KR20010054357A - Method for controlling Universal Serial Bus security module using crypto-chip - Google Patents

Abstract

PURPOSE: A method for controlling a USB security module using a password chip based on a PC is provided to prevent an illegal user from illegally copying and correcting software or data by providing a USB security module to a lock, and by controlling a crypto-chip using a USB port. CONSTITUTION: A device driver is opened(S1). In case that there's no error(S2), an ID of the device is required(S3). In case that there's no error(S4), a key is transmitted to a USB(Universal Serial Bus) security module(S5). In case that there's no error(S6), a discramble code encoded is transmitted to the USB security module(S7). The discramble code decoded from the USB security module is sent back to a control program(S8). In case that there's no error(S9), a CRC of the discramble code is checked(S10). An error is checked(S11). An execution code encoded is transmitted to the USB security module(S12). The execution code encoded is encoded and sent back(S13). In case that there's no error(S14), the execution code is discrambled in a discrambling procedure of the control program(S15). It is checked whether the CRC is properly decoded(S16). An error is checked(S17). An error message for the device is outputted(S19). An error message for decoding is outputted(S20).

Description

Method for controlling Universal Serial Bus security module using crypto-chip

The present invention relates to a USB (Universal Serial Bus) security module control method using a PC-based encryption chip, in particular USB security with built-in user authentication and data encryption and decryption algorithms for software copy protection and illegal user access blocking The present invention relates to a method of controlling a U.S. non-security module using a PC-based encryption chip by a control program for controlling a module.

In general, software developers are faced with many difficulties due to the unauthorized copying and illegal access of software developed with the development of information and communication technology. Due to the lack of software technology in Korea, private security chips are rarely developed in domestic private companies.

Since these software protections always have the potential for unauthorized copying and alteration, security and protection equipment developers around the world are able to prove their identity to a much higher level of security and authenticity and non-replicable common credit card sizes. And other information, but are not known to be copied or hacked.

In fact, the function of the lock is implemented by software or hardware. An application equipped with a lock determines whether a lock is present or an error by locking checking with the lock in a predetermined manner. As shown in FIG. 1, even when a lock first appears, the lock has been developed into a hardware lock because a serial number or a unique ID is easily exposed inside the lock.

Hardware locks can generally be classified into EEPROM and ASIC formats. EEPROM format is a ROM writer that writes a unique value (serial number or unique ID) to the lock, making it easy to copy and modify. The lock, which consists of ASIC chips, is manufactured at the time of manufacture. You cannot duplicate or modify the value except for. Therefore, in case of EEPROM, serial number can be arbitrarily locked by a third party, but in case of chip made by ASIC, it has the same serial number at the time of manufacture. Only paths can produce locks with the same serial number. Therefore, when a lock is made of an ASIC chip, it is almost impossible to duplicate the lock itself. However, this method also checks the transmitted and received data using a lock simulator or the like and converts the program into machine code so that the lock can be disabled to copy the program without permission. Currently, most of the locks on the market in our country are hardware locks.

However, hardware lock does not differ much from software lock copy protection because of the manufacturing cost, so in countries where more copies are used than in regular programs, more software is sold or restricted. There is a tendency to induce purchases by differentiation of post management by using a method such as user registration. Therefore, domestic and overseas lock manufacturers are looking for ways to increase manufacturing costs versus copy protection. One of them is to encrypt the executable or data file and to get the key used for encryption from the lock (HASP). This method has been well-received by National Software Testing Laboratories (NSTL), but it is pointed out that the program execution time is greatly affected by the frequency of lock checks. In addition, despite the high evaluation in terms of security level and flexibility, because of the control structure by software, illegal copying is possible by debugging at the machine level.

However, it is simply a method of placing a microprocessor inside the lock to check the existence and matching of the lock or the program, so that the lock set once in the software is impossible or difficult to recycle. Since data encryption by software is performed, the speed of supported additional functions is slow, and the cost is low by using simple encryption algorithm.It is difficult to put various additional functions because there is only software copy protection function. Since only the locks for multiple software must be connected, all the locks need to be connected, which causes problems of lack of connection space or errors in the recognition of peripheral devices such as printers, and there are separate locks in the software. And only sells separately. Need to lock (Lock) for each word, and the user has the disadvantage that must be managed separately rock of the software purchased.

The present invention has been proposed to solve the above problems of the prior art, and an object of the present invention is to embed various encryption / decryption algorithms such as RSA algorithm, which is a public key-based asymmetric encryption algorithm, and KSE96 algorithm, which is an improved DES encryption algorithm. By embedding a crypto-chip in a copy protection lock and controlling it using a USB port, the PC is controlled by a USB security module having a PC-based USB interface and a control program for controlling an information protection device using a crypto chip. Provides a method for controlling a non-security module using PC-based encryption chips to prevent illegal copying and modification of software or data by illegal users.

1A and 1B are schematic views of a program copy protection device according to a conventional embodiment.

Figure 2a is a conceptual diagram of an information protection system by encryption and decryption to block unauthorized copying and illegal access of the present invention.

Figure 2b is a security module using a PC-based USB according to the present invention.

Figure 3 is a schematic diagram illustrating a USB security module and program copy protection method according to the present invention.

4 is a flowchart showing the operation of the USB security module and the control program according to the present invention.

5A-5C are flow diagrams illustrating operations within the USB security module.

Explanation of symbols on the main parts of the drawings

10: Computer 7: USB Tab

17: control program 20: USB security module

23: USB controller 27: encryption chip

USB: Universal Serial Bus

In order to achieve the above object, the present invention opens the device driver by the control program (S1) and if there is no error (S2) requests the device ID which is the serial number of the USB security module (S3) and if there is no error (S4) Transmitting a key to the USB security module (S5); In step S5, if there is no error (S6), an encrypted descramble code (E (Discramble) code) existing in software is transmitted to the USB security module (S7), and the descramble code (Discramble code) decrypted from the USB security module. Check the CRC of the descramble code if there is no error (S9) after returning the control program to the control program (S8); After the CRC check, the error is checked (S11) and if there is no error, the execution code (E _KM (Exe) code) encrypted using the key KM is transmitted to the USB security module (S12), and the key is received from the USB security module. The execution code (E _KSR (Exe) code) encrypted using the _KSR is returned (S13) and if there is no error (S14), the E _KSR (Exe) code is descrambled in the descrambling procedure of the control program (Sc). S15) CRC checking whether it is properly decoded (S16); And checks the error after the CRC check in step S16 (S17), if there is no error, jumps to the original program location and executes it (S18). (S19), if there is an error in the process S11 and S17 provides a method for controlling the U.S. non-security module using a PC-based encryption chip, characterized in that the step of outputting a decryption error message (S20) and ends. do.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2A is a conceptual diagram of an information protection system by encryption / decryption to prevent unauthorized copying and illegal access.

Referring to FIG. 2B, the PC-based USB security module 20 includes a USB controller 23 and a crypto-chip 27, and a USB tab 7 of the computer 10. Is controlled by the control program 17.

The USB (Universal Serial Bus) interface can be inserted or removed regardless of the PC's power on / off, and because it has a high data transfer speed, the USB interface connected to the USB tab 7 in the PC environment is built-in. The USB security module 20 is suitable for use as an authentication and data protection system. For reference, USB is a standard input / output interface of a PC, and is not limited to a PC peripheral device, but also a speaker from a communication device such as a fax machine.

The present invention is embodied in the encryption chip 27 in the USB security module 20 so as to have the world's first access control and information protection of software using USB, a new interface standard, a user authentication function, and an encryption / decryption function. Only when the USB security module 20 is plugged into the USB tab 7 which is a connector for interfacing to the built-in USB port, the control program 17 is installed and used in the computer 10.

The encryption chip 27 has an encryption function such as a cryptographic and authentication algorithm made of ASIC, KSE 96 algorithm, which is an improved DES algorithm, a secret key based symmetric encryption algorithm, and an RSA algorithm, which is an asymmetric encryption algorithm based on a public key. Security Modules can be created to protect data and prevent unauthorized copying of software, and to include access control and control of PCs.

The control program 17 has a device driver between the protected software and the USB security module 20 and controls the USB security module 20. At this time, in order to prevent the exposure of the program on the PC, the USB security module 20 monitors the state of the PC through the device driver and immediately detects the presence of a monitoring program including any debugger. A mode checker, a circuit for stopping execution, is mounted in the USB security module.

Therefore, the PC-based USB module control program according to the present invention is a much more robust system than commercial copy protection products and has the following functions.

■ Prevent unauthorized copying and illegal access of the software.

The present invention is implemented in a new copy protection method having a distinction from the existing general copy protection locks used at home and abroad can be carried out only when the USB security module 20 is present, the copy protection software, simply It is a completely different approach from the traditional way of determining the performance of software based on the presence of modules.

The configuration diagram of a system for preventing unauthorized copying and illegal access is shown in FIG. 2B, and the execution software is encrypted and sold by the USB security module 20, and the user receives the user's authentication through a legitimate purchase. Since the security module 20 must be present to execute the software, illegal copying and access of the software is prevented.

The execution software modifies the portion E (code) protected by the USB security module so that the USB security module 20 can be used, and encrypts / decrypts data generated as necessary. This can be done using the module 20. Therefore, the leakage by the third party of the data protected by the USB security module 20 becomes impossible unless it is in the same Security Module.

■ Perform user authentication.

The USB security module 20 issued to a user has a unique ID therein and has a built-in encryption algorithm, thereby having a robust authentication function, and the data encrypted by the USB security module 20 is the same security module. However, access control is possible because the decryption is performed only in the module with the authorized ID.

■ It has a function of encrypting / decrypting data.

The USB security module 20 performs a fast encryption / decryption operation of data, and the KSE96 encryption algorithm or the RSA encryption algorithm built in the USB security module 20 may convert a table as necessary. Therefore, since it operates with a unique algorithm, it cannot be decrypted without a module used for encryption, thus exhibiting a strong data protection function.

The USB tab 7 is an extension of a USB connector installed on the back of the computer 10, and also serves as a hub. The USB security module 20 has a built-in encryption chip 27 to be designed in-house and ASIC. A user may access a PC using the USB security module 20 and may be limited whether or not an application program can be executed by an access right according to the USB security module 20.

○ Function and standard

▷ User login / logout function using USB security module

Commercially available products that provide authentication do not provide automatic login / logout and do not manage user environments separately.

▷ Separate environment setting function

After the automatic login (login), the environment set by the user is automatically set. It is also automatically saved at logout and restored at the next login.

▷ Permission setting and access control function by software

S / W encrypted with Class ID can be executed by USB security module with same Class ID. Therefore, if the use is allowed only in the same office, the S / W can be protected using the common Class ID of the office.

▷ Easy to carry

The USB security module is only about the size of a normal paint (60mm x 15mm x 7mm), is easy to carry and is hardly affected by the operating system and the physical environment.

▷ No replication

Summarizing the problems of the existing copy protection system (Lock), since the existing lock has a function of checking the presence or absence of a lock in accessible software, the function of the lock can be removed only by changing the software. The applied algorithm encrypts execution code that must be executed when the software is executed, thereby making it impossible to change the software.

ㆍ High speed data processing function: 1.5 Mbps, 12 Mbps

ㆍ USB standard specification support: V 1.1

Multilanguage support:

C, C ++, Clipper, Pascal, Visual Basic, Power Builder, Delphi

Automatic installation function

ㆍ Software Copy Protection

ㆍ Data encryption / decryption function (Encryption / Decryption)

ㆍ Security Module Auto Protection

ㆍ Software crack prevention function for security module control

(anti debugging, Tamper Resistance)

ㆍ Collision avoidance with USB interface device

▷ USB Security Module

-Development of security modules

ㆍ Chip Chip: Data encryption / decryption function, user authentication function

ㆍ Interface board: Protection of I / O and transmission data using USB port

ㆍ USB Security Module Controller: Device controller program with built-in data protection

ㆍ Automatic protection tool of executable data: Automatic locking tool of executable file and data

ㆍ Manual implementation library of executable data:

Library with source of executable

ㆍ KIT for developers: DK for developers to easily apply USB security module

ㆍ Module Programmer: H / W based tool for programming during module manufacturing

ㆍ Module tester: USB security module verification H / W tool with security function

-Development of management network

ㆍ Module management P / G: DB management for module key value management

ㆍ Authentication code (Auth. Code) production P / G: Authentication code issue with security function P / G

ㆍ Web site design for end user access

Currently, products for certification include smart cards, IC cards, magnetic stripe cards, and biometric systems, and there are many physical products such as HardLock and Sentinel Lock as data protection and software duplication devices. It is sold. Table 1 compares the developed products and the characteristics of other products and the present invention.

Kinds Other products Development of the present invention Certification Smart Card Copy protection intelligent lock Type of installation Phone card form ㆍ Internal: ISA slot insertion ・ External: LPT insertion External: Insert USB Port How it works Encryption algorithm in card encrypts data and information to user for transmission and storage How to check the existence of a lock and a program by placing a microprocessor inside the lock High speed encryption and copy protection by placing an encryption chip with a microprocessor in the security module pros and cons ㆍ It is difficult to duplicate locks · Easy to carry · Provides only authentication and data archiving functions • Needs additional input device · No data encryption ㆍ More functions than simple type, not recyclable, slow speed of additional functions supported due to data encryption by supporting software, and low ratio of encrypted data ㆍ It is impossible to copy because it is encrypted by one-chip encryption chip, and it is possible to reuse it.It has various additional functions.It is applicable to high-speed communication networks due to the speed of encryption.It has a high rate of encryption data. No device needed Product and Company MegaLock (limit), HASP (Alladin), Sentinel (Rainbow), Hard Lock Not developed worldwide

Protects data and prevents unauthorized copying of software in a USB security module that encrypts encryption / decryption algorithms and authentication algorithms with cryptographic chips made with ASICs, and controls and controls PC access using cryptographic chips. The PC-based USB module that provides the user authentication function is controlled by the control program.

3 is a schematic diagram illustrating a USB security module and a program copy protection method according to the present invention. The program maker encrypts the execution code or data of the program using the key stored in the key table 22 of the USB security module 20 and stores the encrypted code in the auxiliary storage medium 12.

The computer 10 operates in accordance with the control program 17 to share the encrypted execution code or data and the debug mode determination bits stored in the auxiliary storage medium 12 through a device driver. 20).

The USB security module 20 receives the encrypted execution code or data and the debug mode determination bit from the computer 10, and uses a specific key that stores the encrypted execution code or data in advance only in the debug mode. Then decrypt and transmit to the computer 10.

The mode checker 24 receives a debug mode determination bit from the computer 10 through the buffer, determines whether the mode is in the debug mode, and performs the encryption / decryption process only when the debug mode is not in the debug mode. The specific key stored in (22) is outputted to the encryption / decryptor 26.

The encryption / decryptor 26 receives the specific key and decrypts the encrypted execution code or data input through the buffer and outputs the decrypted execution code or data to the computer 10.

In this case, the key table 22, the mode checker 24 and the encryption / decryptor 26 are implemented as an application specific integrated circuit (ASIC) is embedded in the USB security module 20, the key The table 22 is made in a write-only form so that the key is unknown to the producer, and a plurality of keys may be stored to simultaneously support copy protection for a plurality of programs.

The program stored in the secondary storage medium 12 is an executable code or data encrypted using a control program and a key stored in the key table 22 of the USB security module 20, and an unencrypted executable code or data. Consists of When a program stored in the auxiliary storage medium 12 is executed by an application program of the computer 10, a control program is stored in the memory of the computer 10, and the computer 10 is encrypted according to the control program. Position information on the execution code and data is output to the device driver 14. That is, when the application program executes an executable file, it is first checked whether the executable file is executable. If the executable file is executable, the program is executed according to an execution rule. In order to execute the program, it is checked whether there is enough memory to load the program. If it does exist, it loads the execution module into memory. Then, the relocation information is read from the contents of the executable file to reposition specific parts of the execution module, and then information such as a start position is set in the CPU register of the computer 10.

As such, repositioning a specific portion of an execution module makes it impossible to duplicate the execution module loaded in the memory by storing the file again as a file.

4 is a flowchart showing the operation of the USB security module and the control program according to the present invention.

If the device driver is opened by the control program 17 (step S1) and there is no error (S2), the device ID which is the serial number of the USB security module 20 is requested (step S3), and if there is no error (step S4) The key is transmitted to the USB security module 20 (step S5).

If there is no error in step S5 (step S6), the encrypted descrambling code (E (Discramble) code) existing in the software is transmitted to the USB security module 20 (step S7), and from the USB security module 20 After the decoded descramble code is returned to the control program (step S8), if there is no error (step S9), the CRC of the descramble code is checked (step S10).

After the CRC check, the error is checked (step S11) and if there is no error, the execution code (E _KM (Exe) code) encrypted using the key KM is transmitted to the USB security module 20 (step S12). Encrypts and returns the executable code (E _KSR (Exe) code) encrypted using the key KSR from the USB security module (step S13). If there is no error (step S14), the descrambling of the E _KSR (Exe) code is performed. The procedure descrambling (discrambling) (step S15) and checks whether the CRC is correctly decoded (step S16).

Check the error after the CRC check in step S16 (step S17). If there is no error, jump to the original program position and then execute it (step S18). If there is an error in steps S2, S4, S6, S9, and S14, output an error message. (Step S19), if there is an error in steps S11 and S17, the decoding error message is output (step S20) and then terminated.

5A-5C are flow charts illustrating the operation within the USB security module.

The operating system of the computer requests permission to use the USB security module 20 (step S21), and if permission is granted (step S22), initializes an internal register of the controller in the USB security module 20 (step S23). Check (step S24), if it is not a data input, check whether the device has been removed (step S25). If it is removed, it ends. If not, it checks the data input again.

If the data is input, the control word is analyzed (step S26) and the module information request is checked (step S27). If the module information is returned, the module ID is returned through the USB port (step S28). Otherwise, it is checked whether it is a debugger command (step S29).

The debugger command compares the input value with the debug info table (step S30) and checks for the presence of the debugger (step S31). If the debugger does not exist, it returns to step S24. If the debugger exists, an error is detected through the USB port. Return (step S32) and forcibly stop the USB security module 20 (step S33).

If it is not the debugger command, it is checked whether it is a key setting command (step S34). If it is not a key setting, it is checked whether it is a data input / output command (step S35).

If the control word analysis result is the key setting command, it is checked whether it is an internal key setting (step S36). If an internal key setting, an internal key is generated using a module ID and an input value (step S37), and an internal key is set (step 38). Return to step S24.

If the result of the control word analysis is not the internal key setting or the external key setting (step S39), if the external key setting is set, the external key is set as an input value (step S40), and then returns to step S24. By checking whether the scrambled key is set (step S41) and generating a scrambled key with the module ID and the input value (step S42), the scrambled key is set (step S43) and the process returns to step S24, and if not the scrambled key setting, returns to step S24. .

After the control word analysis, if the control word analysis result is the data input / output command, it is checked whether it is encryption (step S44). If it is encryption, it is checked whether it is the internal key (step S45). (Step S46) If the internal key is not used, the input value is encrypted with the foreign key (step S47).

In step S44, it is checked whether the encryption is an internal key or not (step S48). If the internal key is used, the input value is decrypted with the internal key (step S49). If the internal key is not used, the input value is decrypted with the external key (step S50).

After the encryption and decryption process, it is checked whether or not to perform scramble by the flag bit set in the control word (step S51), and then scrambles to perform scramble of the result value (step S52). After returning the result value to the control program 17 through the scrambler, buffer, and device driver of the USB security module 20 (step S53), the process returns to step S24, and if the scramble is not performed, the result value is immediately returned. Return to step S24.

Therefore, the PC-based USB encryption chip can be controlled by the control program of the USB security module incorporating user authentication and data encryption / decryption algorithms, thereby preventing software copying and preventing unauthorized users from accessing.

As described above, the U.S. non-security module control method using a PC-based encryption chip according to the present invention is an encryption / decryption algorithm such as an RSA encryption algorithm, a KSE96 algorithm, a scrambler, and the like by a control program connected to a USB interface. By controlling the USB security module including the encryption chip built into this ASIC, user authentication, access control and control of important data on the PC using the encryption chip, and unauthorized copying of the software by encrypting and decrypting the important data using the USB security module And it is effective to block illegal access.

In addition, the execution software is encrypted and sold with an algorithm such as an encryption algorithm of the USB security module, and the control program executes after decrypting the encrypted portion of the execution software, and executes to prevent illegal cracking of the decrypted S / W. When opaque execution is detected such as memory management and debugging tool at the end, S / W execution stop function and USB security module store 10 Class ID and Private ID, respectively. With multiple software protection features and the use of EEPROMs, the module can be reused and extended.

The encryption chip with the new copy protection algorithm can be applied not only to the USB module but also to the security card or copy protection system of the PCI and ISA interface standard, and the USB security module can be restored to the power saving function by plugging it into the PC through the USB port. When the security module is removed and the security module is removed, the power saving function is activated after the automatic logout, and the user management with thorough user management is saved. The user authentication technology using the USB security module uses the existing password software. Certification strength is superior to certification technology.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art will be able to variously modify and change the present invention without departing from the spirit and scope of the invention described in the claims below. It will be appreciated.

Claims (3)

In an information protection system with a USB tab and a USB security module that are USB interfaced to a computer: (a) Open the device driver by the control program (S1) and if there is no error (S2) request the device ID which is the serial number of the USB security module (S3) and if there is no error (S4) send the key to the USB security module. Step S5; (b) If there is no error in step S5 (S6), the encrypted descramble code (E (Discramble) code) existing in the software is transmitted to the USB security module (S7), and the descramble code decrypted from the USB security module. Checking the CRC of the descramble code if there is no error after returning (Discramble code) to the control program (S8) (S10); (c) After checking the CRC, check the error (S11) and if there is no error, transmit the encrypted execution code (E _KM (Exe) code) using the key KM to the USB security module (S12), and the USB security The execution code (E _KSR (Exe) code) encrypted using the key KSR is returned from the module (S13) and if there is no error (S14), the E _KSR (Exe) code is descrambled in the descrambling procedure of the control program. (S15) CRC check whether it is correctly decoded (S16); And (d) Check the error after CRC check in step S16 (S17). If there is no error, jump to the original program position and execute it (S18). If there is an error in S2, S4, S6, S9, and S14, the device error message is displayed. Outputting (S19) and outputting a decryption error message if there is an error in steps S11 and S17 (S20) and ending using a PC based encryption chip, characterized in that the control method using a non-security module. . The method of claim 1, When the operating system of the computer requests permission to use the USB security module (S21), and when it is permitted (S22), it initializes an internal register of the controller in the USB security module (S23) and checks whether data is input (S24). Checking whether the device has been removed (S25), if it is removed, ending; if not, checking the data input again; If the data is input, the control word is analyzed (S26) and the module information request is checked (S27). If the module information is returned through the USB port module ID (S28), the process is repeated S24, and if not the module information, the debugger command Checking the recognition (S29); The debugger command compares the input value with the debug info table (S30) and checks the existence of the debugger (S31). If the debugger does not exist, the process returns to step S24 and if the debugger exists, an error is returned through the USB port. (S32) forcibly stopping the USB security module (S33); Checking whether it is a key setting command if it is not the debugger command (S34), and checking whether it is a data input / output command if it is not a key setting (S35), and returning to step S24 if it is not an input / output command; If the control word analysis result is the key setting command, the internal key setting is checked (S36). If the internal key setting is performed, an internal key is generated using a module ID and an input value (S37), and an internal key is set (S38). Returning; If the result of the control word analysis is not the internal key setting or the external key setting (S39), if the external key setting is set, the external key is set as an input value (S40), and then the process returns to step S24. Setting the scramble key (S42) by checking whether it is set (S41) by generating a module ID and an input value (S42), and returning to step S24, and returning to step S24 if the scramble key is not set; After the control word analysis, if the control word analysis result is the data input / output command, it is checked whether it is encryption (S44). If it is encryption, it is checked whether it is the internal key (S45). Encrypting an input value with the external key if the internal key is not used (S47); In step S44, if it is not an encryption or an internal key, it is checked (S48). If the internal key is used, the input value is decrypted with the internal key (S49). If the internal key is not used, the input value is decrypted with the external key (S50); After the encryption and decryption process, it is checked whether the scramble is performed by the flag bit set in the control word (S51). If the scramble is performed, the scrambler of the USB security module is performed after the scramble is performed (S52). Returning the result value to the control program through the buffer and the device driver (S53), and then returning to step S24, and if the scramble is not performed, returning the result value immediately and returning to step S24. A method of controlling a U.S. non-security module using a PC-based encryption chip. A program for realizing the function (a), the function (b), the function (c) and the function (d) in the computer in an information protection system having a USB tab and a USB security module which are USB interfaced to a computer. A computer-readable recording medium that records the data.