KR101349849B1 - Universal secure information storage device - Google Patents

Abstract

The present invention relates to a universal secure information storage device comprising: an encryption block processing platform for processing encryption operations by at least one encryption algorithm, encrypting attacks using a change in current consumption according to encryption key values used in the encryption algorithm, creating decryption keys for decryption operations, performing the scheduling function of the decryption keys, and processing a block size and a key length more than a predetermined bit; a hardware platform for realizing at least one controller which executes a function for controlling access to smart cards, USB devices, and secure digital (SD) cards, a function for controlling writing on a memory, a function for controlling input and output ports for serial communication, and a function for controlling host connection devices; and at least one software for realizing writing and reading on the memory, a bootloader, a USB device driver, an SD card driver, a smart card driver, a driver for input and output ports for serial communication, a device driver for a key input function, and a driver for host connection devices. Thus, the universal secure information storage device of the present invention can be used as a security token by executing data encryption and decryption operations and a certificate storing function, can be used as a portable storage means of various information terminal devices by supporting functions of a smart card interface, a USB interface, an SD card interface, and a serial communication interface, thereby controlling the leakage of personal information and the loss of personal data, and unauthorized data access. [Reference numerals] (110) Encryption block processing platform; (120) Hardware platform; (130) Software platform

Description

UNIVERSAL SECURE INFORMATION STORAGE DEVICE}

The present invention relates to a general-purpose secure storage device, and more particularly, it can be utilized as a security token by supporting data encryption / decryption operations and certificate storage functions, and has a smart card interface, a USB interface, an SD card interface, and a serial communication interface function. It can be used as a portable storage means that can support information leakage, data loss, unauthorized secure data access to a general-purpose secure storage device.

In recent years, the spread of communication information terminals such as smartphones and tablet PCs has been rapidly expanded, and this trend is expected to continue to replace conventional feature phones and mobile phones.

In response to this change, information terminals such as smartphones and tablet PCs as well as personal PCs are exposed to universal communication network communication networks such as Wi-Fi or Bluetooth, and data leakage through external memory devices is possible. It is necessary to reinforce the information security of devices because malicious code is installed on the terminal and the risk of data leakage can not be excluded.

Recently, as personal information leakage, illegal data duplication, and public certificate leakage due to data loss of information terminal devices have become social issues, service providers, banks, governments, and corporations have secured security to counter the threat of hacking and personal information leakage. It is strengthening.

Individuals and small businesses are also obliged to securely manage personal information and personal data online and offline when using personal PCs or external HDDs (HDDs, SSDs) without a separate system.

In accordance with the Enforcement Measures for Reinforcing Stability of Management of Accredited Certificates by the Ministry of Public Administration and Security in 2011, the use of security tokens, a safe storage medium for accredited certificates, has been mandated. The range of use is expanding.

Accordingly, a smart card storing information requiring security, such as a certificate and personal information, and a security token and a USB integrated information storage device having a large capacity information storage device integrated with the USB are being developed.

Security token and secure storage device integrated USB always transmits security information in memory by USB connection to USB port such as PC and goes through authentication process. Therefore, it is necessary to use USB plugged into a PC. There is a problem that can not be used in the smart pad.

In addition, the secure storage device having an IC chip in the SD card is a method in which a memory provided in the SD card and the IC chip are connected through the SD interface, and the IC chip blocks / allows access to the memory through the SD interface. After access to the memory is allowed, there is a problem in that it is impossible to prevent unauthorized access to the memory by interrupting the access right to the memory.

The present invention can be used as a security token by storing and executing at least one cryptographic algorithm to execute data encryption / decryption operations and certificate storage functions, and support smart card interface, USB interface, SD card interface and serial communication interface functions. It can be used as a portable storage means of various information terminal devices, thereby controlling information leakage, data loss, unauthorized data access, and safe management of data security to prevent economic and social damage. It provides a general purpose secure storage device.

Among the embodiments, the general-purpose secure storage device processes an encryption operation by at least one encryption algorithm, performs encryption on an attack using a change in current consumption according to an encryption key value used in the encryption algorithm, and performs a decryption operation. A cryptographic block processing platform for generating a decryption key, performing a scheduling function of the decryption key, and processing a block size and a key length of a predetermined bit or more; Control functions for connecting smart cards, USB devices, and SD cards (Secure Digital Cards), write control functions for memory, input / output port control functions for serial communication, key input control functions, and control functions for host connection devices A hardware platform implementing at least one controller; And writing and reading the memory, a boot loader, a USB device driver, an SD card driver, a smart card driver, a driver of an input / output port for serial communication, a device driver for a key input function, and a device driver for a host connection. And at least one software to implement, wherein the controller of the hardware platform stores the blacklist information including an internet address, a string, a phone number, and URL information, and classifies a storage area according to a risk of the blacklist information. Data storage module; An information extraction module for extracting index information for prohibiting unauthorized data access when the smart card, USB device, SD card, input / output port or host connection device is connected; A filtering module for comparing the extracted index information with the blacklist information to search for the unauthorized data connection; And an access control module for outputting a warning message or controlling a corresponding data connection when there is an unauthorized data connection through the filtering module.

In this case, the cryptographic block processing platform includes an algorithm execution module for storing and executing at least one encryption algorithm using a unidirectional key, a symmetric key, or an asymmetric key scheme; A random bit generation module which receives an encryption result of the algorithm execution module and generates a random bit stream to generate an encryption key; And a control module configured to control a memory that sequentially receives the encrypted or decrypted data while the encryption operation or the decryption operation is in progress.

The algorithm execution module, the one-way key is at least one of MD5, Serfu, H-Hash, MD2, MD4, SHA, HAVAL, and the symmetric key is 3DES, AES, SEED, ARIA, DES, CRYPTON, RIJNDAEL , CAST256, RC6, RC5, RC4, RC2, TWOFISH, MARS, SERPENT, SKIPJACK, IDEA, SEAL, DESX, RC5, BLOWFISH, CAST128, SAFER, at least one or more of the asymmetric key, RSA, EIGamal, ECC, It is characterized by using at least one of DSS and PKP.

The controller of the hardware platform may include a data storage module configured to store blacklist information including an internet address, a string, a phone number, and URL information, and to classify a storage area according to a risk of the blacklist information; An information extraction module for extracting index information for prohibiting unauthorized data access when the smart card, USB device, SD card, input / output port or host connection device is connected; A filtering module for comparing the extracted index information with the blacklist information to search for the unauthorized data connection; And an access control module for outputting a warning message or controlling a corresponding data connection when there is an unauthorized data connection through the filtering module.

If the index information includes the same information among the blacklist information, the filtering module reads string information having a specific length or more including the index information, and searches for information in which a matching ratio with the blacklist information is equal to or greater than a first determination condition. Extracts matching information, and if the matching information extracted in the first determination condition satisfies a second determination condition in which the same character string exists among the blacklist information, the data connection including the index information is not permitted. It is characterized by judging by the connection.

The filtering module, when the index information does not have the same information among the blacklist information, determines that the data connection including the index information is a permitted data connection, and the index information is the same information among the blacklist information. Is present but does not satisfy the first determination condition, data access information including the index information is stored in a low risk storage area of the data storage module, and the index information includes the same information among the blacklist information. And storing the data access information including the index information in the medium risk storage area of the data storage module when the first determination condition is satisfied and the second determination condition is not satisfied. The same information exists among the information, and the first judgment group And a high risk of the data storage module, a data access information including the index information in the case that satisfies the determination condition 2 is also characterized in that stored in the storage area.

The general purpose secure storage device of the present invention stores and executes at least one cryptographic algorithm to execute data encryption / decryption operations and certificate storage functions to be used as security tokens, and includes a smart card interface, a USB interface, an SD card interface, and a serial. It can support the communication interface function, so it can be used as a portable storage means of various information terminal devices, thereby controlling the leakage of personal information, the loss of personal data, and unauthorized access of data, and for companies, financial institutions, public institutions and countries. Applied to institutions, safety management of data security can be carried out, which can prevent economic and social damages.

1 is a diagram illustrating a configuration of a general purpose secure storage device according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration of a cryptographic block processing platform of FIG. 1.
Figure 3 is a block diagram illustrating a processor portion of a general purpose secure storage device in accordance with one embodiment of the present invention.
4 is a block diagram illustrating a configuration of a controller of the hardware platform of FIG. 1.

The description of the present invention is merely an example for structural or functional explanation, and the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the present invention should be understood to include equivalents capable of realizing technical ideas. Also, the purpose or effect of the present invention should not be construed as limiting the scope of the present invention, since it does not mean that a specific embodiment should include all or only such effect.

Meanwhile, the meaning of the terms described in the present invention should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

It should be understood that the singular " include "or" have "are to be construed as including a stated feature, number, step, operation, component, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present invention.

1 is a diagram illustrating a configuration of a general purpose secure storage device according to an embodiment of the present invention.

Referring to FIG. 1, the universal secure storage device 100 includes a cryptographic block processing platform 110, a hardware platform 120, and a software platform 130.

The cryptographic block processing platform 110 processes cryptographic operations using at least one cryptographic algorithm, processes 256-bit block sizes and key lengths, generates decryption keys for decryption operations, and schedules the decryption keys. Proceed to encrypt the attack using the current consumption change according to the encryption key value used in the encryption algorithm.

The cryptographic block processing platform 110 utilizes an Advanced Encryption Standard (AES) 256-bit hardware accelerator and elliptic ECC (Elliptic), an attack defense cipher of 224bit / 256bit differential power analysis (DPA) using a change in current consumption. Curve Cryptosystem) is built in.

 The hardware platform 120 may control inputs and outputs of smart cards, USB devices, and SD cards (Secure Digital Cards), write control of NOR / NAND flash memory, and SPI / I2C / UART / GPIO for serial communication. At least one controller may be implemented to execute a control function of a port, a control function for a keypad and a touch input, and a control function of a device (Serial Advanced Technology Attachment, SATA).

The software platform 130 writes and reads NOR / NAND flash memory, bootloaders, USB device drivers, SD card drivers, smart card drivers, and SPI / I2C / UART / GPIOs for serial communication. At least one software that implements a driver, a device driver for keypad and touch functions, and a driver for SATA.

FIG. 2 is a block diagram illustrating a configuration of a cryptographic block processing platform of FIG. 1.

Referring to FIG. 2, the cryptographic block processing platform 110 includes an algorithm execution module 210, a random bit generation module 220, and a control module 230.

The algorithm execution module 210 stores and executes at least one encryption algorithm using a unidirectional key, symmetric key, or asymmetric key method to perform an encryption operation.

The algorithm execution module 210 uses at least one of MD5, Serfu, H-Hash, MD2, MD4, SHA, and HAVAL as unidirectional keys, and 3DES, AES, SEED, ARIA, DES, CRYPTON, RIJNDAEL, and CAST256 with symmetric keys. Use at least one of, RC6, RC5, RC4, RC2, TWOFISH, MARS, SERPENT, SKIPJACK, IDEA, SEAL, DESX, RC5, BLOWFISH, CAST128, SAFER, and among the RSA, EIGamal, ECC, DSS, PKP with asymmetric keys At least one or more may be used.

In one embodiment, the algorithm execution module 210 uses SHA-256 as a unidirectional key, AES / ARIA as a symmetric key and RSA / ECC as an asymmetric key.

The random bit generation module 220 receives the encryption result of the algorithm execution module 210 and generates a random bit stream to generate an encryption key.

The control module 230 controls the FIFO (First-In First out) memory which receives the data whose encryption is completed while the encryption operation is in progress by the algorithm execution module 210 and sequentially stores the data.

Figure 3 is a block diagram illustrating a processor portion of a general purpose secure storage device in accordance with one embodiment of the present invention.

Referring to FIG. 3, a general-purpose secure storage device 100 is implemented by a cryptographic block processing platform 110 and a software platform 130 through which an ARM-based CPU 300, which is a secure processor, is connected to an AHB bus and is connected to an AHB bus. It is connected to the USB 2.0 device IP (Inetface Protocol) 131, SD card 2.0 IP 132, static SDRAM IP 133, internal SRAM IP 134, NAND flash IP 135.

The algorithm execution module 210 of the encryption block processing platform 110 may execute an encryption algorithm using the ARIA / AES 211, the ECC 212, the RSA 213, and the SHA 214.

The USB 2.0 device IP 131 is connected to the PHY circuit 131a and connected to the USB 3.0 interface. PHY circuitry 131a is a standard physical layer interface for a USB port. The static SDRAM IP 133 is connected to the NOR flash memory 101 and the SDRAM 102, the internal SRAM IP 134 is connected to the internal SRAM 103, and the NAND flash IP 135 is the NAND flash memory 104. )

The bridge circuit 105 is connected to an AHB bus, which is a high-speed bus, and an APB bus, which is a low-speed bus. The APB bus is provided with a smart card IP 136, an SPI / I2C / UART / GPIO input / output port 137a to 137d, and a timer ( 106, a Watch Dog Timer (WTC) 107, and a Real Time Clock (RTC) 108 are connected.

The interrupt controller (INTC) 10 controls the setting and determination of the interrupt level and the interrupt request for the CPU 300.

4 is a block diagram illustrating a configuration of a controller of the hardware platform of FIG. 1.

Referring to FIG. 4, the controller of the hardware platform 120 is an ARM-based CPU 300, and includes a data storage module 320, an information extraction module 330, a filtering module 340, and an access control module 350. Include.

The data storage module 320 stores the blacklist information including the Internet address, a string, a phone number, and URL information in the memory 310. The memory 310 includes a NOR flash memory 101, an SDRAM 102, and an internal device. It may be one of the SRAM 103 and the NAND flash memory 103.

The data storage module 320 may be divided into a high risk storage region 313, a medium risk storage region 312, and a low risk storage region 311 according to the risk of the blacklist information.

The information extraction module 330 extracts index information for prohibiting unauthorized data access when data transfer or leakage occurs due to connection of a STAT device such as a smart card, a USB device, an SD card, an input / output port, or a PC. do.

The filtering module 340 compares the extracted index information and the blacklist information to search for an unauthorized data connection, and the access control module 350 performs an unauthorized data connection through the filtering module 340. Warning message or control of data access.

For example, if "http://img.kruncles.info/css.html" is stored in the blacklist information, and the general purpose secure storage device 100 is connected to the PC through the STAT device, the "http://img.kruncles.info/css.html" is stored in the "http://img.kruncles.info/css.html". If you try to access the URL ": //img.kruncles.info/cdd.html", the information extraction module extracts the index information of 'kruncles'.

If the same information as the index information of 'kruncles' exists in the blacklist information, the filtering module 340 may primarily use 'img.kruncles.info/cdd.html' in the URL information to match the entire URL information and the blacklist information. The character string information of "'is read, and the matching information containing the information with a matching rate with black list information more than a 1st determination condition is extracted.

The first determination condition may be a case in which character string information excluding special characters or symbols has a matching rate of 70% or more with blacklist information.

The filtering module 340 sets the second determination condition as the case where the matching information satisfying the first determination condition is 90% or more, and the matching rate between the matching information and the blacklist information is 90% or more. Therefore, the URL information of "http://img.kruncles.info/cdd.html" is determined to be an unauthorized data connection.

The access control module 350 blocks the URL access of "http://img.kruncles.info/cdd.html" and outputs a warning message "You have accessed an unauthorized URL."

On the other hand, the filtering module 340 determines that the data connection including the index information is an authorized data connection when the index information does not have the same information among the blacklist information. In addition, the filtering module 340 may store the white list in the memory 310 through the data storage module 320 in the case of an authorized data connection.

In addition, the filtering module 340 stores the data access information including the index information in the memory 310 through the data storage module 320 when the same information exists among the blacklist information but does not satisfy the first determination condition. In the low risk storage area 311.

When the index information satisfies the first determination condition while the same information is present among the blacklist information, but does not satisfy the second determination condition, the filtering module 340 stores the data connection information including the index information. It is stored in the medium risk storage area 312 through. At this time, the access control module 350 outputs an inquiry message as to whether to store the Internet address, string, phone number and URL information stored in the medium risk storage area 312 as a blacklist to the user, and the user's response message ( YES / NO) determines whether to save the blacklist.

The filtering module 340 stores the data access information including the index information through the data storage module 320 when the index information has the same information among the blacklist information and satisfies the first and second determination conditions. Stored in the high risk storage area 313 (310).

The data storage module 320 may update or share the blacklist information periodically or at the user's request.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

100: universal secure storage device 110: password block processing platform
120: hardware platform 130: software platform
210: algorithm execution module 220: random bit generation module
230: control module 300: CPU
320: data storage module 330: information extraction module
340: filtering module 350: access control module

Claims (6)

Process the encryption operation by at least one encryption algorithm, perform encryption for an attack using a change in current consumption according to the encryption key value used in the encryption algorithm, generate a decryption key for decryption operation, and decrypt the decryption key A cryptographic block processing platform for performing a scheduling function of and processing a block size and a key length of a predetermined bit or more;
Control functions for connecting smart cards, USB devices, and SD cards (Secure Digital Cards), write control functions for memory, input / output port control functions for serial communication, key input control functions, and control functions for host connection devices A hardware platform implementing at least one controller; And
Write and read the memory, boot loader (Bootloder), USB device driver, SD card driver, smart card driver, driver of input / output port for serial communication, device driver for key input function and device driver for host connection Includes a software platform comprising at least one software,
The controller of the hardware platform,
A data storage module for storing blacklist information including an internet address, a character string, a phone number, and URL information, and classifying a storage area according to a risk of the blacklist information;
An information extraction module for extracting index information for prohibiting unauthorized data access when the smart card, USB device, SD card, input / output port or host connection device is connected;
A filtering module for comparing the extracted index information with the blacklist information to search for the unauthorized data connection; And
And a connection control module for outputting a warning message or controlling a corresponding data connection when there is an unauthorized data connection through the filtering module.
The method of claim 1, wherein the cryptographic block processing platform,
An algorithm execution module for storing and executing at least one encryption algorithm using a unidirectional key, symmetric key, or asymmetric key scheme;
A random bit generation module which receives an encryption result of the algorithm execution module and generates a random bit stream to generate an encryption key; And
And a control module configured to control a memory for sequentially receiving the encrypted or decrypted data while the encryption operation or the decryption operation is in progress.
The method of claim 2, wherein the algorithm execution module,
The unidirectional key uses at least one of MD5, Serfu, H-Hash, MD2, MD4, SHA, HAVAL,
The symmetric key is selected from 3DES, AES, SEED, ARIA, DES, CRYPTON, RIJNDAEL, CAST256, RC6, RC5, RC4, RC2, TWOFISH, MARS, SERPENT, SKIPJACK, IDEA, SEAL, DESX, RC5, BLOWFISH, CAST128, SAFER. Using at least one,
The asymmetric key is a general-purpose secure storage device, characterized in that using at least one of RSA, EIGamal, ECC, DSS, PKP.
delete The method of claim 1,
The filtering module, when the index information has the same information among the blacklist information,
Reading character string information having a specific length including the index information and extracting matching information including information having a matching ratio with the black list information equal to or greater than a first determination condition,
When the matching information extracted from the first determination condition satisfies the second determination condition in which the same character string exists among the blacklist information, the data connection including the index information is determined to be an unauthorized connection. Universal Secure Storage.
The method of claim 5, wherein the filtering module,
If the index information does not have the same information among the blacklist information, it is determined that the data connection including the index information is an authorized data connection,
If the index information includes the same information among the blacklist information but does not satisfy the first determination condition, data access information including the index information is stored in a low risk storage area of the data storage module,
When the index information includes the same information among the blacklist information, the first determination condition is satisfied and the second determination condition is not satisfied, the data access information including the index information is seriously risked by the data storage module. Stores it in storage,
When the index information has the same information among the black list information and satisfies the first and second determination conditions, data access information including the index information is stored in the high risk storage area of the data storage module. General purpose secure storage device, characterized in that.

Images