumulated data as a new kind of cold data. When the accumulated data is generated, the electronic device transmits the corrected memory location value of the accumulated data as soon as it sends an authentication confirmation message to the user. In addition, in order to increase the proof of erasure proof, an arbitrary block is selected from the accumulated data at an arbitrary time and the memory location value and the memory value of the corresponding block are transmitted.

The hot data 703 may update data that is highly likely to be continuously modified in the electronic device. It can also be defined as data other than the cold data 601 and the accumulated data 602 of the system. Since hot data is constantly changing, a user who calculates erasure evidence through data stored in a memory in an electronic device must be aware of a modification operation of hot data. When the hot data is modified, the electronic device transmits a memory location of the modified hot data and a value of the hot data at the same time that an authentication confirmation message is sent to the user.

8 to 11 are diagrams for explaining a deletion operation of a remote data deletion system according to an embodiment.

The remote data deletion system may perform the deletion operation by performing an XOR operation on each data area when the count value becomes a preset value as the count value of the electronic device changes. For example, when a hash value is not received from the user, or when a counter built in the electronic device cannot be reset, the counter reaches a specified time, and data stored in the electronic device starts to be deleted.

Referring to FIG. 8, it is an example for explaining performing a cold data deletion operation. When the electronic device fails to perform the authentication process within a specific time, a cold data deletion operation may be performed. When the deletion operation is performed in the electronic device, the electronic device may first perform the deletion operation on the cold data. For cold data, since the user knows the location and value of the data in the memory, the delete operation can be performed immediately without the need for any preceding work. For example, the electronic device may delete a specific block of cold data with a value calculated by performing an XOR operation of a memory of a specific block of cold data and a last hash value received from a user. In the deletion operation, after the electronic device overwrites the first block of cold data with the last hash value received from the user (801), the XOR operation of the first block and the second block may be started. After overwriting the operation value obtained by performing the XOR operation of the first block and the second block of cold data on the second block, the XOR operation of the second block and the third block of cold data can be performed. The operation value of the XOR operation of the second block and the third block of cold data can also be stored in the third block of cold data. This process continues until the last block of cold data.

The deletion operation from the second cold data can be expressed by Equation 1 below.

Equation 1:

Referring to FIG. 9, it is an example for explaining the operation of deleting accumulated data. When the electronic device fails to perform the authentication process within a specific time, it is possible to perform a deletion operation of accumulated data. The electronic device may perform a deletion operation based on an accumulated data value for an arbitrary location among the accumulated data. For example, the deletion operation on the accumulated data of the system is performed on the accumulated data except for the randomly selected data block 902 after the authentication between the electronic device and the user is cut off, the changed location of the accumulated data is stored on the main memory. The cold data may be overwritten with the final calculation result (901). After this preceding operation, as shown in FIG. 9, the hash value and XOR operation of the block of accumulated data and the block of randomly selected accumulated data are performed, and the calculated operation value is overwritten in the corresponding block of accumulated data. I can.

The delete operation of an arbitrarily selected data block can be expressed as in Equation 2. Other accumulated data blocks may be calculated in the same manner as in Equation 1.

Equation 2:

퍼센트)를 선정할 수 있다. 또한, Y_n 시간에 임의의 블록을 선정한다면 Y_n-1 시간부터 현재 Y_n 사이에 생성된 임의 블록 개수의

퍼센트를 선정할 수 있다. 여기서, Y_n는 임의의 시간을 나타낸다. At this time, in the case of accumulated data, a partial ratio of the number of arbitrary blocks in proportion to Y _n -Y _n-1 (

Percent) can be selected. In addition, if a random block is selected at Y _n time, the number of random blocks generated between Y _n-1 time and the current Y _n

You can select a percentage. Here, Y _n represents an arbitrary time.

Referring to FIG. 10, it is an example for explaining performing a hot data deletion operation. For example, the electronic device may perform a deletion operation using a previous hot data value of the specific hot data based on a specific hot data value (random hot data value) among hot data. Alternatively, the electronic device may perform a deletion operation using a hot data value for an arbitrary location among hot data. The hot data deletion operation may store the location of the changed hot data on the main memory after authentication between the electronic device and the user is terminated, and then overwrite the location of the corresponding data with the final value of the cold data deletion operation (1001). After the preceding operation, the hot data deletion operation can be performed in the same manner as the accumulated data deletion operation. In other words, it is possible to perform an XOR operation with a hash value of a block of hot data and a block of randomly selected hot data, and overwrite the calculated operation value to a corresponding block of hot data.

The delete operation of the randomly selected hot data block can be expressed as in Equation 3. Other hot data blocks may be calculated in the same manner as in Equation 1.

Equation 3:

개의 임의의 블록을 선정할 수 있다. In the case of hot data, in proportion to the memory area allocated to the hot data

You can select any number of blocks.

Referring to FIG. 11, an operation for deleting each data may be repeatedly performed. One round can be defined until the last block is overwritten with a new value. Since the remote data deletion system aims at erasing data that cannot be recovered, the second round can be started by overwriting the XOR operation values of the last block and the first block to the first block. Even if the memory of the electronic device is acquired by performing a plurality of rounds, data cannot be recovered. From the second round, the delete operation can be performed regardless of the type of data classified by the remote data deletion system. The hash value of the last block of memory can be delivered to the user as evidence of deletion whenever one round is completed by performing a plurality of rounds. Exceptionally, in the first round, after XORing the last block value of the accumulated data and the last block value of the hot data, the hash operation value is transmitted as evidence for erasure.

Since the data deletion operation has a dependency on the data stored in the electronic device, a user who does not have the electronic device cannot generate evidence that the deletion has been successfully performed.

12 is an example for explaining transmission of evidence for a deletion operation in a remote data deletion system according to an embodiment.

It can be assumed that the user 102 owns an antenna 1201 capable of receiving a specific frequency. Evidence of deletion can be transmitted to the user whenever the final result of the operation (H _n '' or H _n '' or H _n '''' _..., etc.) is generated through a specific frequency. In this case, the first transmission message may include information on a memory changed after authentication is terminated together with evidence of the deletion operation. There is no need to include the changed memory information other than the first transmitted message. Evidence of deletion operation has a size of 64 bytes, and information on the address value of the changed data must be additionally transmitted after authentication is terminated. For example, it is assumed that the evidence of the deletion operation is transmitted through a binary low frequency called FSK, and in the remote data deletion system, the user has an antenna 1201 capable of receiving the binary low frequency.

The user may check whether the deletion of the electronic device has proceeded by comparing the calculation result and the received evidence 1202 of the deletion operation by calculating as follows. User can select memory location and value of cold data, memory location of accumulated data (aln), randomly selected accumulated data value and location of randomly selected data block 802, memory location and value of hot data (hln), and finally transfer One hash value 801, the address value of data that has changed since authentication was terminated, is known.

In the remote data deletion system according to an embodiment, the data generated by the unmanned aerial vehicle photographing is classified into a new type of data called accumulated data, and a feature of the accumulated data that is not modified after the data is generated remotely is deleted. Use. In addition, even when communication between the remotely existing unmanned aerial vehicle and the user is disconnected, data stored in the unmanned aerial vehicle is deleted through a counter-based basis, and the deletion operation evidence dependent on each data is transmitted to the user. In addition, the best effort method of repeatedly performing the deletion operation is used to increase the completeness of the deletion verification after communication is disconnected. In addition, security is generalized even if variables (such as memory capacity of hot data) are adjusted according to the situation.

The apparatus described above may be implemented as a hardware component, a software component, and/or a combination of a hardware component and a software component. For example, the devices and components described in the embodiments are, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, such as one or more general purpose computers or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications executed on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of software. For the convenience of understanding, although it is sometimes described that one processing device is used, one of ordinary skill in the art, the processing device is a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of these, configuring the processing unit to behave as desired or processed independently or collectively. You can command the device. Software and/or data may be interpreted by a processing device or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. Can be embodyed in The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described by the limited embodiments and drawings, various modifications and variations are possible from the above description by those of ordinary skill in the art. For example, the described techniques are performed in a different order from the described method, and/or components such as a system, structure, device, circuit, etc. described are combined or combined in a form different from the described method, or other components Alternatively, even if substituted or substituted by an equivalent, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and claims and equivalents fall within the scope of the claims to be described later.

Claims (16)

In the remote data deletion method performed by the remote data deletion system,
Performing, by the electronic device, periodic authentication with a mutually authenticated user through an initialization process; And
Remotely deleting data stored in the electronic device based on a timer-based counter value changed according to whether or not authentication with the user succeeds in the electronic device
Remote data deletion method comprising a. The method of claim 1,
Verifying deletion of data by verifying a deletion operation on the remotely deleted data
Remote data deletion method further comprising a. The method of claim 1,
The step of performing the periodic authentication,
Exchanging an authentication message based on a hash chain between the user and the electronic device as mutual authentication with the user is performed
Remote data deletion method comprising a. The method of claim 3,
The step of performing the periodic authentication,
If the result of calculating the authentication request message transmitted from the user in the electronic device matches the result of comparing the hash value stored in the electronic device, the counter value of the electronic device is reset, and the hash value is Steps to update
Remote data deletion method comprising a. The method of claim 4,
The step of performing the periodic authentication,
When the electronic device does not receive the user's hash value, the count value is changed every specific period.
Remote data deletion method comprising a. The method of claim 3,
The step of performing the periodic authentication,
When the user does not receive an authentication success message in response to the authentication request message transmitted to the electronic device, retransmitting an authentication re-request message to the electronic device
Remote data deletion method comprising a. The method of claim 1,
The step of remotely deleting the data,
If the count value becomes a preset value as the count value of the electronic device changes, performing an XOR operation on each data area to perform a deletion operation
Remote data deletion method comprising a. The method of claim 7,
The data area,
A method of remote data deletion, classified into a data area including cold data storing a fixed value, accumulated data storing data generated by photographing in an electronic device, and hot data updating the modified data. The method of claim 7,
The step of remotely deleting the data,
Deleting the cold data using the last hash value received from the user
Remote data deletion method comprising a. The method of claim 7,
The step of remotely deleting the data,
Performing a deletion operation through the accumulated data value for an arbitrary position among the accumulated data
Remote data deletion method comprising a. The method of claim 7,
The step of remotely deleting the data,
Performing a delete operation using a hot data value for an arbitrary location among the hot data
Remote data deletion method comprising a. The method of claim 2,
The step of verifying the deletion of the data,
Transmitting to the user evidence that the deletion operation on the remotely deleted data is performed on the basis of a hash chain to verify the deletion of each of cold data, accumulated data, and hot data
Remote data deletion method comprising a. The method of claim 12,
The step of verifying the deletion of the data,
Repeatedly performing a deletion operation for each of the cold data, accumulated data, and hot data
Remote data deletion method comprising a. The method of claim 13,
The step of verifying the deletion of the data,
One round is defined until the last block of each of the cold data, accumulated data, and hot data is changed to a new value, and the defined round is performed multiple times to perform a deletion operation regardless of the type of data, The step of passing the hash value of the last block of each data acquired by performing the plurality of rounds as deletion evidence to the user
Remote data deletion method comprising a. The method of claim 1,
The step of performing the periodic authentication,
Generated by sharing an encryption key to be used for authentication between the electronic device and the user, and encrypting it based on arbitrary numeric data (x) and the maximum number of times (n) that can be authenticated using the shared encryption key from the user The resulting message is transmitted to the electronic device, and the electronic device decrypts the message using the shared encryption key to check the number data and the maximum number of times that can be authenticated. Calculate a hash value based on the number of times to store the maximum number of times that can be authenticated and the calculated hash value, transmit the calculated hash value to the user, and based on the hash value received from the electronic device from the user. Performing an initialization process of performing mutual authentication between the electronic device and the user by checking arbitrary numeric data and the maximum number of times that can be authenticated
Remote data deletion method comprising a. In the computer-implemented computing protection system,
At least one processor implemented to execute computer-readable instructions
Including,
The at least one processor,
A process in which the electronic device performs periodic authentication with a mutually authenticated user through an initialization process; And
The process of remotely deleting data stored in the electronic device based on a timer-based counter value that is changed according to the success of authentication with the user in the electronic device
Remote data deletion system comprising a.

Images