KR100574238B1 - Data storage apparatus with usb interface ic chip, and storing method thereof - Google Patents

Abstract

An apparatus and method for securely storing data in a storage device having a security chip having a USB interface is disclosed. According to the present invention, a data storage device includes a USB hub for outputting data input according to a USB signal standard according to a USB signal standard to a plurality of output ports; A controller for generating an address used to store data from one of the output ports to a flash memory, and transferring the data to the flash memory accordingly; At least one flash memory for storing the received data; And a security chip which receives and stores data from one of the output ports according to the USB interface and is accessed through a predetermined authentication process. As a result, it is possible to more securely store public certificates, personal account numbers or credit card data, important ID and password data, and other data requiring user authentication, and further includes an RF transceiver to perform functions of an electronic wallet or a transportation card together. can do.

Description

Data storage apparatus and method including a security chip having a USB interface {Data storage apparatus with USB interface IC chip, and storing method}

1 is a configuration diagram of a storage device having a USB interface;

2 is a block diagram of a data storage device according to an embodiment of the present invention;

3 is a detailed configuration diagram of the security chip 250 of FIG.

4 is a flowchart of a data storage method according to a preferred embodiment of the present invention;

5 is a flowchart of a data reading method according to a preferred embodiment of the present invention.

The present invention relates to the security and storage of data, and more particularly, to the secure storage of data in a storage device having a security chip having a USB interface.

With the development of data storage technology, various types of portable storage devices are used. Among these portable storage devices, flash memory equipped with a USB (Universal Serial Bus) interface has a large storage capacity, is easy to carry and connects to a PC, and is used in various fields such as storing document data, music, photos, and video files. It is widely used. However, such USB flash memory is very weak in security. Recently, some USB flash memories have a function such as requiring a password to access a specific area of the USB flash memory. However, data stored in the USB flash memory can be stored by means of physical hacking by a hacker, dumping or copying the memory, and the like. Accessibility is not a fundamental troubleshooting tool.

On the other hand, as an operating system (OS), there is an IC card equipped with a chip operating system (COS), a central processing unit (CPU), a security module, and a memory. IC cards employ encryption technology to securely process various transactions and to encrypt and store data, which are widely used in fields such as electronic wallets, electronic accounts, and personal authentication. But while IC cards are highly secure, their storage capacity is not as great as that of flash memory. In addition, in order to store data on the IC card or read the stored data, a reader capable of reading the IC card is required, but the IC card reader is not as widely used as a USB interface, and thus it is inconvenient to use.

Accordingly, the present invention provides a data storage device for storing data in the flash memory or the IC chip by configuring a storage device by connecting an IC chip having a USB interface and a USB flash memory through a USB hub. To provide a storage method.

Another object of the present invention is to connect an IC chip and a USB flash memory having a USB interface through a USB hub, and further comprising an RF transceiver to provide a data storage device having an electronic wallet, electronic money, and a transportation card function. To provide.

According to the present invention, a USB hub for outputting data input according to the USB signal standard, according to the USB signal standard to a plurality of output ports; A controller for generating an address used to store data from one of the output ports to a flash memory, and transferring the data to the flash memory accordingly; At least one flash memory for storing the received data; And a security chip which receives and stores data from one of the output ports according to the USB interface and is accessed through a predetermined authentication process.

The data storage device may further include an RF transceiver for loading data stored in the security chip into an RF signal and receiving data from an external RF device through the RF signal.

The security chip, the USB interface unit for inputting and outputting data from any one of the output port; A security chip controller for controlling the transfer of the received data; An encryption processing unit for encrypting the received data according to a predetermined encryption algorithm; And a secure data storage unit for storing the received data as it is or storing data encrypted by the encryption processing unit.

On the other hand, according to another field of the present invention, the technical problem is a step of outputting data received according to the USB signal standard according to the USB signal standard to any one port according to the destination of the data of a plurality of ports; And storing the output data in a flash memory or in a secure chip accessible through a predetermined authentication process.

In addition, the technical problem is a step of receiving information about the data to be read from the host; Determining whether the selected data is stored in a secure area accessible only through authentication or in a general area accessible without authentication; And reading data from a secure area or a general area according to a result of the determination and transferring the data to the host through a USB hub.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a storage device having a USB interface.

The flash storage device having a USB interface includes a connector 100, a USB interface unit 110, a controller 120, and a flash memory 130. The connector 100 provides an interface for connecting a physical signal line for exchanging data with a host. The USB interface unit 110 connects to a USB bus according to the USB standard, and provides an interface for transmitting data to and receiving data from the host. The controller 120 converts the file system provided to the user to correspond to the physical address and the command of the flash memory 130 so that the flash memory 130 can store data. When accessing data stored in the flash memory 130, the physical address of the flash memory is converted into a logical file system and provided in a form that the host can recognize. The flash memory 130 is a nonvolatile memory, and stored data is not deleted even when power is not supplied.

2 is a block diagram of a data storage device according to a preferred embodiment of the present invention.

The data storage device includes a connector 200, a USB hub 210, a USB interface unit 220, a controller 230, a flash memory 240, and a security chip 250, and preferably an RF transceiver 260. More). The connector 200 provides an interface for connecting a physical signal line with the host to exchange data with the host. That is, it provides a physical interface for transmitting data to and receiving data from the host according to the bus standard defined by USB.

The USB hub 210 has a plurality of input / output ports, and transmits data received from the host through the connector 200 to the flash memory 240 through the USB interface unit 230 or directly to the security chip 250. do. The data received from the flash memory 240 or the security chip 250 is transferred to the host. The USB interface unit 220 connects to the USB hub 210 to transfer data to the flash memory 240, and transfers data from the flash memory 240 to a host.

The controller 230 transmits the data received from the USB hub 210 and the USB interface 220 to the flash memory 240. To this end, the controller 230 converts the file system provided to the user to correspond to the physical address and command of the flash memory 240 so that the flash memory 240 stores the data. Even when the data stored in the flash memory 240 is accessed, the physical address is converted into a logical file system and provided in a form that the host can recognize.

The security chip 250 has a USB interface and is directly connected to the USB hub 210 to transmit and receive data. The detailed configuration of the security chip 250 will be described later with reference to FIG. 3.

According to the data storage method according to the present invention, the data received through the connector 200 from the host is stored in the flash memory 240 or the security chip 250 via the USB interface unit 220 and the control unit 230. It can also be stored in the memory provided in. In other words, the received data may be stored in the security chip 250 without performing encryption on the received data, the received data may be stored in the security chip 250 by performing encryption, or the received data may be stored in the security chip 250. In accordance with the encryption algorithm built in the encryption may be stored in the flash memory 240.

Therefore, the data storage path from the host is the first path to be stored in the flash memory 240 via the USB hub 210, the USB interface 220, and the controller 230, and directly through the USB hub 210. The second path to be stored in the security chip 250, and after being input to the security chip 250 through the USB hub 210 and undergoes a predetermined encryption process, the USB hub 210, the USB interface unit 220, the controller There is a third path stored in the flash memory 240 via the 230.

Saving data along the first path is the same as storing data on a general USB flash memory. This process is as described above with reference to FIG.

Storing data along the second path may require authentication with the security chip 250 when the application program that performs data storage is executed on the host, and if user authentication at the security chip 250 succeeds, The application program sends the data you want to save. The security chip 250 stores the received data as it is or encrypts the received data. Meanwhile, since the encryption process takes a long time, only a part of the received data may be encrypted and stored. Some data may be for example a 4 byte header of received data.

A process of storing data along the third path is as follows. When the application program that performs data storage is executed in the host, the authentication request is made to the security chip 250. If the user authentication is successful in the security chip 250, the application program of the host transmits data to be stored. The security chip 250 encrypts the received data and transmits the encrypted data to the flash memory 240 through the USB hub 210, the USB interface 220, and the controller 230. In this case, it is also possible to encrypt and store only a part of the received data. Meanwhile, the data may be encrypted and transmitted in advance according to an encryption program built in the host without encrypting the data in the security chip 250, and the received encrypted data may be stored in the flash memory 240. The encryption program may be included in the application.

In the above-described example, an example of encrypting and decrypting data is described in more detail. The encryption may be performed by the secret key of the security chip 250, and the decryption may be performed by the public key of the host. Encryption algorithms that may be used include both the Data Encryption Standard (DES) and the Rivest-Shamir-Adleman (RSA) algorithm, as well as the general encryption algorithm.

Meanwhile, the RF transceiver 260 exchanges data with another device through RF communication. For example, in order to perform a traffic card or electronic money function in a non-contact manner, the traffic card or electronic money related data recorded in the security chip 250 is transmitted through an RF reader. In this case, the security chip 250 operates by receiving power from the RF transceiver 260.

3 is a detailed block diagram of the security chip 250 of FIG. 2.

The security chip 250 includes a USB interface unit 310, a security chip control unit 320, an encryption processing unit 330, a security data storage unit 340, and an RF interface unit 350.

The USB interface unit 310 is connected to the USB hub 210 to perform data communication. The security chip control unit 320 controls to store the data received through the USB interface unit 310 as it is in the secure data storage unit 340 without an encryption process according to a user's security data storage command, or stores the encryption command in the encryption processing unit. Pass to 330 to encrypt the data. In addition, the data stored in the secure data storage unit 340 is transmitted to the RF transceiver 250 through the RF interface unit 350.

The encryption processing unit 330 encrypts the received data or decrypts the encrypted data according to a predetermined encryption algorithm and outputs the encrypted data. The secure data storage unit 340 receives and stores the unencrypted data through the USB interface unit 310 and the security chip control unit 320, or receives and stores the encrypted data by the encryption processing unit 330. An example of the data stored in the secure data storage unit 340 may be a public certificate, account information, credit card information, and the like. The RF interface unit 350 transmits data stored in the secure data storage unit 340 through the RF transceiver 250 in accordance with a command from an external RF reader for a function such as a traffic card or an electronic wallet.

4 is a flowchart of a data storage method according to a preferred embodiment of the present invention.

When the application program of the host is executed, a user interface screen for storing data is provided, and through this, a user inputs data to be stored, information on whether to encrypt and store it, and in which area to encrypt (S410). ). If it is determined whether or not to store the data encrypted (S420), if the data to be stored is received as an important data to encrypt and receive a command to be stored to perform a security algorithm to encrypt the data to be stored (S430) . If no encryption is to be performed, the encryption process is omitted. Next, it is determined whether the encrypted data or the general data is stored in the secure area (S440), and according to the result, the data is stored in the secure area (S450) or stored in the general area (S460). The security area becomes the memory inside the security chip, and the general area becomes the flash memory.

5 is a flowchart of a data reading method according to a preferred embodiment of the present invention.

When the application program is executed, a user interface for reading data is provided to the user, and the user receives input of data to be read by selecting one (S510). For example, the data to be read may be information such as a file name to be read. And. Check the storage area where the read data is stored (S520). If the data to be read is stored in the security area, authentication is performed (S530). If the authentication is successful, the data stored in the security area is read (S540). . On the other hand, if the data to be read is data stored in the general area, the data is read from the general area (S550). It is determined whether the data stored in the read security area or the general area is encrypted data (S560), and if it is encrypted data, decryption is performed (S570). On the other hand, in performing the authentication in step S530, if the authentication fails more than a certain number of times, for example three or more times, it can be locked so that no more data can be read.

On the other hand, the above-described data storage method can be created by a computer program. Codes and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the program is stored in a computer readable media, and read and executed by a computer to implement a data storage method. The information storage medium includes a magnetic recording medium, an optical recording medium, and a carrier wave medium.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

As described above, according to the present invention, it is possible to more securely store the authentication certificate, personal account number or credit card data, important ID and password data, and other data for requesting user authentication, and further includes an RF transceiver for electronic wallet or transportation. You can perform the functions of the card together.

Claims (8)

A USB hub having a plurality of input / output ports, for receiving data according to a USB signal standard from one port and outputting the data to another port;  A control unit which receives data output from any one port of the USB hub, generates an address for use in storing in the flash memory, and transfers the data to the flash memory accordingly;  At least one flash memory for storing data received from the controller; And  Receiving the data output from any one port of the USB hub in accordance with the USB interface, encrypted and stored, or transfer the encrypted data to the flash memory, comprising a security chip that is accessed only through a predetermined authentication process Data storage device, characterized in that. The method of claim 1, And transmitting and receiving data stored in the security chip in an RF signal, and receiving and receiving data from an external RF device through an RF signal. delete The method of claim 1, wherein the security chip A USB interface unit for inputting and outputting data from any one of the output ports; A security chip controller for controlling the transfer of the received data; An encryption processing unit for encrypting the received data according to a predetermined encryption algorithm; And And a secure data storage unit for storing the received data as it is or storing data encrypted by the encryption processing unit. Outputting data received according to the USB signal standard according to the USB signal standard through one of the output ports of the plurality of output ports according to a location to be stored; And Storing the output data in a flash memory or encrypting and storing the output data in a secure chip accessible through a predetermined authentication process. Receiving information about data to be read from the host; Determining whether the selected data is stored in a secure area accessible only through authentication or in a general area accessible without authentication; And And reading data from a secure area or a general area according to the determination result and transferring the data to the host through a USB hub. A computer-readable recording medium having recorded thereon a program for executing the method of claim 5 on a computer. A computer-readable recording medium having recorded thereon a program for executing the method of claim 6 on a computer.

Images