KR20060061877A - Integrated personal security device - Google Patents

Abstract

The present invention relates to a combination of a USB storage device and an authentication smart chip into one device, and more particularly, to an integrated authentication device implemented as one device having a USB memory for storing an authentication program and an authentication smart chip. .

The integrated personal security device of the present invention comprises a USB terminal for interfacing with a host; A smart chip for executing an authentication algorithm; A nonvolatile memory unit for storing personal privacy data and / or executable programs; And a USB path expansion unit for securing a USB path for the smart chip and a USB path for the nonvolatile memory from the host.

The integrated personal security device of the present invention does not simply combine a smart chip and a nonvolatile memory in a single device, but by using a USB path extension to give a separate USB path to each of the smart chip and the nonvolatile memory, the host has two devices. It is recognized as an independent USB device, so that authentication work performed by the host using the smart chip and the nonvolatile memory at the same time becomes possible.

Personal Security, Personal Authentication, USB Hub, Smart Chip, USB Memory

Description

Integrated Personal Security Device {INTEGRATED PERSONAL SECURITY DEVICE}             

1 is a block diagram of an integrated personal security device according to a first embodiment of the present invention;

2 is a block diagram of an integrated personal security device according to a second embodiment of the present invention;

3 is a block diagram of an integrated personal security device according to a third embodiment of the present invention;

4 is a block diagram of an integrated personal security device according to a fourth embodiment of the present invention;

5 is a block diagram of an integrated personal security device according to a fifth embodiment of the present invention;

* Explanation of symbols for main parts of the drawings

10: USB terminal 20: mobile phone connection terminal

30: USB path expansion unit 40: smart chip interface unit

42: smart chip 50: memory interface unit

52: nonvolatile memory 54: removable memory socket

60: power generator

72, 82, 84, 92, 94: path switch

The present invention relates to a combination of a USB storage device and an authentication smart chip into one device, and more particularly, to an integrated authentication device implemented as one device having a USB memory for storing an authentication program and an authentication smart chip. .

USB storage devices and smart chips are widely used in modern life. USB storage devices are used as storage devices for PCs and digital cameras, and smart chips are used in the form of traffic cards or smart cards for personal authentication.

The USB storage device keeps personal data such as electronic organizer data and electronic signatures and can be used with PCs in various places. Smart chips can be used as access keys and personal authentication devices as well as transportation cards. The common areas of the above listed fields are those related to personal data storage, authentication, and security that require high privacy. Since the uses are common to individuals, it is desirable to implement one device that can be used in the above listed fields. Will be done.

However, USB storage devices and smart chips have different data communication protocols in order to maintain compatibility and security of data communication protocols in their own fields. This has been a big problem in the implementation of the personal integrated authentication device.

Simply, as an implementation in which a smart chip is mounted on a USB storage device, there is a Korean Patent Application No. 10-2003-0020594. The invention is characterized in that the data encrypted by the authentication processor is written to the nonvolatile memory via the authentication processor on a path for reading / writing data from the PC to the nonvolatile memory via the USB interface. .

However, the present invention has the following problems to use as a personal integrated authentication device. First, the authentication processor is only for encrypting / decrypting data recorded in the nonvolatile memory, not for performing mutual authentication with an external authentication device. Second, since the authentication processor and the nonvolatile memory are located on the same data input / output path, it is extremely difficult for an external processor to implement mutual authentication with the authentication processor while driving a program stored in the nonvolatile memory. . For the same reason, it is extremely difficult to implement the authentication processor performing mutual authentication with an external processor while encrypting / decrypting data written to nonvolatile memory.

The present invention has been made to solve the above problems, and an object thereof is to provide an integrated personal security device for storing personal authentication and personal privacy data.

Another object of the present invention is to provide an integrated personal security device that can be used as an electronic money storage means and that can store personal privacy data.

Another object of the present invention is to provide an integrated personal security device that combines the functions of the integrated personal security device, the interface device of the PC and the mobile phone, and / or the traffic card function.

Another object of the present invention is to provide an integrated personal security device capable of performing authentication through an internal smart chip while driving a program stored in an internal memory.

An integrated personal security device of the present invention for achieving the above object, USB terminal for interfacing with the host; A smart chip for executing an authentication algorithm; A nonvolatile memory unit for storing personal privacy data and / or executable programs; And a USB path expansion unit for securing a USB path for the smart chip and a USB path for the nonvolatile memory from the host.

The integrated personal security device of the present invention does not simply combine the smart chip and the nonvolatile memory unit into a single device, but by using a USB path extension unit to assign a separate USB path to each of the smart chip and the nonvolatile memory unit, the host has 2 It is recognized as two independent USB devices, and therefore, the authentication operation performed by the host using the smart chip and the nonvolatile memory unit at the same time becomes possible.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, the terms or words used in this specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly introduce the concept of terms in order to best explain their invention. It should be interpreted as meanings and concepts in accordance with the technical spirit of the present invention based on the principle that it can be defined. Therefore, the embodiments described in the specification and the drawings shown in the drawings are only one of the most preferred embodiments of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

(Example 1)

The integrated personal security device of this embodiment, as shown in Figure 1, USB terminal 10 for interfacing with the host; A USB path extension unit 30 connected to the USB terminal 10 for securing a USB path for the following smart chip 42 and a USB path for the following nonvolatile memory 52 from the host; A smart chip 42 for executing an authentication algorithm; A smart chip interface unit 40 for forming a data communication path between the USB path extension unit 30 and the smart chip 42 and converting a USB communication protocol and a smart chip 42 communication protocol to each other; Non-volatile memory (eg, EEPROM) 52 for storing personal privacy data and / or executable programs; And a memory interface unit 50 forming a data communication path between the USB path extension unit 30 and the nonvolatile memory 52.

The USB terminal 10 is for physically connecting to the USB terminal 10 provided in a host such as a PC. The USB terminal 10 may be implemented as a type to be withdrawn / retracted from a personal integrated authentication device for ease of use, or a line of sufficient length. It may be implemented to be connected to the personal integrated authentication device via.

The USB path extension unit 30 allows the host to recognize the smart chip 42 and the nonvolatile memory 52 as an independent USB device, and uses a USB hub chip (USB controller chip). In the figure, although a USB hub chip having four output terminals is used, a USB hub chip having a smaller or larger number of output terminals may be used depending on the implementation. That is, the USB hub chip used in this embodiment has one input terminal and two or more output terminals, and extends a USB path connected to one input terminal to a USB path connected to two or more output terminals.

The smart chip 42 may be implemented as a contact smart chip or a combination smart chip that also serves as a contact and RF interface. In this case, the smart chip 42 may be implemented to be directly connected to the smart chip interface unit 40 through a terminal to which a contact terminal for data communication is connected, or a smart chip socket provided in the integrated personal security device. And it may be implemented to be connected via a contact terminal. In the latter case, the integrated personal security device further includes a smart chip socket to replace a smart chip provided with a contact terminal. In the case of a combination smart chip, an RF antenna is connected to the smart chip socket. When the combination smart chip is plugged into the socket, the RF antenna connection terminal of the combination smart chip is connected to the RF antenna. In addition, the combination smart chip and the socket may be implemented to use an unused terminal among the contact terminals for the RF antenna connection terminal of the combination smart chip. In this case, the smart chip interface unit 40 performs mutual conversion between data conforming to the contact serial communication protocol and data conforming to the USB serial communication protocol. In the case of implementing the combination smart chip, the pre / postpaid traffic card function may be added to the smart chip 42.

In addition, the smart chip 42 may also be implemented as a contactless RF smart chip. In this case, since the contactless RF smart chip receives data from the outside, only the RF antenna connection terminal is provided. The smart chip interface unit 40 is connected through the RF antenna connection, and converts the data transmitted through the USB protocol and the RF signal on the RF antenna.

The nonvolatile memory 52 may be implemented as an EEPROM, a flash memory, or the like, and may store autorun programs and / or data in which personal privacy is important when automatically connected to a host.

The memory interface unit 50 performs mutual conversion between data read / write to the nonvolatile memory 52 and data conforming to the USB transfer protocol. In some implementations, the nonvolatile memory 52 may be replaced with a removable memory such as a CF card, an SD card, an MMC card, a memory stick, and a socket thereof, and the nonvolatile memory 52 fixed to a personal integrated authentication device may be used. And a socket 54 for a removable memory. In the latter case, a part of the address area accessed by the memory interface unit 50 may be allocated to the fixed nonvolatile memory 52, and the other part may be allocated to the removable memory. When the socket 54 for the portable memory is provided as described above, the memory interface unit 50 performs mutual conversion between data conforming to the protocol used in the portable memory inserted into the socket and data conforming to the USB transmission protocol. .

The personal integrated authentication device of the present embodiment uses the smart chip issued for personal authentication by a financial institution for the purpose of integrating and storing personal data requiring security, and the nonvolatile memory ( 52) stores important personal privacy data such as personal diaries, organizer data, and PIMS data. In addition, the non-volatile memory 52 may store an autorun program for editing / driving the stored privacy data. On the other hand, the personal digital certificate is stored in the smart chip 42 or the nonvolatile memory 52 according to its form (smart card type, SW type).

(Example 2)

The integrated personal security device of this embodiment, as shown in Figure 2, USB terminal 10 for interfacing with the host; A USB path extension unit 30 connected to the USB terminal 10 for securing a USB path for the smart chip 42 and a USB path for the nonvolatile memory 52 from the host; A smart chip 42 for executing an authentication algorithm; A smart chip interface unit 40 for forming a data communication path between the USB path extension unit 30 and the smart chip 42 and converting the USB communication protocol and the smart chip communication protocol to each other; Non-volatile memory (eg, EEPROM) 52 for storing personal privacy data and / or executable programs; A memory interface unit 50 for forming a data communication path between the USB path expansion unit 30 and the nonvolatile memory 52; A mobile phone connection terminal 20 (mobile phone interface unit) connected to the USB path extension unit 30 to perform data communication with a mobile phone; And a power source (DC2DC) generator 60 for generating charging power with the power input to the USB terminal 10 and supplying it to the mobile phone through the mobile phone connection terminal.

In the integrated personal security device of the present embodiment, a function of relaying data communication between the mobile phone and the host is added to the function of the integrated personal security device of the first embodiment.

The USB terminal 10, the smart chip 42, the smart chip interface unit 40, the nonvolatile memory 52, and the memory interface unit 50 are the same as those of the first embodiment, and thus description thereof is omitted.

The USB path expansion unit 30 is similar to that of the first embodiment, and the cellular phone connection terminal is connected to one of the output terminals. Even if the mobile phone connection unit is directly connected to the USB path extension unit 30 without a separate interface unit, there is no problem since the mobile phone itself has a USB communication interface. The mobile phone connection terminal is provided to provide a communication path between a host such as a PC and a mobile phone. In some embodiments, data transmission and synchronization between the mobile phone and the nonvolatile memory 52 may be performed via a host connected to the USB terminal 10. .

The power generator 60 is for supplying the battery charging power to the mobile phone, the generated power is supplied to the mobile phone through the power supply terminal of the mobile phone connection portion. On the other hand, the driving power of the power generator 60 uses the power supplied from the host through the USB terminal (10).

By implementing the integrated personal security device of the above configuration, it securely stores data requiring personal security, such as financial data authentication data, digital signature, PIMS, charge the mobile phone through a USB connection device, data communication between PC and mobile phone A multipurpose device can be implemented that provides a path.

(Example 3)

The integrated personal security device of this embodiment, as shown in Figure 3, USB terminal 10 for interfacing with the host; A USB path expansion unit 30 for securing a USB path to the smart chip 42 and a USB path to the nonvolatile memory 52 from the host; A smart chip 42 for executing an authentication algorithm; A smart chip interface unit 40 for forming a data communication path between the USB path extension unit 30 and the smart chip 42 and converting the USB communication protocol and the smart chip communication protocol to each other; Non-volatile memory (eg, EEPROM) 52 for storing personal privacy data and / or executable programs; A memory interface unit 50 for forming a data communication path between the USB path expansion unit 30 and the nonvolatile memory 52; A mobile phone connection terminal 20 (mobile phone interface unit) for performing data communication with the mobile phone; A power supply (DC2DC) generator 60 for generating charging power with power input to the USB terminal 10 and supplying it to the mobile phone through the mobile phone connection terminal; And a path switch 72 for selecting one of the USB terminal 10 and the mobile phone connection terminal to form a path connected to an input terminal of the USB path expansion unit 30.

The USB terminal 10 is connected to one of the output terminal of the USB path expansion unit 30, the mobile phone connection terminal is characterized in that it is connected to the other of the output terminal of the USB path expansion unit 30.

In the integrated personal security device of the present embodiment, when the path switch 72 connects the input terminal of the USB path expansion unit 30 and the USB terminal 10, a device such as a PC externally connected to the USB terminal 10 is provided. When the path switch 72 connects the input terminal of the USB path expansion unit 30 and the cellular phone connection terminal, the cellular phone connection terminal and the cellular phone connected to the outside function as the USB host.

When the PC or the like becomes the USB host, the operation of each component is the same as that of the first embodiment. On the other hand, when the mobile phone becomes a USB host, a device such as a PC connected to the USB terminal 10 and an external device is operated in connection with the output terminal of the USB path expansion unit 30. The mode may be used when the mobile phone has a USB host function. When the mobile phone becomes a USB host, authentication may be performed using the smart chip 42 during an electronic transaction through the mobile phone. The nonvolatile memory 52 The personal information data stored in) can be used on the mobile phone.

The process for determining the USB host applied to the integrated personal security device of this embodiment is as follows. First, when only one of the host and the mobile phone is connected to the integrated personal security device, the device functioning as a USB host uses the characteristic of supplying driving power to the USB slave. That is, by detecting whether the driving power is supplied from the USB terminal and the mobile phone connection terminal (the device further includes a known voltage detection circuit), the path switching unit is controlled so that the terminal to which the driving power is supplied is connected to the input terminal of the USB path extension unit. do.

Second, when the host and the mobile phone are simultaneously connected to the integrated personal security device, whichever device is connected first in time to be a USB host, or any other external hardware switch (manual switch such as a dip switch) is used in advance. It can be implemented to set whether to operate as USB host first. The latter function can also be implemented in software. In this case, the device set in the storage means in the integrated personal security device operates as a USB host, and the user changes the setting by using the input / output means of the device acting as the USB host. USB host authority will be transferred to the other device.

Meanwhile, the USB terminal 10, the mobile phone connection terminal 20, the smart chip 42, the smart chip interface unit 40, the nonvolatile memory 52, the memory interface unit 50, and the power generator 60 may be Since it is the same as that of the said 2nd Example, description is abbreviate | omitted.

(Example 4)

The integrated personal security device of this embodiment, as shown in Figure 4, USB terminal 10 for interfacing with the host; A USB path extension unit 30 for forming a plurality of USB communication channels to the USB host; A smart chip 42 for executing an authentication algorithm; A smart chip interface unit 40 for forming a data communication path between the USB path extension unit 30 and the smart chip 42 and converting the USB communication protocol and the smart chip communication protocol to each other; Non-volatile memory (eg, EEPROM) 52 for storing personal privacy data and / or executable programs; A memory interface unit 50 for forming a data communication path between the USB path expansion unit 30 and the nonvolatile memory 52; A mobile phone connection terminal 20 (mobile phone interface unit) for performing data communication with the mobile phone; A power supply (DC2DC) generator 60 for generating charging power with the power input to the USB terminal 10 and supplying it to the mobile phone through the mobile phone connection terminal; An input path switch (92) for connecting a path connected to an input terminal of the USB path expansion unit (30) to one of the USB terminal (10) or the cellular phone connection terminal; And an output path switch 94 for connecting a path connected to one of the output terminals of the USB path extension unit 30 to one of the USB terminal 10 or the cellular phone connection terminal.

The terminal to which the input path switch 92 is connected and the terminal to which the output path switch 94 is connected are switched to be different from each other.

Also in this embodiment, the USB host path is selected using the path switch as in the third embodiment. However, in order to increase the stability of the formed data communication channel, there is a difference that the path switch is provided at the input terminal and the output terminal of the USB path expansion unit 30, respectively.

Meanwhile, the USB terminal 10, the mobile phone connection terminal 20, the smart chip 42, the smart chip interface unit 40, the nonvolatile memory 52, the memory interface unit 50, and the power generator 60 are provided. Since the configuration and the determination process of the USB host are the same as those in the third embodiment, description thereof is omitted.

(Example 5)

The integrated personal security device of this embodiment, as shown in Figure 5, USB terminal 10 for interfacing with the host; A USB path extension unit 30 for forming a plurality of USB communication channels to the USB host; A smart chip 42 for executing an authentication algorithm; A smart chip interface unit 40 for forming a data communication path between the USB path extension unit 30 and the smart chip 42 and converting the USB communication protocol and the smart chip communication protocol to each other; Non-volatile memory (eg, EEPROM) 52 for storing personal privacy data and / or executable programs; A memory interface unit 50 for forming a data communication path between the USB path expansion unit 30 and the nonvolatile memory 52; A mobile phone connection terminal 20 (mobile phone interface unit) for performing data communication with the mobile phone; A power supply (DC2DC) generator 60 for generating charging power with the power input to the USB terminal 10 and supplying it to the mobile phone through the mobile phone connection terminal; A first path switch (82) for connecting a path connected to the USB terminal (10) to one of an input terminal or an output terminal of the USB path expansion unit (30); And a second path switch 84 for connecting a path connected to the cellular phone connection terminal to one of an input terminal and an output terminal of the USB path expansion unit 30.

One of the USB terminal 10 or the mobile phone connection terminal is connected to the USB terminal 10, and the other is the first and second path switch is switched so as to be connected to the connection terminal to the mobile phone connection terminal do.

Also in this embodiment, the USB host path is selected using the two path switches as in the fourth embodiment. However, two path switches select a path connected to the USB terminal 10 at an input terminal or an output terminal of the USB path expansion unit 30, and a path connected to a mobile phone connection terminal is input at the input terminal of the USB path expansion unit 30. Or there is a difference in the selection at the output stage.

Meanwhile, the USB terminal 10, the mobile phone connection terminal 20, the smart chip 42, the smart chip interface unit 40, the nonvolatile memory 52, the memory interface unit 50, and the power generator 60 Since the configuration and the determination process of the USB host are the same as those in the third embodiment, description thereof is omitted.

(Example 6)

This embodiment is replaced with a wireless data communication module instead of a mobile phone connection terminal that interfaces with a mobile phone in a wired manner in the configuration of the second to fifth embodiments. As the wireless data communication module, a Bluetooth communication module, a wireless LAN communication module, or an infrared communication module may be used. The wireless communication module is a mobile phone interface unit, and forms a wireless data communication channel with the mobile phone, and the host connected to the USB terminal performs an interface between the host and the mobile phone so that the mobile phone connected with the wireless data communication channel is only viewed as a USB slave. .

Since the rest of the configuration and the effects except for the wireless data communication module can be inferred from the description of the second to fifth embodiments, description thereof will be omitted.

Although the present invention has been described by way of limited embodiments and drawings, the present invention is not limited thereto, and the technical spirit of the present invention and the claims to be described below by those skilled in the art to which the present invention pertains. Of course, various modifications and variations are possible within the scope of equivalents.

By implementing the integrated personal authentication device according to the present invention, it is possible to perform a function of storing personal authentication and personal privacy data using a smart chip with one USB device.

In addition, there is an effect that the smart chip of the present invention can be used as an electronic money storage means or a transportation card payment means.

In addition, by performing the security key check through the internal smart chip while driving the authentication program stored in the internal memory of the present invention there is an effect that it is possible to perform high security authentication with one device.

Claims (9)

A USB terminal for physically connecting to the host; An input terminal connected to the USB terminal, the USB path expansion unit for securing a USB path for the smart chip and a USB path for the nonvolatile memory from the host; A smart chip for executing an authentication algorithm; A smart chip interface unit for forming a data communication path between the USB path extension unit and the smart chip, and converting a USB communication protocol and a smart chip communication protocol; A nonvolatile memory unit for storing personal privacy data and / or executable programs; A memory interface unit forming a data communication path between the USB path extension unit and the nonvolatile memory unit Integrated personal security device comprising a. The method of claim 1, The smart chip is a combination smart chip that performs both RF communication and contact communication, An integrated personal security device further comprises an RF antenna formed around the integrated personal security device and connected to the combination smart chip. The method of claim 1, An autorun program is stored in the nonvolatile memory unit. And when the integrated personal security device is connected to a host, the autorun program is loaded into the host for execution on the host. The method of claim 1, Is connected to the output terminal of the USB path expansion unit, further comprises a mobile phone interface for performing data communication with the mobile phone, Integrated personal security device that relays data communication between the mobile phone and host. The method of claim 4, wherein Located between the USB terminal and the USB path extension, Connected to the USB terminal and the mobile phone interface unit, And an input path switch for connecting a path connected to an input terminal of the USB path extension unit to either the USB terminal or the mobile phone interface unit. The method of claim 5, One of the output terminals of the USB path extension unit is connected to the USB terminal. The method of claim 5, Located between the mobile phone interface unit and the USB path expansion unit, Connected to the USB terminal and the mobile phone interface unit, An output path switch for connecting a path connected to one of the output paths of the USB path extension part to one of the USB terminal or the cellular phone interface part; And the terminal to which the input path switch is connected and the terminal to which the output path switch is connected are switched to be different from each other. The method of claim 4, wherein Located between the USB terminal and the USB path extension, Connected to the input terminal and the output terminal of the USB terminal and the USB path expansion unit, A first path switch for connecting a path connected to the USB terminal to one of an input terminal and an output terminal of the USB path expansion unit; And Located between the mobile phone interface unit and the USB path expansion unit, It is connected to the input terminal and the output terminal of the mobile phone interface unit and the USB path expansion unit, A second path switch for connecting a path connected to the mobile phone interface unit to one of an input terminal and an output terminal of the USB path extension unit; Integrated personal security in which the first and second path switches are switched such that one of the USB terminal or the cellular phone interface unit is connected to an input terminal of the USB path extension unit and the other is connected to a connection terminal to an output terminal of the USB path extension unit. Device. The method of claim 1 or 8, wherein the USB path expansion unit, An integrated personal security device that is a USB hub chip for extending a USB path connected to one input into a USB path connected to two or more outputs.

Images