WO2014107060A1

WO2014107060A1 - Apparatus for securing mobile data and method therefor

Info

Publication number: WO2014107060A1
Application number: PCT/KR2014/000081
Authority: WO
Inventors: 문성건; 장상근; 박세현
Original assignee: 주식회사 안랩
Priority date: 2013-01-07
Filing date: 2014-01-06
Publication date: 2014-07-10
Also published as: KR101473656B1; KR20140089703A

Abstract

The present invention relates to an apparatus for securing mobile data and a method therefor. The disclosed apparatus for securing mobile data includes: a data security control unit for obtaining a security token and the additional information and seed used in the generation of the security token from a server stage to request encoding or decoding of the data by using the security token; and a data security processing unit for generating a verifying token based on the additional information and seed supplied from the data security control unit to process the requested encoding or decoding of the data if the security token matches the verifying token.

Description

Mobile data security devices and methods

The present invention relates to mobile data security, and more particularly, to a mobile data security device and method for supporting secure storage of sensitive data requiring security in a mobile terminal device.

Recently, due to the development of mobile communication technology as well as wired and wireless Internet, mobile phones having various functions such as wireless Internet function as well as simple telephone call function have been spreading. In particular, the smart phone (smartphone) that has been recently spreading can install a variety of application programs that operate in a mobile operating system, for this reason users are using the smartphone for various purposes.

Smartphones are equipped with mobile operating systems such as Android, an operating system (i-OS), and windows mobile, and development of application programs that can be executed in various mobile operating systems is being actively performed.

Mobile terminal devices such as smart phones have a lot of sensitive data such as personal information, financial information, or game money due to the characteristics of the device, and are always exposed to the threat of leakage of such information. Therefore, such a mobile terminal device should be sought to securely store important data requiring security.

According to the prior art, a partition of a removable storage device is divided into an encrypted secure partition and a regular partition, a specific code is inserted into a master boot record to protect the secure partition, and a hash value of a password when the secure partition encrypts and decrypts information. If the user is authenticated as a valid user during decryption, the encrypted security partition information is decrypted and stored in a general partition table.

However, according to the related art, since the security processing is performed by the mobile storage device alone, the data security cannot be guaranteed if the mobile storage device is seized by a malicious subject, and a password for encryption and decryption is exposed. In this case, there was a problem that the security of the data cannot be guaranteed.

Embodiment of the present invention, the security of the data through the collaboration with the server side that operates in isolation from malicious behavior in the mobile terminal device, even if the relevant information for encryption and decryption is exposed Provides a mobile data security device and method to ensure.

The mobile data security device according to the first aspect of the present invention obtains additional information and seeds used for generating a security token from the server side together with the security token, and obtains the security token. A data security controller for requesting encryption or decryption of the data, and a verification token based on the seed and the additional information provided from the data security controller, and when the encryption or decryption of the data is requested It may include a data security processing unit for processing the encryption or decryption requested when the token and the verification token match.

Here, the data security controller may provide identification information to be included in the additional information when requesting the server terminal to issue the security token. The identification information may use a terminal identification number (IMEI, International Mobile Equipment Identity) or application program information. The application program information may include a package name or a signature. The additional information may include any one of time information, nonce, and a value generated by the data security processor. The data security processor may obtain the update additional information and the update seed from the server, generate an update token based on the update additional information and the update seed, and encrypt the data using the update token. . The data security processor may request a security update to obtain the update additional information and the update seed from the server. The data security processor may periodically request the security update to periodically encrypt the data using the update token.

In the mobile data security method according to the second aspect of the present invention, receiving the additional information and the seed used in the generation of a security token (token), and the verification token based on the seed and the additional information Generating a; comparing the security token used in the data encryption or decryption request with the verification token; and performing the encryption or decryption requested when the security token matches the verification token. Processing.

Here, the additional information may include a terminal identification number (IMEI) or application program information as identification information. The application program information may include a package name or a signature. The additional information may include visual information or a nonce. Obtaining an update additional information and an update seed from a server end, generating an update token based on the update additional information and the update seed, and encrypting the data using the update token; Can be. The method may further include requesting a security update from the server to obtain the update additional information and the update seed. The security update may be periodically requested to periodically encrypt the data using the update token.

According to a third aspect of the present invention, a computer-readable recording medium having recorded thereon a program including instructions for performing each step according to the mobile data security method can be provided.

According to an embodiment of the present invention, since data security is secured through collaboration with a server that operates in isolation from malicious behavior in a mobile terminal device, information tampering can be prevented from threats such as dictionary attacks. .

In addition, since a security update is performed to re-encrypt previously stored data by using an update token, there is an effect of ensuring the security of the data even when relevant information for encryption and decryption is exposed.

1 is a block diagram of a mobile terminal including a mobile data security device according to an embodiment of the present invention, and a security server device.

2 is a flowchart illustrating a security method by a mobile data security apparatus according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

As described above, according to an embodiment of the present invention, the mobile terminal device 100 and the security server device 200 are physically isolated from each other, and the mobile terminal device 100 communicates wirelessly with the security server device 200. Collaboration ensures the security of your data.

The mobile terminal device 100 includes a memory unit 110, a display unit 120, a networking unit 130, a secure memory unit 140, and a data security processing unit 410, and an application service unit 310 and data. It may further include an application program unit 300 including a security control unit 320. Here, the data security control unit 320 and the data security processing unit 410 form a mobile data security device 500 according to an embodiment of the present invention. The security server device 200 includes a security service unit 210 and a token issuer 220.

The application service unit 310 of the application program unit 300 interfaces with the user through the display unit 120 to provide a unique application service such as a financial transaction service or a game service.

The data security control unit 320 of the application program unit 300 provides security through encryption and decryption of data generated by the application service by the application service unit 310. To this end, the data security control unit 320 obtains additional information and seeds used in the generation of a security token through the networking unit 130 from the security server device 200 together with the security token. The data security processing unit 410 is requested to encrypt or decrypt the data using a security token.

In addition, the data security control unit 320 provides the identification information to be included in the additional information when the security server device 200 issuing a security token, the identification information is a terminal identification number (IMEI, International Mobile Equipment Identity) or application Use program information. In this case, the application information includes a package name or a signature.

On the other hand, the data security control unit 320 together with the data security processing unit 410 forms a mobile data security device 500 according to an embodiment of the present invention.

The data security processing unit 410 of the mobile data security device 500 generates a verification token based on the seed and additional information provided from the data security control unit 320, and encrypts the data by the data security control unit 320. If decryption is requested, the requested encryption or decryption is processed when the security token and the verification token match. Here, the data security processor 410 stores the encrypted data in the secure memory unit 140. For example, the memory unit 110 and the secure memory unit 140 may be physically separated. When the memory unit 110 and the secure memory unit 140 are located together in one memory, a specific area is encrypted. The data is allocated to the secure memory unit 140 for processing, and the data stored in the secure memory unit 140 may not find desired information through a memory scan.

In addition, the data security processing unit 410 obtains the update additional information and the update seed from the security server device 200 by requesting a security update, generates an update token based on the update additional information and the update seed, and uses the update token. To encrypt the data. For example, the data security processor 410 periodically requests a security update to periodically process data encryption using the update token.

The security service unit 210 of the security server device 200 performs communication with the mobile terminal device 100, and provides various request and transmission information by the mobile terminal device 100 to the token issuer 220. The seed and token generated by the token issuer 220 and additional information are transmitted to the mobile terminal 100.

The token issuing unit 220 of the security server device 200 generates a security token when a token issuance is requested from the data security control unit 320 of the mobile data security device 500, and the additional token used to generate the security token is added. The information and the seed are transmitted together with the security token to the data security controller 320. In addition, the token issuing unit 220 generates an update token when a security update is requested by the data security processing unit 410, and transmits the update additional information and the update seed used in the generation of the update ton to the data security processing unit 410. The update token, the update seed, and additional information are transmitted to the data security controller 320.

Here, the additional information used by the token issuing unit 220 when issuing the token includes identification information. For example, the identification information may include a terminal identification number (IMEI, International Mobile Equipment Identity) or the information provided from the mobile terminal 100. Application information is available. In addition, the additional information used when the token is issued may include time information, a nonce, or a value generated by the data security processor 410.

As described above, in the mobile data security method, the data security control unit 320 requests the token issuer 220 to generate a token (S601 to S603), and the token issuer 220 generates a security token. After transmitting the security token to the data security control unit 320 along with additional information and seed used to generate the security token (S605 to S609), the data security processing unit 410 is the data security control unit 320 Generating a verification token based on the seed and the additional information received from (S611 and S613), and if the data security processing unit 410 is requested to encrypt or decrypt the data for security used in the request for encryption or decryption of the data Comparing the token and the verification token (S615 and S617), processing the requested encryption or decryption when the security token and the verification token match (S619 and S621), and data In step S623 and S625, the security processing unit 410 periodically requests a security update from the token issuer 220, and after the token issuer 220 generates the update token, the update additional information used for the update token; While transmitting the update seed to the data security processing unit 410, the data security control unit 320 transmits the update additional information and the update seed together with the update token (S627 to S631), and the data security processing unit 410 sends the update seed and And generating a renewal token based on the renewal additional information and periodically processing the security update for re-encrypting the pre-encrypted and stored data using the renewal token (S633 and S635).

Hereinafter, referring to FIGS. 1 and 2, a process of providing a security service for data through mobile communication between the mobile terminal device 100 and the security server device 200 through wireless communication will be described in more detail.

The data security control unit 320 and the data security processing unit 410 forming the mobile data security device 500 according to the embodiment of the present invention may be implemented in hardware or in software. Here, if implemented in software, the data security processing unit 410 may be installed in advance in the mobile terminal 100 or together with the data security control unit 320 when the application program unit 300 is installed. For example, the application unit 300 may be installed in an application form, such as a process of installing an application using an apk file in a smartphone using an Android-based operating system, and together with the application unit 300 A program corresponding to the data security processor 410 may be installed together.

First, the data security control unit 320 requests the security service unit 210 to issue a token through the networking unit 130 for the security of the data (S601), and the security service unit 210 issues the token issue unit 220. Transfer the token issuance request to the (S603).

After the token issuing unit 220 generates the security token (S605), the token issuing unit 220 stores the security token along with the additional information and the seed used in the generation of the security token through the networking unit 130. In step S607, the data security control unit 320 provides additional information to the data security processing unit 410 together with the seed in step S609.

Then, the data security processor 410 generates a verification token based on the seed and the additional information received from the data security controller 320 (S613).

As such, in the state where the data security processing unit 410 generates the verification token, the data security control unit 320 may request the data security processing unit 410 to encrypt or decrypt the data. Token is used (S615).

Then, the data security processing unit 410 compares the security token used in the data encryption or decryption request with the verification token (S617), and if the security token and the verification token match, the requested encryption or decryption is performed. Process (S621). However, if there is a mismatch between the security token and the verification token, the data security controller 320 informs the token mismatch status (S619). Here, the encrypted data is not stored in the memory unit 110 but in the secure memory unit 140. Therefore, encrypted data information cannot be found through a general memory scan.

On the other hand, the data security processing unit 410 periodically requests a security update to the security service unit 210 to improve the security of the data (S623), the security service unit 210 is secured to the token issuing unit 220 The update request is forwarded (S625).

Then, the token issuing unit 220 transmits the update additional information and the update seed used in the update token to the data security processing unit 410 after generating the update token (S629), and the update additional information to the data security control unit 320. And the update seed together with the update token to be used when requesting data encryption or decryption (S631).

Thereafter, the data security processing unit 410 generates an update token based on the update seed and the update additional information (S633). The security update encrypts data previously encrypted and stored in the secure memory unit 140 using the update token again. Process periodically (S635).

As described above, according to the exemplary embodiment of the present invention, since the security of the data is ensured through collaboration with the security server apparatus 200 which operates in isolation from malicious behavior in the mobile terminal apparatus 100, the secure memory unit 140 ) Can be protected from threats such as dictionary attacks. In addition, since a security update is performed to re-encrypt previously stored data using an update token, even if relevant information for encryption and decryption is temporarily exposed, the related information exposed by new encryption becomes useless. This is guaranteed.

Combinations of each block of the block diagrams and respective steps of the flowcharts attached to the present invention may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas falling within the scope of the present invention should be construed as being included in the scope of the present invention.

Claims

A data security control unit which obtains additional information and seeds used to generate a security token from the server side together with the security token, and requests encryption or decryption of data using the security token; ,

Generates a verification token based on the seed and the additional information provided from the data security controller, and when the encryption or decryption of the data is requested, the encryption token requested when the security token matches the verification token. Or a data security processor that processes the decryption.
The method of claim 1,

And the data security controller provides identification information to be included in the additional information when requesting the server to issue the security token.
The method of claim 2,

The identification information is a mobile data security device using a terminal identification number (IMEI, International Mobile Equipment Identity) or application information.
The method of claim 3, wherein

And the application information includes a package name or signature.
The method of claim 2,

The additional information includes any one of visual information, nonce, and a value generated by the data security processing unit.
The method of claim 1,

The data security processing unit obtains the update additional information and the update seed from the server side, generates an update token based on the update additional information and the update seed, and encrypts the data using the update token. Security device.
The method of claim 6,

And the data security processing unit requests the security update to obtain the update additional information and the update seed from the server.
The method of claim 7, wherein

The data security processing unit periodically requests the security update to periodically process the encryption of the data using the update token.
Receiving additional information and seeds used to generate a security token;

Generating a verification token based on the seed and the additional information;

Comparing the verification token with the security token used in the request for encryption or decryption of data;

And processing the encryption or decryption requested when the security token and the verification token match.
The method of claim 9,

The additional information includes a mobile terminal identification number (IMEI, International Mobile Equipment Identity) or application information as identification information.
The method of claim 10,

And the application information includes a package name or signature.
The method of claim 9,

The additional information includes visual information or nonce.
The method of claim 9,

Obtaining the update additional information and the update seed from the server end,

Generating an update token based on the update additional information and the update seed;

Encrypting the data using the update token.
The method of claim 13,

Requesting a security update from the server side to obtain the update additional information and an update seed.
The method of claim 14,

And periodically requesting the security update to periodically encrypt the data using the update token.
Receiving additional information and seeds used to generate a security token;

Generating a verification token based on the seed and the additional information;

Comparing the verification token with the security token used in the request for encryption or decryption of data;

A computer readable program containing instructions for performing each step according to the method for mobile data security, comprising processing the encryption or decryption requested if the security token and the verification token match. Record carrier.