WO2009066826A1

WO2009066826A1 - Storage security system and method using communication network

Info

Publication number: WO2009066826A1
Application number: PCT/KR2007/006295
Authority: WO
Inventors: Sung-Gab Lee; Jaejin Lee; Phoebe Min
Original assignee: Seoul National University Industry Foundation
Priority date: 2007-11-22
Filing date: 2007-12-06
Publication date: 2009-05-28
Also published as: KR20090053162A

Abstract

A storage security apparatus and method are provided. The storage security apparatus includes: a host interface unit transceiving data to/from a host; a storage storing the data received via the host interface unit; and an authentication unit receiving authentication information via a network, and authenticating an access to the storage based on the received authentication information. The storage security apparatus may authenticate an access to the data of the storage using the network. Also, when the storage is lost or stolen, whether another person accesses the storage may be verified by storing a record of an access to the storage in an authentication server during an authentication process of the storage.

Description

STORAGE SECURITY SYSTEMAND METHOD USING COMMUNICATION

NETWORK

Technical Field The present invention relates to a storage security apparatus and method, and more particularly, to security of at least one of a mobile storage and a portable storage. This work was supported by the IT R&D program of MIC/IITA. [2006-S-040-01, Development of Flash Memory-based Embedded Multimedia Software]

Background Art

\ storage storing data may be a magnetic disk, a semiconductor memory and the like. As the storage has been miniaturized due to improvement of storage manufacturing technology, various types of portable storages are developed.

A Universal Serial Bus (USB) memory drive having an interface of a USB scheme, a Secure Digital (SD) card, an external hard disk drive, a micro drive, and the like are widely used as the portable storages.

A μser of a portable storage may conveniently store a large amount of data in the portable storage, however, when the user loses the portable storage, a finder may easily access the data stored in the portable storage. Specifically, since the data stored in the conventional portable storage may be unlimitedly copied, modified, and deleted by a person having the portable storage, a demand for a security method of the portable storage increases.

Recently, a security method of assigning a secret number to the portable storage and disabling access to the data when a wrong secret number is inputted, and a security method using bio-information including fingerprint identification, iris identification, and the like in order to access the data stored in the portable storage are disclosed.

Since the security method using the bio-information needs an apparatus for recognizing the bio-information and needs a lot of computation for analyzing the bio- information, the portable storage becomes complex and a cost of the portable storage increases. A security method using computation power of a host by software for cost reduction is disclosed, however, a hazard of software hacking still remains.

The security method of assigning the secret number to the portable storage has a possibility that the secret number may be exposed by carelessness of the user.

Also, when the portable storage is lost or stolen, the conventionally-disclosed security methods may not know whether the data stored in the portable storage is leaked to others. Also, the conventionally-disclosed security methods may access the data stored in the portable storage by decoding the secret number by generating all possible secret numbers, or using the bio-information forged in advance.

Also, another person who has the lost or stolen portable storage may unlimitedly make an attempt for various methods in order to access the data stored in the portable storage. For example, the data may be accessed by separating a memory chip from the portable storage and directly reading the memory chip.

The present specification discloses a storage security apparatus and method which can strengthen security of a portable storage without increasing costs.

Disclosure of Invention Technical Goals

The example of present invention provides an apparatus and method of authenticating an access to data stored in a storage using a network.

The example of present invention also provides a system and method of authenticating whether an access to data stored in a storage is possible, and storing an access record of the storage in an authentication server when power is applied to the storage.

The example of present invention also provides an apparatus and method of verifying whether the data stored in a storage is accessed by another person when the storage is lost or stolen.

Technical solutions

According to an aspect of the present invention, there is provided a storage security apparatus including: a host interface unit transceiving data to/from a host; a storage storing the data received via the host interface unit; and an authentication unit receiving authentication information via a network, and authenticating an access to the storage based on the received authentication information.

According to another aspect of the present invention, there is provided a storage security system including: an authentication server; and a storage requesting authentication information to authentication server via a network, and when the storage requests the authentication information, the authentication server transmits the authentication information to the storage via the network, and the storage receives the transmitted authentication information and determines whether to transmit data to a host based on the received authentication information.

According to still another aspect of the present invention, there is provided a storage security method which controls access to a storage transceiving data with a host, the method including: requesting authentication information to authentication server via a network; receiving the requested authentication information; and determining whether to transmit data to the host based on the received authentication information.

Advantageous Effects

According to the example of the present invention, there is provided an apparatus and method of authenticating an access to data stored in a storage using a network.

Also, according to the example of the present invention, there is provided a system and method of authenticating whether an access to data stored in a storage is possible and storing an access record of the storage in an authentication server when a power is applied to the storage.

Also, according to the example of the present invention, there is provided an apparatus and method of verifying whether data stored in a storage is accessed by another person when the storage is lost or stolen.

Brief Description of Drawings

FIG. 1 is a diagram illustrating a storage security system according to an exemplary embodiment of the present invention;

FIG. 2 is a diagram illustrating a storage security apparatus 200 according to another exemplary embodiment of the present invention; FIG. 3 is a flowchart illustrating a storage security method according to an exemplary embodiment of the present invention; and

FIG. 4 is a flowchart illustrating a storage security method according to another exemplary embodiment of the present invention.

Best Mode for Carrying Out the Invention

Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. The embodiments are described below in order to explain the present invention by referring to the figures.

FJG. 1 is a diagram illustrating a storage security system according to an exemplary embodiment of the present invention. Referring to FIG. 1, the storage security system includes an authentication server 110 and a storage 130.

The storage 130 requests authentication information to the authentication server 110 via a mobile network 120. When the storage 130 requests the authentication information, the authentication server 110 transmits the authentication information to the storage 130 via the mobile network 120.

The authentication information corresponding to the storage 130 is stored in the authentication server 110 in advance. The authentication server 110 may update the authentication information corresponding to the storage 130 as required.

The storage 130_^ receives the transmitted authentication information, and determines whether to transmit data to a host based on the received authentication information.

Depending on exemplary embodiments, the mobile network 120 may be a mobile network based on a cellular scheme.

Depending on exemplary embodiments, the mobile network 120 may be at least one of a Code Division Multiple Access (CDMA) network and a Global System for Mobile communication (GSM) network.

The storage security system maintains security of the data of the storage 130 by using at least one of the CDMA network and the GSM network in which an accessible range are widest from among current mobile communication methods even though the storage 130 accesses the host from anywhere.

When the storage 130 requests the authentication information, the authentication server 110 may store a record of the request. The record of the request may include a date and a time in which the storage 130 requests the authentication information. The record of the request may also include location information, and a current location of the storage 130 may be traced based on the location information.

If a legitimate user's storage 130 is lost or stolen, the authentication server 110 stores the record of the request of the authentication information from the storage 130 when a third person makes an attempt to access the storage 130. The legitimate user can know a fact that the third person attempted to access the storage 130, a date of the attempted access, a time of the attempted access, and a location of the attempted access based on the record of the request of the authentication information from the storage 130, the record being stored in the authentication server 110.

When a legitimate user's storage 130 is lost or stolen, the legitimate user may report identification information and a fact of either loss or theft to the authentication server 110 and block an access of the third person to the storage 130.

When the third person makes the attempt to access the storage 130 after an access of the third person to the storage 130 is blocked, the authentication server 110 transmits the authentication information including contents of "access denied" to the storage 130.

When the storage 130 receives the authentication information including the contents of "access denied", the storage 130 may block an access of the host to the storage 130, thereby blocking an access of the third person to the storage 130.

Depending on exemplary embodiments, when the storage 130 is connected with the host and power is applied from the host to the storage 130, the storage 130 may request the authentication information to the authentication server 110. In this instance, by requesting the authentication information when the power is applied to the storage 130, a record of an access attempt to the storage 130 remains in the authentication server 110.

Depending on exemplary embodiments, each time the host attempts to access the data stored in the storage 130, the storage 130 may request the authentication information to the authentication server. In this case, the authentication server 110 may store a record of the attempted access for each access attempt to the storage 130.

If a network is the mobile network of the cellular scheme such as the CDMA network and the GSM network, the authentication server 110 may determine a spatial location of a cell in which the storage 130 is currently located. Accordingly, the authentication server 110 may be aware of a time when the attempt to access the storage 130 is made, and the spatial location. Referring to the access record stored in the authentication server 110, the legitimate user may know the time and the place in which the attempt to access the storage 130 is made.

Since authentication process via the network is automatically performed by hardware inside the storage in the present invention, a user cannot intervene in an authentication process. Accordingly, a user cannot deceptively imitate authentication.

And also since the authentication information is not accessed by user, the authentication information may not be easily exposed.

Also, since the present invention may be applied with other conventionally disclosed storage security schemes, a security function may be strengthened.

The host includes all terminals accessing the data stored in the storage 130 including a personal computer, a work station, a desktop computer, a laptop computer, a personal digital assistant, and the like.

FIG. 2 is a diagram illustrating a storage security apparatus 200 according to an exemplary embodiment of the present invention.

Referring to FIG. 2, the storage security apparatus 200 includes a host interface unit 210, a control unit 220, an authentication unit 230, and a storage 240. The host interface unit 210 transmits data to a host, and receives the data from the host.

The storage 240 stores the data received via the host interface unit 210. When the storage 240 receives a read command from the host interface unit 210, the storage 240 transmits the data corresponding to the read command, to the host interface unit 210. The authentication unit 230 receives authentication information via a network, and authenticates an access to the storage 240 based on the received authentication information. The authentication unit 230 requests the authentication information to an authentication server via the network. In this instance, the authentication unit 230 receives the requested authentication information from the authentication server. Depending on exemplary embodiments, when power is applied to the storage security apparatus 200, the authentication unit 230 may request the authentication information to the authentication server. Depending on exemplary embodiments, each time a host accesses the storage 240, the authentication unit 230 may request the authentication information to the authentication server.

When the authentication unit 230 requests the authentication information to the authentication server, a record of a request is stored in the authentication server. The record of the request includes a date and a time in which the request exists. Also, the record of the request includes a place in which the request was made.

The control unit 220 determines whether to transmit the data stored in the storage 240 to the host, based on the authentication information received by the authentication unit 230. The control unit 220 receives the data to be stored in the storage 240 from the host interface unit 210. The control unit 220 stores the data in the storage 240 by encrypting the data received from the host interface unit 210. Security of the data stored in the storage 240 may be strengthened by data encryption process of the control unit 220. The authentication information includes information about whether an access to the storage 240 is permitted. When the authentication information received by the authentication unit 230 is "access denied", the authentication unit 230 may determine that authentication of the host access to the storage 240 fails. When the authentication information received by the authentication unit 230 is "access denied", the control unit 220 prevents the data stored in the storage 240 from being transmitted to the host.

When the authentication information received by the authentication unit 230 is

"access permitted", the authentication unit 230 may determine that authentication of the host access to the storage 240 succeeds. When the authentication information received by the authentication unit 230 is "access permitted", the control unit 220 may transmit the data stored in the storage 240 to the host.

According to the present invention, in an access authentication of the storage 240, an authentication process is automatically performed by the authentication unit 230 and the control unit 220, and a record of an access of the authentication unit 230 to the network is stored in the authentication server. Accordingly, since a user cannot intervene in the authentication process, authentication may not be deceptively imitated, and the authentication information may be securely protected.

Also, since the authentication process of the authentication unit 230 and the control unit 220 is processed in hardware, a risk of software hacking is minimized.

Also, since the authentication server is managed by a network service provider, a third person cannot imitate an authentication environment. Since the control unit

220 encrypts and stores the data, the stored data with encryption may not be analyzed even when the third person forcibly separates and reads a memory chip of the storage

240.

FIG. 3 is a flowchart illustrating a storage security method according to an exemplary embodiment of the present invention.

The storage security method controls an access to a storage transmitting data to a host and receiving the data from the host.

Referring to FIG. 3, in operation S310, the storage security method requests an authentication information to an authentication server via a network.

In- operation S320, the storage security method receives the requested authentication information from the authentication server. The storage security method determines whether to transmit data to the host, based on the received authentication information.

In operation S330,, the storage security method determines whether the received authentication information is "storage access permitted".

In operation S340, when the received authentication information is "storage access permitted", the storage security method transmits the data to the host.

In operation S350, when the received authentication information is different from "storage access permitted", the storage security method prohibits an access of the host to the storage.

Depending on exemplary embodiments, when the authentication information is requested from the authentication server, the storage security method may store a record of a request to the authentication server.

Depending on exemplary embodiments, in operation S310, when the host accesses the data stored in the storage, the authentication information may be requested to the authentication server. FIG. 4 is a flowchart illustrating a storage security method according to another exemplary embodiment of the present invention.

Referring to FIG. 4, in operation S410, the storage security method senses a power applied to storage.

In operation S420, when the storage security method senses the power applied to the storage, the storage security method requests authentication information to an authentication server via a network. In operation S470, when the authentication information is requested, the storage security method stores a record of a request to the authentication server.

In operation S430, the storage security method receives the authentication information from the authentication server via a network.

In operation S440, the storage security method determines whether the received authentication information is "storage access permitted".

In operation S450, when the received authentication information is "storage access permitted", the storage security method permits the host access to the storage.

In operation S460, when the received authentication information is different from "storage access permitted", the storage security method prohibits the host access to the storage.

The storage security method, according to the exemplary embodiments of the present invention, may be implemented as program instructions which can be executed on various types of computers and may be recorded in computer-readable media. The media may also include, alone or in combination with the program instructions, data files, data structures, and the like. The program instructions recoded in the said media, may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable media include magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD ROM disks and DVD; magneto-optical media such as optical disks; and memory devices that are specially configured to store and perform program instructions, such as read-only memory (ROM), random access memory (RAM), flash memory, and the like. Examples of program instructions include both machine code, such as produced by a compiler, and files containing higher level code that may be executed by the computer using an interpreter. The described hardware devices may be configured as one or more software modules in order to perform the operations of the above-described, embodiments of the present invention, vice versa. The foregoing descriptions of specific embodiments of the present invention have been presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed, and obviously many modifications and variations are possible in light of the above teaching. Therefore, it is intended that the scope of the invention be defined by the claims appended thereto and their equivalents.

Although a few embodiments of the present invention have been shown and described, the present invention is not limited to the described embodiments. Instead, it would be appreciated by those skilled in the art that changes may be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A storage security apparatus comprising: a host interface unit transceiving data to/from a host; a storage storing the data received via the host interface unit; and an authentication unit receiving authentication information via a network, and authenticating the access to the storage based on the received authentication information.

2. The apparatus of claim 1, further comprising: a control unit determining whether to transmit the data stored in the storage to the host based on the authentication information.

3. The apparatus of claim 2, wherein the control unit encrypts the data received from the host interface unit, and stores the encrypted data in the storage.

4. The apparatus of claim 1, wherein the authentication unit requests the authentication information to an authentication server via the network, and receives the authentication information from the authentication server.

5. The apparatus of claim 4, wherein, when power is applied, the authentication unit requests the authentication information.

6. The apparatus of claim 4, wherein, when the authentication unit requests the authentication information to the authentication server, a record of the request is stored in the authentication server.

7. The apparatus of claim 6, wherein the record of the request includes at least one of a date, a time, and a place where the request was made.

8. The apparatus of claim 1, wherein the authentication information includes information about whether an access to the storage is permitted.

9. A storage security system comprising: an authentication server; and a storage requesting authentication information to the authentication server via a network, and when the storage requests the authentication information, the authentication server transmits the authentication information to the storage via the network, and the storage receives the transmitted authentication information and determines whether to transmit data to a host, based on the received authentication information.

10. The system of claim 9, wherein, when the storage requests the authentication information, the authentication server stores a record of the request.

11. The system of claim 9, wherein, when power is applied, the storage requests authentication information to the authentication server.

12. The system of claim 9, wherein the network is a mobile network based on a cellular scheme.

13. A storage security method which controls an access to a storage transceiving data with a host, the method comprising: requesting authentication information to an authentication server via a network; receiving the requested authentication information; and determining whether to transmit data to the host based on the received authentication information.

14. The method of claim 13, wherein, when power is applied to the storage, the requesting requests the authentication information to the authentication server.

15. The method of claim 13, wherein, when the host accesses the data stored in the storage, the requesting requests the authentication information to the authentication server.

16. The method of claim 13 , further comprising: storing a record of a request via the authentication server when the authentication information is requested from the authentication server.

17. A computer-readable recording medium storing a program for implementing the method according to any one of claims 13 through 16.