KR100664924B1 - Portable storage, host device and method for communication between them - Google Patents

Abstract

The present invention relates to a host device, a portable storage device and a method of communication therebetween. A portable storage device according to an embodiment of the present invention is connected to a host device to receive a control signal and perform data transmission and reception, a storage module for storing data received from the host device, and the received control signal according to And a control module for controlling whether to maintain communication with the host device.

According to the present invention, security can be enhanced for communication between the host device and the portable storage device.

Write command, read command, communication security, portable storage device

Description

Portable storage, host device and method for communication between them}

1 is a diagram illustrating a conventional DRM concept.

2 is a diagram illustrating a DRM concept according to an embodiment of the present invention.

3 is a flowchart illustrating a mutual authentication process between a host device and a portable storage device according to an exemplary embodiment of the present invention.

4 is a diagram illustrating a structure of transmitting data between a host device and a portable storage device according to an embodiment of the present invention.

5 is a diagram illustrating a data transmission structure in more detail in an embodiment of the present invention.

6 is a diagram illustrating a communication process between a host device and a portable storage device according to an embodiment of the present invention.

7 illustrates a host device according to an embodiment of the present invention.

8 is a block diagram illustrating a portable storage device according to an embodiment of the present invention.

9 is a flowchart illustrating an operation process of a host device according to an embodiment of the present invention.

10 is a flowchart illustrating an operation process of a portable storage device according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

211, 221: interface module 212, 222: control module

213, 223: encryption module 214, 224: storage module

215, 225: application drive module 216: display module

217: transceiver module

The present invention relates to a host device, a portable storage device, and a communication method therebetween, and more particularly, to a method of enhancing communication security by allowing a write command and a read command, which are control signals for controlling data transmission, to be operated in pairs. will be.

Recently, researches on digital rights management (hereinafter referred to as "DRM") have been actively conducted, and commercial services using DRM have been introduced or are being introduced. DRM is a technology concept for protecting digital content that is easy to copy and distribute.

Efforts have been made to protect digital content in the past, but this has focused on preventing unauthorized access to digital content. For example, access to digital content was allowed only to users who paid for it, and users who did not pay for it could not access digital content. However, due to the nature of digital data, digital content can be easily reused, processed, copied, and distributed. Therefore, if a user who pays for and accesses the digital content is copied or distributed without permission, the digital content can be used by the user who has not paid.

To solve this problem, DRM encrypts and distributes digital content and requires a specific license called a right object (RO) to use the encrypted digital content.

Referring to FIG. 1, a user 110 who wants to use digital content may obtain desired digital content from the content provider 120. At this time, the digital content supplied by the content provider 120 is in an encrypted state, and a rights object is required to use the encrypted digital content (hereinafter referred to as a content object).

The user 110 may obtain a rights object including a right to execute a content object from the rights object issuer 130 by paying a certain price. The rights included in the rights object may be a content encryption key that can decrypt the content object. At this time, the rights object issuing agency 130 reports the rights object issuance history to the content provider 120. In some cases, the rights object issuing agency 130 and the content provider 120 may be the same subject.

The user 110 acquiring the rights object may use the content object by consuming the rights object.

Meanwhile, content objects can be freely copied and distributed to other users. However, the rights object contains restriction information such as the number of times and duration of execution of the content object through the rights object or the number of times the rights object is allowed to be duplicated. Therefore, unlike a content object, a rights object is subject to certain restrictions on reuse or duplication, and according to such DRM technology, digital content can be effectively protected.

The user can store the content object and the rights object on a host device that wants to execute multimedia data, such as a mobile phone or a PDA. Recently, however, in order to simplify the storage and distribution of content objects or rights objects, a technology for managing rights objects through a portable storage device such as a memory stick or a multi-media card (MMC) has been developed.

In the case of using a portable storage device, data transmission between the host device and the portable storage device frequently occurs, and thus, a technology for enhancing communication security between the host device and the portable storage device has been required.

It is an object of the present invention to enhance security in communication between a host device and a portable storage device.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, according to an embodiment of the present invention, a host device includes an application driving module for driving one or more applications, a write command for controlling data transmission and reception according to a data transmission / reception request of an application driven by the application driving module; And a control module for outputting a control signal composed of a pair of read commands, and an interface module connected to a portable storage device to transmit and transmit and transmit the control signal output from the control module.

In order to achieve the above object, a portable storage device according to an embodiment of the present invention is connected to a host device interface module for receiving control signals and data transmission and reception, a storage module for storing data received from the host device, and And a control module for controlling whether to maintain communication with the host device according to the received control signal.

In order to achieve the above object, a communication method between a host device and a portable storage device according to an embodiment of the present invention comprises the steps of driving at least one application, the driven application requesting data transmission and reception with the portable storage device, and And controlling the data transmission and reception by outputting a control signal composed of a pair of a write command and a read command according to the request.

In order to achieve the above object, a communication method between a host device and a portable storage device according to another embodiment of the present invention is a control signal consisting of a write command instructing reception of data from the host device and a read command instructing transmission of data. Receiving the; and determining whether to maintain the communication in accordance with the received control signal, and the step of communicating with the host device according to the determination result.

Specific details of other embodiments are included in the detailed description and the drawings.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Prior to the detailed description of the present invention, the meaning of the terms used herein will be briefly described. However, the description of the term is to aid the understanding of the present specification. Therefore, it should be noted that the following terms are not used to limit the technical spirit of the present invention unless the present invention is explicitly limited in the detailed description of the present invention.

Public-key Cryptography

Also known as asymmetric encryption, this refers to an encryption method in which an encryption key used to decrypt data and an encryption key used to encrypt data are composed of different encryption keys. In public key cryptography, an encryption key consists of a pair of public and private keys. The public key does not need to be kept secret and can be easily known to other devices, and the private key must be known only to the specific device itself. Examples of such public key encryption algorithms include a Diffie-Hellman method, an RSA method, an ElGamal method, and an elliptic curve method.

Symmetric-key Criptography

Also known as secret key encryption, this refers to an encryption method in which an encryption key used to encrypt data and an encryption key used to decrypt data are configured with the same encryption key. As an example of such a symmetric key encryption, the DES scheme is most commonly used, and recently, an application using the AES scheme is increasing.

Digital Signature

Used by the signer to indicate that a document has been created. Examples of such digital signatures include RSA digital signatures, ElGamal digital signatures, DSA digital signatures, and Schnorr digital signatures.

Portable storage device

The portable storage device used in the present invention includes a nonvolatile memory having a property of reading, writing, and erasing data, such as a flash memory, having a predetermined computing power, and easily connecting / disconnecting a host device. Means storage. Examples of such storage devices include smart media, memory sticks, CF cards, XD cards, and multimedia cards.

Host device

The host device used in the present invention refers to a multimedia device that can be connected to a portable storage device and can directly use digital contents through a rights object stored in the portable storage device. Examples of host devices include mobile phones, PDAs, notebooks, desktop computers, digital TVs, and the like.

Right object

It is a kind of license that includes the right to use a content object, usage restriction information on the content, information on the duplication of the rights object, rights object ID, and content ID.

The right to use the content object may be a content encryption key (hereinafter referred to as CEK) capable of decrypting the content object. The CEK is a key value for decrypting the content object that the device intends to use, and the host device can use the content object by receiving the CEK from the portable storage device in which the rights object is stored.

The usage restriction information is information indicating a limit in which a rights object can be consumed to execute a content object. The types of usage restrictions include the use date limit, the number of use limit, the usage period limit, and the usage limit.

The usage date limit restricts the date on which the content object is available. Therefore, when the usage date limit is set in the rights object, the host device can use the content object by consuming the rights object after the date set in the rights object or before the date set in the rights object.

The usage limit limits the number of times a content object can be used. For example, if the number of times of usage of the rights object is set to N times, the host device can consume the rights object and use the content object N times.

The usage period restriction restricts the use of the content object by consuming the rights object for the period set in the rights object from the first use of the content object through the rights object. For example, if the usage period limit is set to one week for the rights object, the host device can use the content object through the consumption of the rights object for one week from the first consumption of the rights object to use the content object.

The usage limit restricts the total amount of time that a content object can be used. For example, if the expiration limit is set to 10 hours for the rights object, the host device can consume the rights object and use the content object for 10 hours. In this case, the host device is not limited to the number of times the content object is used or the date.

The copy restriction information is information that limits the number or limit of the rights object that can be copied or moved. The copy restriction information may include copy restriction information and movement restriction information.

Copying a rights object is a concept of transmitting the same rights object to another device while the rights object remains in the existing device.

The movement of a rights object is a concept of deleting a rights object from an existing device while transferring the rights object existing in the existing device to another device.

Therefore, the user may copy or move the rights object stored in the host device or the portable storage device to another host device or the portable storage device by the copy limit number or the movement limit number set in the rights object.

The rights object ID is an identifier that identifies itself from another rights object.

The content ID is an identifier of the content object for identifying the content object that can be executed by consuming the rights object.

Descriptions of other rights objects are detailed in the OMA DRM Enabler v1.0, 2002, Open Mobile Alliance or OMA DRM v2.0 draft, 2004, Open Mobile Alliance.

Right object status information

The rights object state information used in the present invention is information indicating the degree of consumption of the rights object. For example, if the expiration date information is set to 10 hours in the rights object and the host device spends 4 hours in order to use the content object, the rights object status information indicates that the host device has consumed the rights object so far. Information about the time (4 hours) or the time (6 hours) when the host device consumes the rights object and can use the content object in the future.

The rights object state information may be included in the rights object or may be managed as information separate from the rights object by the host device or the portable storage device storing the rights object.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a DRM concept according to an embodiment of the present invention.

The user may obtain a content object from the content provider 240 as in the related art through the host device 210. In addition, it is possible to purchase a rights object that can execute a content object from the rights object issuer 230 at a predetermined cost.

Meanwhile, although the purchased rights object may be stored in the host device 210, the purchased right object may be stored in the portable storage device 220 according to an embodiment of the present invention. In addition, the portable storage device 220 may store one or more rights objects since its production.

In this case, the host device 210 may consume the rights object stored in the portable storage device 220 to use the content object. The host device 210 consuming the rights object generates the state update information for the rights object according to the degree of consumption of the rights object and transmits it to the portable storage device 220. The portable storage device 220 updates the status information of the rights object through the received status update information.

In addition, the other host device 250 may use the content object by consuming the rights object stored in the portable storage device 220. In some cases, the rights object stored in the portable storage device 220 may be moved or copied to another host device 250. Therefore, when the portable storage device 220 is used, the host devices 210 and 250 may easily share the rights object within the limits of the usage restriction information or the replication restriction information set in the rights object. In addition, by storing the rights objects in the portable storage device 220, it is possible to improve the data storage capability of the host device 210 and to simplify the management of the rights objects.

In general, the host device 210 undergoes mutual authentication before combining with the portable storage device 220 to exchange data. Mutual authentication is a basic process for maintaining the security of data exchanged between the host device 210 and the portable storage device 220, which will be described with reference to FIG.

3 is a flowchart illustrating a mutual authentication process between a host device and a portable storage device according to an exemplary embodiment of the present invention.

In the description of FIG. 3, the subscript H means data owned by or generated by the host device 210, and the subscript S is owned by the portable storage device 220 or generated by the portable storage device 220. Means data.

The host device 210 and the portable storage device 220 may each include their own encryption key pair, which is used for public key encryption.

The first host device 210 requests mutual authentication from the portable storage device 220 (S10). In this case, the host device 210 transmits its public key to the portable storage device 220. The public key may be included in the certificate _H issued to the host device 210 by a certification authority and transmitted.

The portable storage device 220 may verify whether the host device 210 is a legitimate device through the certificate _H of the host device 210, and obtain a public key of the host device 210.

The portable storage device 220 checks the certificate _H of the host device 210 (S12). In this case, the portable storage device 220 may determine whether the certificate _H is valid using the certificate revocation list (hereinafter referred to as "CRL") and whether the certificate _H expires. Ten thousand and one out of date of the certificate _H or, if the case of the certificate _H is registered in the CRL certificate portable storage device 220 may reject mutual authentication with the host device (210). On the other hand, if the certificate _H is confirmed to be valid, the portable storage device 220 may obtain the public key of the host device 210 through the certificate _H.

On the other hand, if it is confirmed that the certificate of the host device 210 is valid, the portable storage device 220 generates a random number _S to respond to the mutual authentication request (S14), and encrypts it with the public key of the host device 210 (S16). ).

The random number _S encrypted as the mutual authentication response is transmitted to the host device 210 together with the public key of the portable storage device 220 (S20). In this case, the public key of the portable storage device 220 may also be included in the certificate _S of the portable storage device 220 and transmitted.

The host device 210 may confirm that the portable storage device 220 is a legitimate device by checking the validity of the certificate _S of the portable storage device 220 through the CRL held by the host device 210 (S22). Meanwhile, the host device 210 may obtain the public key of the portable storage device 220 through the certificate of the portable storage device 220 and decrypt the encrypted random number _S with its own private key to obtain the random number _S (S24).

Encrypts the portable storage device, the host device 210 also generates a random number _H and (S26), the generated random number _H confirming that the called legitimate device 220 with the public key of the portable storage device 220 (S28).

Thereafter, the host device 210 transmits the encrypted random number _H together with the session key generation request (S30).

The portable storage device 220 receives the encrypted random number _H and decrypts it with its private key (S32). Accordingly, the host device 210 and the portable storage device 220 may share a random number generated by the host device and a random number generated by the partner, and generate a session key using two random numbers (S40 and S42). In this embodiment, the random number is generated and used in both the device 210 and the portable storage device 220, thereby greatly increasing the randomness and enabling secure mutual authentication.

Meanwhile, the host device 210 and the portable storage device 220 generating the session key may check whether the session key generated by the host device 210 is identical to the session key generated by the other party.

The host device 210 and the portable storage device 220 sharing the session key may encrypt data transmitted to each other with the session key and decrypt the received data with the session key. This can enhance security during data transmission.

The above-described mutual authentication process is only an example of a process for confirming that the host device 210 and the portable storage device 220 are mutually authorized devices and sharing a session key. Accordingly, a similar mutual authentication process may be performed to generate a common session key between the host device 210 and the portable storage device 220.

Meanwhile, encryption using a session key may belong to symmetric key encryption. However, the present invention is not limited thereto, and the host device 210 and the portable storage device 220 may use a public key encryption method that encrypts data to be transmitted with a public key of the other party and encrypts the received data with its private key. .

In the following embodiments, although not specifically mentioned, the host device 210 and the portable storage device 220 may encrypt data transmitted to each other with a session key or a counterpart's public key, and the received data may be encrypted with the session key or its own individual. Can be decrypted with a key.

Data transmission between the host device and the portable storage device during or after the mutual authentication process described above is controlled by a control signal generated from the host device, which will be described with reference to FIG. 4.

4 is a diagram illustrating a structure of transmitting data between a host device and a portable storage device according to an embodiment of the present invention.

When the host device 210 and the portable storage device 220 are connected, the host device 210 and the portable storage device 220 transmit necessary data to each other according to an operation of an application that is being driven. For example, in order to execute the content object, the host device 210 may receive a rights object stored in the portable storage device 220. Alternatively, when it is necessary to update the status information of the rights object as the rights object is consumed, the host device 210 consumes the rights object and provides data necessary for updating the status information of the consumed rights object, such as the time or number of times the content object is used. Or transmit to portable storage 220.

In order to control such data transmission, the host device 210 transmits a control signal 310 to the portable storage device 220. The control signal 310 may be composed of a write command and a read command. The write command is a control signal for preparing the portable storage device 220 to receive data, and the read command is a control signal for preparing the portable storage device 220 for data transmission.

Accordingly, the portable storage device 220 prepares to transmit or receive data through a control signal transmitted from the host device 210. In addition, the host device 210 transmits data to the portable storage device 220 through a write command or accesses data stored in the portable storage device 220 through a read command.

As such, a control signal from the host device is required to transmit and receive necessary data between the host device and the portable storage device.

5 is a diagram illustrating a data transmission structure in more detail in an embodiment of the present invention.

The illustrated figure shows how Application A running on the host device 210 and Application B running on the portable storage device 220 transmit data necessary for each other.

To transmit data to the portable storage device 220, the host device 210 uses a control signal 310 composed of a pair of write commands 312 and read commands 314.

For example, when the host device 210 intends to transmit data necessary for updating status information of the rights object consumed to the portable storage device 220, the host device 210 updates the rights object through the write command 312. The necessary data 322 can be transmitted. In this case, the host device 210 receives the response data 324 regarding whether the rights object is successfully transmitted from the portable storage device 220 through the read command 314.

Meanwhile, even when accessing data stored in the portable storage device 220, the host device 210 uses a control signal 310 composed of a pair of a write command 312 and a read command 314.

For example, when the host device 210 attempts to access a rights object stored in the portable storage device 220, the data 322 transmitted through the write command 312 may be empty data filled with a null value. Thereafter, the host device 210 transmits a read command 314 and receives the rights object data 324 stored in the portable storage device 220.

As such, the host device 210 undergoes a process of transmitting a write command 312 / data 322 and receiving a read command 314 / data 324 to transmit or receive data.

Therefore, the host device 210 according to the embodiment of the present invention transmits the write command 312 and prepares to transmit the read command 314, and the write command 312 or the read command 314 is continuously transmitted. To prevent them.

In addition, the portable storage device 220 according to an exemplary embodiment of the present invention expects a read command 314 to be transmitted after the write command 312 is transmitted from the host device 210. If the write command 312 or the read command 314 are continuously received, the portable storage device 220 may determine that an error has occurred in the host device 210 connected to the portable storage device 220.

6 is a diagram illustrating a communication process between a host device and a portable storage device according to an embodiment of the present invention.

The illustrated figure shows that Application A and Application B, which are running on the host device 210, are required to transmit necessary data to and from Application K, which is running on the portable storage device 220.

As described with reference to FIG. 5, the application A may exchange data with the application K through a control signal composed of a pair of a write command 312 and a read command 314. At this time, the host device 210 transmits a write command according to another data transmission / reception request of the application A or a data transmission / reception request of the application B which is another application until the read command 314 paired with the write command 312 is output. Prohibit output. A write command according to another data transmission / reception request of the application A or a data transmission / reception request of the application B may be output after the read command 314 paired with the first output write command 312 is output.

On the other hand, the portable storage device 220 that receives the write command 312 from the host device 210 receives another write command before the read command 314 is received from the host device 210. May send an error message or interrupt communication with the host device 210.

Accordingly, another data for causing the portable storage device 220 to generate incorrect response data to the data 322 transmitted from the host device 210 may be prevented from being input into the portable storage device 220. . That is, the data 324 outputted to the host device 210 by the application K of the portable storage device 220 in the illustrated figure becomes suitable response data to the data 322 transmitted from the host device 210.

7 illustrates a host device according to an embodiment of the present invention.

Modules used in this embodiment and the following embodiments refer to software that performs specific functions or hardware components such as FPGAs or ASICs. However, modules are not meant to be limited to software or hardware. The module may be configured to be in an addressable storage medium and may be configured to play one or more processors.

Thus, as an example, a module may include components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, procedures, subroutines, program code. May be segments, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. The functionality provided within the components and modules may be combined into a smaller number of components and modules or further separated into additional components and modules. In addition, the components and modules may be implemented to reproduce one or more CPUs in a host device or portable storage device.

The host device 210 may include an interface module 211 for exchanging data with the portable storage device 220, a control module 212 for controlling each component module to perform DRM, and an encryption module 213 having a security function. And a storage module 214 having a storage function. In addition, the host device 210 may exchange data with an application driving module 215 for driving various applications required to perform a DRM function, a display module 216 for displaying execution contents of a content object, and an external device or system. Transmit / receive module 217.

The interface module 211 allows the host device 210 to be connected to the portable storage device 220. Basically, the host device 210 is connected to the portable storage device 220 means that the portable storage device 220 and the interface modules 211 and 221 of the host device 210 are electrically connected to each other. It is to be understood that the term "connected" also includes the meaning of being in a state of being able to communicate with each other through a wireless medium in a non-contact state. The control signal may be transmitted or data may be transmitted or received to the portable storage device 220 through the interface module 211.

The control module 212 controls a data transmission / reception process with the portable storage device 220 according to a request of an application driven by the application driving module 215, and outputs a control signal for data transmission / reception to the interface module 211. . The control signal may be configured as a pair of a write command and a read command as described above, and the control module 212 prevents the write command or the read command from being output continuously. Control signal output by the control module 212 is as described with reference to FIG.

Therefore, when another data transmission / reception request of the same application is input after a write command is output according to the data transmission / reception request of the application, the control module 212 transmits other data until a read command paired with the output write command is output. Limits the output of write commands in response to transmission / reception requests.

In addition, even when a data transmission / reception request is input from another application driven by the application driving module 215 after a write command is output in response to a data transmission / reception request of a specific application, the control module 212 may not output the write command. Limits the output of write commands in response to requests from other applications until the paired read commands are output.

The encryption module 213 is a module that performs encryption and encrypts data transmitted to the portable storage device 220 according to a request of the control module 212, or decrypts data received by being encrypted from the portable storage device 220. . The encryption module 213 may perform not only a public key encryption method but also a secret key encryption method, and one or more encryption modules may exist to perform both methods.

In particular, the rights objects may be stored in an encrypted state. The host device 210 encrypts the rights objects using a unique encryption key that cannot be read by other devices or the portable storage device 220 through the encryption module 213. can do. In addition, when the right object is to be moved or copied to another device or the portable storage device 220, it may be decrypted using a unique encryption key. A symmetric key encryption method using a unique encryption key may be used to encrypt the rights object. In addition, the right object may be encrypted using the public key of the host device 210 and, if necessary, decrypted with the private key of the host device 210. In addition, the encryption module 213 may generate a predetermined random number necessary for the mutual authentication process.

The storage module 214 stores encrypted contents and rights objects, and data necessary for applying a DRM technology such as a certificate and a CRL of the host device 210. In addition, the storage module 214 may store data necessary for the application driving module 215 to drive the application.

The application driving module 215 drives an application required to perform the DRM. For example, an application driven by the application driving module 215 performs a function of executing a content object or generating data for updating status information of a rights object consumed to execute the content object.

The application driving module 215 may allow the host device 210 to perform various functions by simultaneously driving one or more applications. In addition, the host device 210 may include one or more application driving modules 215.

An application driven by the application driving module 215 may request the control module 212 to transmit data to or receive data from the portable storage device 220.

For example, an application that generates update information necessary for updating status information of the rights object consumed by the host device 210 may request the control module 212 to transmit the generated update information to the portable storage device. An application for executing a specific content object may also request the control module 212 to receive from the portable storage the rights object needed to execute the content object.

The display module 216 displays a content object that is allowed to be used through the rights object (for example, playing the content object) so that the user can visually see it. The display module 216 may be implemented as a liquid crystal display such as a TFT LCD, an organic EL, or the like.

The transmission / reception module 217 enables the host device 210 to communicate with a content publisher or a rights object issuer by wire or wireless. The host device 210 may obtain a rights object or a content object from the outside through the transmission / reception module 217.

8 is a block diagram illustrating a portable storage device according to an embodiment of the present invention.

The portable storage device 220 may include an interface module 221 for exchanging data with the host device 210, a control module 222 for controlling each component module to perform a DRM process, and an encryption module having a security function. 223, a storage module 224 having a storage function, and an application driving module 225 for driving various applications required to perform the DRM function.

The interface module 211 allows the host device 210 to be connected to the portable storage device 220. Basically, the host device 210 is connected to the portable storage device 220 means that the portable storage device 220 and the interface modules 211 and 221 of the host device 210 are electrically connected to each other. It is to be understood that the term "connected" also includes the meaning of being in a state of being able to communicate with each other through a wireless medium in a non-contact state. Control signals may be transmitted or data may be transmitted and received to the portable storage device 220 through the interface module 211.

The control module 222 prepares the reception of the data or the transmission of the data according to the control signal received from the host device 210 through the interface module 221. For example, when a write command is received, the control module 222 waits for data reception and stores the received data in the storage module 222 or processes an application driven by the application driving module 225. In addition, when a read command is received, the control module 222 transmits data stored in the storage module 224 or data processed by an application driven by the application driving module 225 to the host device through the interface module 221. To do that.

On the other hand, if the write command is received, the control module 222 expects to receive a read command thereafter. If another write command is received before the read command is received, the control module 222 may stop communication with the host device 210. That is, the control module 222 restricts data reception according to the continuously inputted write command, and in some cases, may stop communication with the host device 210 even when the read command is continuously input.

The encryption module 223 performs encryption and encrypts data transmitted to the host device 210 according to a request of the control module 222, or decrypts data received by being encrypted from the host device 210. The encryption module 223 may perform not only a public key encryption method but also a secret key encryption method, and one or more encryption modules may exist to perform both methods.

In particular, the rights objects may be stored in an encrypted state, and the portable storage device 220 may encrypt the rights objects using a unique encryption key that cannot be read by other devices through the encryption module 223. In addition, when the right object is moved or copied to another device, or when another device requires permission to use a specific content, the encrypted right object can be decrypted using a unique encryption key. A symmetric key encryption method using a unique encryption key may be used for encryption of the right object. In addition, the public key of the portable storage device 220 may be encrypted and decrypted with the private key of the portable storage device 220 when necessary. Do. In addition, the encryption module 223 may generate a predetermined random number required for the mutual authentication process.

The storage module 224 stores content objects and rights objects, state information of each rights object, and data necessary for performing DRM functions such as certificates and CRLs of the portable storage device 220. The rights object stored in the storage module 224 may be obtained from another device (eg, the host device 210), or may be stored from the production of the portable storage device 220. In addition, the storage module 224 may store data necessary for the application driving module 225 to drive the application.

The application driving module 225 drives an application required to perform the DRM. For example, an application driven by the application driving module 225 may perform a function such as updating state information of a rights object consumed to execute a content object, or extracting state information of a specific rights object.

The application driving module 225 may simultaneously drive one or more applications to allow the portable storage device 220 to perform various functions. In addition, the portable storage device 220 may include one or more application driving modules 225.

9 is a flowchart illustrating an operation process of a host device according to an embodiment of the present invention.

The application driving module 215 of the host device 210 connected to the first portable storage device 220 drives a predetermined application to perform a DRM function (S110).

When the driven application requests data transmission / reception with the portable storage device 220 (S120), the control module 212 transmits a write command through the interface module 211 and a corresponding data (S130).

When the request of the application is a data transmission request, the data transmitted through the write command is data requested by the application. When the request of the application is a data reception request, the data transmitted through the write command may be data filled with a null value.

When there is another data transmission / reception request of the same application after outputting the write command, or when there is a data transmission / reception request of another application driven by the application driving module 215, the control module 212 waits for the output of the write command according to the request. Let (S150). If there is no such request, the control module 212 performs the process of outputting a read command (S160).

After outputting the write command, the control module 212 outputs a read command paired with the outputted write command and receives data from the portable storage device 220 (S160).

When the request S120 of the application is a data transmission request, the data received through the read command may be data regarding whether the data transmitted through the write command is normally transmitted. In addition, when the request (S120) of the application was a data reception request, the data received through the read command may be data requested to be received.

After that, if the output of the control signal is made standby, the process of step S130 or less can be performed again.

10 is a flowchart illustrating an operation process of a portable storage device according to an embodiment of the present invention.

The application driving module 225 of the portable storage device 220 connected to the host device 210 initially drives a predetermined application for performing a DRM function (S210).

According to an operation with the host device 210, the portable storage device 220 receives a write command and data from the host device 210 (S220 and S230). The control module 222 stores the received data in the storage module 224 or allows an application driven by the application driving module 225 to process it.

Meanwhile, the control module 222 expects to receive a read command after receiving a write command. Therefore, when the control signal is received (S240), the control module 222 determines whether the received control signal is a read command (S250).

If the received control signal is a write command, the control module 222 may stop communication with the host device 210 (S270). That is, the control module 222 restricts data reception according to the continuously inputted write command, and in some cases, may stop communication with the host device 210 even when the read command is continuously input.

Meanwhile, when a read command is received, the control module 222 transmits data stored in the storage module 224 or data processed by an application driven by the application driving module 225 to the host device through the interface module 221. (S260).

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention belongs may be embodied in other specific forms without changing the technical spirit or essential features of the present invention. You can understand that there is. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

According to the host device, the portable storage device and the communication method of the present invention as described above, it is possible to enhance security in the communication between the host device and the portable storage device.

Claims (12)

An application driving module for driving one or more applications; A control module for outputting a control signal including a write command for controlling transmission of data and a read command corresponding to the write command and controlling reception of data according to a data transmission / reception request of an application driven by the application driving module; And And an interface module connected to a portable storage device to transmit a control signal and to transmit and receive the data output from the control module. The data transmission request of the second application driven by the application driving module is input after the first write command is output according to the data transmission request of the first application driven by the application driving module. And the control module outputs a second write command according to a data transmission request of the second application after outputting a first read command corresponding to the first write command. 2. The method of claim 1, wherein when another data transmission request of the application is input after the write command is output, the control module outputs the read command corresponding to the outputted write command to the other data transmission request. Host device that outputs a write command accordingly. An interface module connected to the host device to receive control signals and transmit and receive data; A storage module for storing data received from the host device; And And a control module to stop communication with the host device when the received control signal is a continuously inputted write command. delete The portable storage device of claim 4, wherein the control module stops communication with the host device when the received control signal is a continuously input read command. Establishing a communication session through a mutual authentication process with the portable storage device; Running one or more applications; Outputting a control signal including a write command for controlling data transmission and a read command corresponding to the write command and controlling reception of data according to a data transmission / reception request of the driven application; And And transmitting the output control signal to the portable storage device. 8. The method of claim 7, wherein the driving comprises driving the first application and the second application, and the outputting of the first application includes outputting a first write command according to a data transmission request of the first application. Outputting a second write command according to a data transmission request of the second application after outputting a first read command corresponding to the first write command when a data transmission request of a second application is input; A method of communication between a device and portable storage device. 8. The method of claim 7, wherein the outputting of the read command comprises outputting the read command corresponding to the output write command when another data transmission request of the application is input after the write command is output. Outputting a write command according to the communication method between the host device and the portable storage device. Establishing a communication session through a mutual authentication process with the host device; Receiving a control signal from the host device; And And stopping communication with the host device when the received control signal is a continuously inputted write command. delete 11. The method of claim 10, further comprising stopping communication with the host device when the received control signal is a continuously input read command.

Images