KR101075792B1 - Usb hardware security module, system for security certifincluding usb hardware security module and method thereof - Google Patents

Abstract

The USB security token according to an embodiment of the present invention includes a USB interface module and a smart card capable of communicating with a host device through a universal series bus (USB), wherein the smart card controls communication with the USB interface module. USB controller; Smart card memory for storing security data related to user authentication; An RNDIS interface module for interfacing with the RNDIS packet format so that the smart card and the host device can communicate according to a Remote Network Driver Interface Specification (RNDIS); A smart card web server (SCWS: SmartCardWebServer) capable of communicating in a Transmission Control Protocol (TCP) / IP (Internet Protocol) protocol through the RNDIS interface module; And a security servlet executed in association with the smart card web server and performing authentication using the security data.

Description

USB security token, security authentication system including the same and security authentication method including the same {USB HARDWARE SECURITY MODULE, SYSTEM FOR SECURITY CERTIFINCLUDING USB HARDWARE SECURITY MODULE AND METHOD THEREOF}

The present invention relates to a USB security token, a security authentication system including the same, and a security authentication method including the same. More particularly, the USB security token and the host device communicate with each other through a remote network device interface standard (RNDIS). The present invention relates to a USB security token that can be used, a security authentication system including the same, and a security authentication method including the same.

Korea uses public certificate for self-identification during internet banking, and most people store it on PC hard disk or USB removable disk. Statistically, more than 80% of certified certificates are stored on hard disks or USB removable disks.

By the way, when storing the certificate in the hard disk or USB removable disk, there is a problem that can be duplicated of the certificate.

In other words, if you store the certificate in C: Program Files \ NPKI (Hard Disk), you can search for the certificate through Explorer and copy it freely. In addition, malicious code can be installed on the PC without the user's knowledge, and there is a risk of leaking the certificate by the malicious code.

In addition, even when storing the certificate in G: NPKI (removable disk / USB memory), it is possible to freely copy the certificate after navigating the certificate through Explorer, so if the USB memory in which the certificate is stored is lost, the certificate is automatically recognized. The certificate will also be lost.

In fact, the financial damage from the leakage of accredited certificates is increasing. In order to prevent such a problem, it is recommended to store and manage the public certificate in the secure token recently. That is, the public certificate stored in the security token is not copied to the outside, so the stability is high.

However, despite the high stability of the security token, the utilization rate is low because of the following problems.

First, in order to use the conventional security token, there is a need to install the smart card reader driver on the host device connecting the security token.

Secondly, since it must have a smart card reader, it is less portable. In other words, the area where the public certificate is stored in the security token is a smart card. In order to use the public certificate stored in the smart card, a smart card reader must be present. Therefore, it is difficult to purchase a smart card reader separately, and even if it is purchased, it is very cumbersome because the user has to carry it every time he wants to use the security token.

Third, the conventional security token communicates using the T0 / T1 protocol, a smart card-specific protocol defined in ISO 7816. Therefore, an application installed on a host device that wants to use the services of a smart card must be able to use the T0 / T1 protocol function, and the hardware must also support it. However, since the T0 / T1 protocol is not a commonly used protocol, security-related applications have a problem in that various restrictions and inconveniences are required to use the functions of the smart card.

The present invention is to solve the above problems, USB security token and the host device communicates through the Remote Network Device Interface Specification (RNDIS), USB security token that can be used without installing the drive, security authentication system comprising the same and the like An object of the present invention is to provide a security authentication method.

According to another embodiment of the present invention, there is provided a USB security token that can be used without a separate device, such as a smart card reader is mounted in the smart card, a security authentication system including the same and a security authentication method including the same For the purpose of

According to another embodiment of the present invention, since the communication via the HTTP protocol through a security servlet stored in the USB security token, the security token can be used in a browser or other equipment, USB security token that can extend the utilization of the security token, including this An object of the present invention is to provide a security authentication system and a security authentication method including the same.

According to another embodiment of the present invention, the security authentication and data storage with a single USB security token, but the area that does not require security and the area that includes a smart card for storing data that requires security, such as a public certificate through a USB hub By separating the storage areas where general data is stored, users can securely store their certificates using a single device, as well as a USB security token that can be used as a general USB memory device for storing general data. An object of the present invention is to provide a system and a security authentication method including the same.

USB security token according to an embodiment of the present invention in order to achieve the object of the store includes a USB interface module and a smart card that can communicate with the host device via a USB (Universal Series Bus), the smart card, USB A USB controller for controlling communication with the interface module; Smart card memory for storing security data related to user authentication; An RNDIS interface module for interfacing with the RNDIS packet format so that the smart card and the host device can communicate according to a Remote Network Driver Interface Specification (RNDIS); A smart card web server (SCWS: SmartCardWebServer) capable of communicating in a Transmission Control Protocol (TCP) / IP (Internet Protocol) protocol through the RNDIS interface module; And a security servlet running in association with the smart card web server and performing authentication using the security data, wherein the security token is configured to include the USB controller when the USB security token is connected to the host device. Activate the smart controller web server by initializing the RNDIS interface module through the USB controller when the USB controller is activated and driving the smart card web server when the RNDIS interface module is initialized. It is characterized by.

delete

delete

The USB security token according to another embodiment of the present invention is characterized in that the security servlet communicates with an authentication server to perform authentication, encryption and decryption of the security token using the security data stored in the smart card memory. do.

USB security token according to another embodiment of the present invention, USB storage capable of storing data; A USB storage controller capable of controlling the USB storage; And a USB hub connected to the USB interface and positioned between the smart card and the USB storage controller to integrally manage input and output of the host device and the smart card and the USB storage.

The security authentication system including a USB security token according to an embodiment of the present invention comprises a USB security token and a host device to which the USB security token can be connected through a USB port, and the host device communicates with the USB security token. Further comprising a security application capable of establishing a session, wherein the USB security token includes a USB interface module and a smart card capable of communicating with a host device via a universal series bus (USB), wherein the smart card includes: A USB controller for controlling communication with the interface module; Smart card memory for storing security data related to user authentication; An RNDIS interface module for interfacing with the RNDIS packet format so that the smart card and the host device can communicate according to a Remote Network Driver Interface Specification (RNDIS); A smart card web server (SCWS: SmartCardWebServer) capable of communicating in a Transmission Control Protocol (TCP) / IP (Internet Protocol) protocol through the RNDIS interface module; And a security servlet executed in association with the smart card web server and performing authentication using the security data.

delete

Security authentication system including a USB security token according to another embodiment of the present invention, the USB security token is USB storage capable of storing data; A USB device controller capable of controlling the USB storage; And a USB hub connected to the USB interface and positioned between the smart card and the USB device controller to manage the input and output of the host device and the smart card and the USB storage.

In accordance with another aspect of the present invention, there is provided a security authentication method including a USB security token, comprising: a host device connection step of connecting a USB security token including a smart card to a host device through a universal series bus (USB); Establishing a session in which the USB security token can communicate with the host device; And an RNDIS data transmission step in which the USB security token transmits data in accordance with a remote network driver interface specification (RNDIS) with the host device. In the host device connection step, the USB security token is performed. It is characterized in that it is recognized as a remote network device that is connected to the USB port of the host device through the RNDIS driver of the host device and transmits data according to the Remote Network Device Interface Specification (RNDIS).

Security authentication method including a USB security token according to another embodiment of the present invention, the smart card web server (SCWS: SmartCardWebServer) that the smart card can communicate via TCP (Transmission Control Protocol) / IP (Internet Protocol) protocol And a USB security token connected to the host device and powered on, wherein the smart card web server is automatically executed after the session establishment step.

delete

The USB security token according to the embodiment of the present invention, the security authentication system including the same, and the security authentication method including the same can be used without installing a drive because the USB security token and the host device communicate through a remote network device interface standard (RNDIS). Provide the effect.

USB security token according to another embodiment of the present invention, a security authentication system including the same, and a security authentication method including the same, the USB device controller is mounted in the smart card has the effect that can be used without a separate device, such as a smart card reader to provide.

In accordance with another embodiment of the present invention, a USB security token, a security authentication system including the same, and a security authentication method including the same communicate with the HTTP protocol through a security servlet stored in the USB security token, thereby enabling the security token in a browser or other device. It can be used to provide the effect of extending the utilization of security token.

USB security token according to another embodiment of the present invention, a security authentication system including the same, and a security authentication method including the same, the security authentication and data storage with a single USB security token, but secured like a public certificate through a USB hub By distinguishing between the area that contains the smart card to store this necessary data and the storage area where general data that does not require security are stored, the user can securely store the public certificate as well as use a single device. It can be used as a general USB memory device.

1 is a block diagram showing a security authentication system including a USB security token according to an embodiment of the present invention.
Figure 2 is a detailed block diagram showing a USB security token according to an embodiment of the present invention.
Figure 3 is a detailed block diagram showing a USB security token according to another embodiment of the present invention.
4 is a flowchart illustrating a security authentication method including a USB security token according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 and 2 is a block diagram showing a security authentication system including a USB security token according to an embodiment of the present invention.

1 and 2, a security authentication system including a USB security token according to the present invention, the USB security token 100, USB (Universal Serial Bus, Universal Series Bus) through the USB security token can be connected It may be configured as a host device 200.

The host device 200 includes a USB port, for example, a PC, a notebook, and the like, and the USB security token 100 is connected through the USB port. In addition, the host device 200 further includes a security application 210 capable of establishing a session by communicating with the USB security token.

The Hardware Security Module (HSM) is a device that can securely store and store secret information such as a digital signature generation key.It has a process and cryptographic device inside the device that can generate digital signature keys, generate and verify digital signatures, etc. It is a hardware device. Secret information such as an electronic signature generation key stored inside the device is not copied or regenerated to the outside of the device and can be produced and implemented in various forms such as smart cards, USB tokens, and the like. Can be implemented.

According to the present invention, when the USB security token 100 is connected to the host device 200, the host device 200 recognizes the USB security token 100 as a remote network device in accordance with the remote network device interface standard (RNDIS) Communicate.

Conventionally, in order to use a security token including a smart card, a smart card reader had to be used. And when using a smart card reader, the host device has to install a smart card reader driver, there is a problem that the user is cumbersome to use it. The present invention has been made to solve this problem, so that the USB security token interface using the Remote Network Device Interface Specification (RNDIS) to avoid the cumbersome task such as driver installation in Windows 7 or VIST environment. Also, in XP Service Pack 2 or later environment, only driver configuration file (inf) can be used after installation.

In addition, according to the features of the present invention, since the USB security token 100 including the host device 200 and the smart card communicates by the remote network device interface standard (RNDIS), ISO 7816 used in general smart cards Smart card-specific protocols, such as T0 / T1 protocols, may not be used.

Description of the function of each component for practicing the present invention is as follows. The USB security token 100 may include a USB interface module 110 and a smart card 120.

When the USB security token 100 is connected to the host device 200, the USB interface module 110 functions to interface the host device and the smart card 120 to communicate through a universal series bus (USB).

The smart card 120 may include a USB controller 130, an RNDIS interface module 131, a smart card web server 132, a security servlet 133, and a smart card memory 134.

The USB controller 130 performs a function of controlling communication with the USB interface module 110.

The USB controller is a semiconductor chip for controlling communication between USB, and designed to have a connection port with the USB controller 130 on the smart card 120 equipped with a USB controller to easily exchange data with peripheral devices that support USB. I can make it available.

The smart card memory 134 stores security data related to user authentication. The smart card memory 134 may be a nonvolatile memory, particularly for the security of data stored in the memory.

The RNDIS interface module 131 interfaces with the RNDIS packet format so that the smart card 120 and the host device 200 can communicate according to the Remote Network Driver Interface Specification (RNDIS). .

RNDIS (Remote Network Driver Interface Specification) is a network device interface standard used for a USB or Ethernet adapter. According to the present invention, when the USB security token 100 is connected to the host device 200, the host device 200 is connected to the USB security. Token 100 is recognized as a remote network device to communicate according to the Remote Network Device Interface Specification (RNDIS).

Existing security tokens communicate using the T0 / T1 protocol, a smart card-specific protocol defined by ISO 7816, so that external applications that want to use the services of the smart card must be able to use the T0 / T1 protocol function, and the hardware can also support it. Should be However, since the T0 / T1 protocol is not a commonly used protocol, there are various limitations and inconveniences for the existing security application to use the functions of the smart card. However, since the USB security token according to the present invention interfaces the RNDIS interface module 131 to communicate according to the remote network device interface standard, the security application can reduce the constraints and inconveniences caused by using the T0 / T1 protocol.

The smart card web server (SCWS: SmartCardWebServer) 132 communicates through a Transmission Control Protocol (TCP) / IP (Internet Protocol) protocol. The smart card web server (SCWS) 132 is a platform mounted in the smart card 120. The smart card web server (SCWS) 132 has a built-in web server in the smart card 120 to provide the HTTP (HyperText Transfer Protocol) requested from the host device 200. It has the ability to understand and respond to XHTML (Extensible HyperText Markup Language) as a result of requests. In other words, it implements the web server function inside the smart card and communicates with important information and services of the smart card using the HTTP (s) protocol to provide various services and contents utilization methods.

The smart card web server 132 may be configured to include a Java virtual machine capable of executing servlets. Java virtual machine is an environment that can execute Java bytecode. Java bytecode is mainly generated by compiling Java, but can also be generated by compilers of other languages.

On the other hand, the smart card web server 132 according to an embodiment of the present invention may be automatically executed when the USB security token 100 is connected to the host device 200 and the power is input.

That is, the smart card web server installed in the conventional USIM card was driven by receiving a terminal profile when the mobile terminal boots up. However, according to the present invention, in order to use the smart card web server used in the mobile terminal in a host device such as a PC, the USB security token 100 is connected to the host device 200 and power is supplied to the host device 200. When supplied, the smart card web server 132 is automatically executed.

The servlet is a Card Application of the SCWS servlet type that operates based on a smart card that supports a smart card web server (SCWS), the security servlet 133 of the present invention is executed in conjunction with the smart card web server 132, smart Authentication is performed using the security data stored on the card.

On the other hand, the security authentication system including a USB security token according to an embodiment of the present invention may be configured to further include an authentication server (300).

The authentication server 300 provides the host device 200 with a host_session key for establishing a session between the security application 210 and the USB security token 100. At this time, the security application 210 may receive the host_session key in a P2P manner.

On the other hand, the authentication server 300 may be implemented as a separate component from the security application, of course, according to the embodiment can be configured to implement the security application 210 integrated with the function of the authentication server, of course. to be.

The security servlet 133 may also generate a smart card_session key, thereby performing authentication of a security token, encryption and decryption of data using security data stored in the smart card memory 134.

Meanwhile, the USB security token 100 according to the embodiment of the present invention may further include a USB storage 170, a USB storage controller 160, and a USB hub 150 as shown in FIG. 3. .

The USB storage 170 stores data, and stores data other than data for preventing duplication, such as a certificate.

The USB storage controller 160 performs a function of controlling the USB storage.

The USB hub 150 is connected to the USB interface module and is located between the smart card 120 and the USB storage controller 160 to integrate input and output of the host device 200 and the smart card 120 and the USB storage 170. Manage.

According to this embodiment of the present invention, since the area containing the smart card for storing data that requires security, such as a public certificate and the storage area for storing the general data that does not require security, the user is a device It can be used as a general USB memory device to store general data as well as to securely store accredited certificates.

4 illustrates a security authentication method including a USB security token according to an embodiment of the present invention. According to the security authentication method including the USB security token of the present invention, first, the USB security token including the smart card performs a host device connection step (S100) in which the host device is connected through a USB (Universal Series Bus). The host device 200 includes a USB port, for example, a PC, a notebook, and the like, and the USB security token 100 is connected through the USB port.

However, at this time, in the host device connection step (S100), the USB security token 100 is connected to the USB port of the host device through the RNDIS driver of the host device to transmit data in accordance with the remote network device interface standard (RNDIS) It is characterized in that it is recognized as a device. In other words, conventionally, in order to use a security token including a smart card, a smart card reader should be used. And when using a smart card reader, the host device has to install a smart card reader driver, there is a problem that the user is cumbersome to use it. The present invention has been made to solve this problem, so that the USB security token interface using the Remote Network Device Interface Specification (RNDIS) to avoid the cumbersome operation such as driver installation, as well as the host device 200 and the smart card The included USB security token 100 communicates according to a remote network device interface standard (RNDIS), so there is an effect that a smart card-specific protocol such as the T0 / T1 protocol of ISO 7816 used in a general smart card may not be used. .

Next, the USB security token 100 performs a session establishment step (S200) of forming a session that can communicate with the host device 200. 5 specifically illustrates the steps for a host device including a USB security token and a security application 210 to authenticate and establish a session.

That is, the host device 200 further includes a security application 210 capable of establishing a session by communicating with the USB security token 100.

In the session establishment step (S200), the host device 200 receives a host_session key, which is a key for establishing a session between the secure application 210 and the USB security token 100, from the authentication server 300.

delete

delete

After the secure application 210 and the USB security token 100 establish a session, the USB security token 100 establishes data according to the host device 200 and the remote network device interface specification (RNDIS). RNDIS data transmission step for transmitting the (S300).

In addition, preferred embodiments of the present invention are disclosed for the purpose of illustration, those skilled in the art will be able to various modifications, changes, additions, etc. within the spirit and scope of the present invention, such modifications, changes, etc. fall within the scope of the claims Should be seen.

100: USB Security Token
110: USB interface module
120: smart card
130: USB controller
131: RNDIS interface module
132 smart card web server (SCWS)
133: Security Servlet
134: smart card memory
150: USB hub
160: USB Storage Controller
170: USB storage
200: host device
210: security application
300: authentication server

Claims (13)

Includes a USB interface module and a smart card that can communicate with a host device through a Universal Series Bus (USB).
The smart card, the USB controller for controlling communication with the USB interface module;
Smart card memory for storing security data related to user authentication;
An RNDIS interface module for interfacing with the RNDIS packet format so that the smart card and the host device can communicate according to a Remote Network Driver Interface Specification (RNDIS);
A smart card web server (SCWS: SmartCardWebServer) capable of communicating in a Transmission Control Protocol (TCP) / IP (Internet Protocol) protocol through the RNDIS interface module; And
And a security servlet executed in association with the smart card web server and performing authentication using the security data.
The USB security token activates the USB controller when the USB security token is connected to the host device, initializes the RNDIS interface module through the USB controller when the USB controller is activated, and the RNDIS interface module USB security token, characterized in that for automatically executing the smart card web server by operating the smart card web server.
delete delete The method of claim 1, wherein the security servlet,
USB security token, characterized in that for communicating with the authentication server to perform authentication, encryption and decryption of the security token using the security data stored in the smart card memory.
The method of claim 1, wherein the USB security token,
USB storage for storing data;
A USB storage controller capable of controlling the USB storage; And
And a USB hub connected to the USB interface module and positioned between the smart card and the USB storage controller to manage the input and output of the host device and the smart card and the USB storage.
USB security token and
The USB security token is configured as a host device that can be connected through a USB port,
The host device further includes a security application capable of establishing a session in communication with the USB security token,
The USB security token includes a USB interface module and a smart card that can communicate with a host device through a USB (Universal Series Bus),
The smart card, the USB controller for controlling communication with the USB interface module; Smart card memory for storing security data related to user authentication; An RNDIS interface module for interfacing with the RNDIS packet format so that the smart card and the host device can communicate according to a Remote Network Driver Interface Specification (RNDIS); A smart card web server (SCWS: SmartCardWebServer) capable of communicating in a Transmission Control Protocol (TCP) / IP (Internet Protocol) protocol through the RNDIS interface module; And a security servlet executed in association with the smart card web server and performing authentication using the security data.
The USB security token activates the USB controller when the USB security token is connected to the host device, initializes the RNDIS interface module through the USB controller when the USB controller is activated, and initializes the RNDIS interface module. If so, by operating the smart card web server, the security authentication system comprising a USB security token, characterized in that for automatically running the smart card web server.
delete delete delete The method of claim 6, wherein the USB security token,
USB storage for storing data;
A USB device controller capable of controlling the USB storage; And
And a USB hub connected to the USB interface module and positioned between the smart card and the USB device controller to manage the input and output of the host device, the smart card, and the USB storage. Security authentication system that includes.
delete delete delete

Images