KR20070111816A - Data output device and data output method for preventing counterfeit and falsification of the data - Google Patents

Abstract

A data output device and a data output method for preventing a counterfeit and a falsification of data are provided to change an unused output device to a using output device by checking an outputting state of the output device. A server requests the certificate of a output device according to a data output request of a PC application(202). The output device transfers the certificate to the server according to a certificate request(203). The server transmits encoded output information having a server signature and unsigned/non-encoded output information to the output device. The server transfers the certificate of a server for certificating the output of the information, to the output device(208). The output device confirms the signature of the server, decodes the encoded output information, and the decoded output information.

Description

Data output system and data output method with forgery and alteration blocking of data {Data output device and data output method for preventing counterfeit and falsification of the data}

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.

1 is a block diagram illustrating a conventional public document output system.

2 is a block diagram illustrating a data output system according to the present invention.

3 is a flowchart illustrating a data output method according to the present invention.

4 is a diagram illustrating a data output system apparatus according to the present invention.

5 is a diagram illustrating a server (output information transmission server) in the data output system apparatus according to the present invention.

6 is a diagram illustrating an output device in the data output system device according to the present invention.

** Description of the symbols for the main parts of the drawings **

410: personal PC Application

420: output device

421 and 431: SOC-System on chip

430 server (output information transmission server)

510: output name information DB (Data base)

520: DB list (data base)

530: SOC-System on chip

531: RAS engine (public key based encryption algorithm engine device)

532 HASH Engine

The present invention relates to a data output method and apparatus based on an encryption system, and more particularly, to a data output method and apparatus having the above modulation blocking function.

1 is a block diagram illustrating a conventional document output system.

Referring to Fig. 1, a conventional data output system includes an output device (printer) 1, a PC application 2, and a server (output information transmission server) 3.

According to FIG. 1, the method for outputting public document data according to the related art includes a step 11 of requesting an output of an official document by a PC application, a step 12 of requesting whether the server is an output capable output device, and a PC application of the output device. Confirming the information (13), the PC application requesting to check the output state (Online) of the output device (14), the output device responds to the confirmation request from the server (15), the PC application to the server Transmitting the list of available output devices (16), the server checks that the received list of available output devices is correct (17), notifies (18) that the output device is available, and the PC application identifies personally identifiable information. Providing the server with the server (19), the server searching the database (DB) and generating output information (20), the server sends the output information to the PC application (21), and the PC application outputs the output. Transmitting (22) the back to the output device information, and starts the data output comprises the step (23) for the output device to output the output information.

In step 12 to 16, which is a process of identifying the outputable output device, the server has to indirectly confirm whether the output device exists through a PC application. Therefore, an ActiveX type authentication program is installed in the PC application, and the program obtains a list of output devices that can be output in the PC application from the device list. After checking whether or not the output device is in a printable state, this information is sent to the server. In addition, currently output devices are limited to have a certain level or higher resolution for displaying a standardized watermark.

However, if the ActiveX program of the PC application does not operate normally or the user of the PC arbitrarily modifies the ActiveX program, it is possible to respond by changing the output device that is not usable to an available output device. That is, the output information may be output from an output device that is not capable of output (if the resolution is less than a predetermined unit or an unauthorized device due to a user's program modulation).

In addition, in steps 21 and 22 in which the server transmits the output information to the output device through the PC application, the server transmits the output information to the output device via the PC application.

The current document issuing system charges a fee based on the number of copies issued. In this step, if the PC application arbitrarily modifies the output information or modifies the driver related to the output device of the PC to output the data received from the server a plurality of times, there is a problem in that the number of applications issued is exceeded. Also, since the location where the output information is converted into information that can be understood by the output device (for example, plain data, which is a language accepted by the output device) is a PC, the program of the information conversion part of the PC can be operated to provide the output information. `There is a problem that can be modulated and printed.

The technical problem to be achieved by the present invention is to provide a data output system apparatus that can block the forgery of the document by installing a forgery and alteration blocking chip in the output device and the server.

Another technical problem to be achieved by the present invention is to provide a data output method that can prevent the forgery of the document by installing a forgery and alteration blocking chip in the output device and the server.

According to an embodiment of the present invention, a data output method having a forgery / modulation blocking function according to an embodiment of the present invention provides a server requesting an output device certificate from an output device according to a data output request from a PC application. In response to the request, the output device forwarding the output device certificate to the server, wherein the server transmits the signed encrypted and unsigned output information of the server to the output device. And transmitting, by the server, a server certificate for authenticating output of information to the output device, and verifying a signature of the server, and decrypting and outputting the encrypted output information.

According to another aspect of the present invention, there is provided a data output system device having an above modulation blocking function, including an output device, a PC application, and a server. The output device receives the encrypted output information from the server, decrypts the received information, and outputs the decrypted information. The PC application is responsible for the data transfer between the output device and the server. The server then transmits the encrypted output information and the unencrypted output information to the output device. The output device is a conventional output device, further comprising a forgery modulation block chip, the modulation block chip has an identifiable certificate and private key issued at the time of manufacture, the certificate is paired with the private key It contains a public key. The server is a conventional server, characterized in that it further comprises a forgery modulation block chip.

DETAILED DESCRIPTION In order to fully understand the present invention, the operational advantages of the present invention, and the objects achieved by the practice of the present invention, reference should be made to the accompanying drawings that illustrate preferred embodiments of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

2 is a block diagram illustrating a data output system according to the present invention.

Referring to FIG. 2, the PC application 210 requests the output of data (eg, an official document) from the server 230 (201). The output request step of the PC application is the same as the previous system and method.

In response to the output request from the PC application, the server requests a certificate from the output device (202).

Here, the output device and the server have a forgery modulation block chip. The tamper-evident chip of the output device is owned by a private key and a certificate that can be identified by the manufacturer at the time of manufacture. In addition, the output device certificate includes information such as a unique public key of the output device, information of the output device, output device producer information, and a unique number of the output device.

In response to the server's certificate request, the output device forwards the output device certificate to the server (203).

The server receives the output device certificate, checks information on the output device (output device name, resolution of the output device, etc.) to determine whether the device is outputable, and checks the signature of the certificate (204).

When the server verifies the signature of the certificate, the PC application provides the server with personal identification of the data to be output (205).

The step of providing the personal identification information is necessary when the information of the individual should be reflected in the data to be output, such as, for example, reading and output of the register copy and output of a resident registration copy.

The server creates data (document) to be output by reflecting the provided personal identification information, hashes the output data, and encrypts the hash value of the data with the public key of the output device certificate. The server then signes the encryption value of the server itself (digital signature) (206).

Here, the public key included in the output device certificate is paired with a private key owned by the output device itself, and the encryption with the public key can be decrypted using the private key. will be. The hash value refers to an encryption value of existing data generated through a hash engine, which will be described in detail below.

Encrypted output information signed by the server at 206, and unencrypted and unsigned output information (generally called 'Plain data') by the server is sent to the output device (207), where the server is the server's certificate. Is transmitted to the output device (208).

The output device decrypts the hash value of the output information and the encrypted output information (the hash value of the output information is encrypted by the RSA engine) using the output device's private key (the value decrypted using the RSA engine). Compare. After checking that the two contents match, the output is output if the contents match and the output is not output if the contents do not match. Through this confirmation, it is possible to confirm whether the forgery of the output information is forged.

For reference, the output amount may be managed by inputting the number of sheets to be output together with the information to be output in the hash value. In addition, in 206 of FIG. 2, the ID-related watermark is generated according to the current specification (standardized spec), and the watermark is generated in the case of an output-capable output device. The watermark generation portion is also used for a conventional system.

The output information transmitted from the server is encrypted from the PC and not sent back to the output device, but is encrypted from the server and sent directly to the output device, so it is impossible to modify the output information and output amount from the PC. This function is used when the objectivity of data must be secured, such as an official document.

The output device according to the present invention can simultaneously support a security mode operated by a separate forgery and alteration blocking chip together with an output mode of general data currently used (when server information is encrypted and output from a personal PC). have. Therefore, the use of the security mode in the output of the general document does not affect the function of the normal output mode, such as loading is impossible or output speed is slowed down.

3 is a view illustrating a data output method according to the present invention, and the data output method according to the data output system of FIG. 2 described above is disclosed.

A user makes a request for outputting a document to a server through a personal PC (301). Accordingly, the server requests a certificate from the output device (302).

In response to the server's certificate request, the output device forwards the output device certificate to the server (303).

The server checks whether the output device is an output device through the certificate of the output device, and the personal PC provides identification information (ID) of the PC to the server (304).

The server refers to the identification information (ID) of the provided personal PC, and transmits the signed encrypted output information and the unsigned unencrypted output information to the output device. The server then transmits the server certificate for authenticating the output of the information to the output device (305).

The output device compares the encryption value of the server certificate with the encryption value of the corresponding output device certificate. The output device certificate includes a public key, and the server encrypts the output information by using the public key of the received output device certificate. The output device receiving the encrypted output information decrypts the encryption value using the private key paired with the public key.

The decrypted value (output information) is compared with the unencrypted output information separately transmitted from the server (306).

The output device determines whether the decrypted values of the two encrypted values match with each other (307).

After determining whether there is a match, if the two values match, output information is output (308).

If the two values do not match, the received output information is not output (309).

4 is a diagram illustrating a data output system apparatus according to the present invention.

According to the present invention, an output system device having a forgery modulation block function includes a personal PC application 410, an output device 420 having a forgery modulation chip, and a server 431 having the forgery modulation chip. Equipped.

Personal PC application 410 is responsible for data transfer between the output device and the server.

The output device 420 receives encrypted output information from a server, and decrypts and outputs the received information. The forgery and alteration blocking chip of the output device includes an identifiable certificate and a private key issued at the time of manufacture, and the certificate includes a public key paired with the private key.

The server 430 transmits the encrypted output information and the unencrypted output information to the output device.

5 is a diagram illustrating a server in the data output system apparatus according to the present invention.

Referring to FIG. 5, the server further includes a forgery / modulation blocking chip in the existing output name information database (DB) 510 and the outputtable output device list database (DB) 520.

The forgery modulation block 530 of the server includes a controller 533, an RSA engine 531, a HASH engine 532, and a RAM 534.

The controller 533 receives the certificate of the output device and verifies the signature of the certificate, verifies the output device name in the certificate in the output device list database, and retrieves the output information to be output from the memory (RAM, etc.). Responsible for generating and hashing the output information (passing the HASH engine) and encrypting it with the public key in the certificate of the output device. That is, the controller generates output information, sends it to the hash engine, and passes the hash engine back to receive and encrypt the output data. At this time, encryption is performed using the public key included in the output device certificate in the RSA engine 531.

The RSA engine 531 is an engine that processes and outputs data received according to a public key based encryption algorithm. When data is input, the RSA engine 531 generates an encryption value (Cipher) by using a private key and outputs the data. In the case of public key-based encryption, a public key and a private key are generated as a key pair from the time of manufacture. When decrypting the value encrypted by the private key, the public key paired with the private key is used. Thus, in step 206, the server generates and encrypts the output information, utilizing the RSA engine.

The hash engine 532 is a device that converts all input data having different sizes into the same predetermined amount of data size and outputs the same. Therefore, even if the size of the data input to the hash engine is different (for example, data 1 is 16 bits, data 2 is 32 bits), the output data is all of the same size (data 1 and 2 above are all 8). Bit).

Herein, if the input value of the hash engine is 'D (data)' and the output value is 'Digest', the characteristics of the hash engine are as follows. (i) If D1 and D2 are different, Digest1 (hash value of D1) and Digest2 (hash value of D2) are different. (ii) If Digest1 and Digest2 have the same value, it is impossible to find D1 and D2. (iii) When the magnitudes of the values of Digest 1 and Digest 2 are merely 1 bit different, D1 and D2 are not simply 1 bit different, and are completely different data values.

By comparing Digest1 and Digest2 using the above (i) characteristic of the hash engine, it is possible to know whether the input data D1 and D2 are the same.

The RAM 534 stores information to be output and is used as a computational space for encryption.

6 is a diagram illustrating an output device in the data output system device according to the present invention.

Referring to FIG. 6, the output device includes a PC connection interface 610, hardware 630 of the output device, and a forgery / modulation blocking chip 620.

The PC connection interface 610 becomes a medium for connecting the PC and the output device. This is the same as the interface of the conventional output device.

The hardware 630 of the output device receives the output information stored in the RAM under the control of the controller, and outputs it in hardware.

The forgery modulation block 620 of the output device includes a ROM-Read only Memory (621), a controller 622, an RSA engine 623, a hash engine 624, and a random access memory (RAM) 625. And an identifiable certificate comprising a private key of the output device.

The ROM 621 of the output device stores a certificate of the output device and a identifiable private key of the output device itself. Accordingly, in step 202 and 203 of FIG. 2, when the certificate request is received from the server, the certificate stored in the ROM is transmitted to the server.

The controller 622 of the output device is a function for distinguishing whether the mode of the current output device is a normal output mode or a secure output mode used for output such as an official document, an output document using an RSA engine and a HASH engine. It is responsible for verifying the integrity of the server. The distinction between the normal output mode and the secure output mode may be determined at the request of the server.

The RAM 625 of the output device stores encrypted output information (hash value of encrypted output information) and unencrypted output information transmitted from the server.

The RSA engine 623 of the output device decrypts the hash value of the encrypted output information received from the server. At this time, it is decrypted using the private key stored in the ROM of the forgery blocking chip.

The hash engine 624 of the output device is used to hash the unencrypted output information (in the form of Plain data ') received from the server and compare it with the value output from the RSA engine.

Here, according to the characteristic of (i) of the above-described hash engine, the value that hashes the information to be output and the encrypted output information hash value are compared with the value that is decrypted by the RSA engine of the output device. This means that the data sent from the server and the data received from the output device are not tampered with. Therefore, the controller compares the above two data and outputs only when data integrity is confirmed.

As described above, optimal embodiments have been disclosed in the drawings and the specification. Although certain terms have been used herein, they are used only for the purpose of describing the present invention and are not intended to limit the scope of the present invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the data output method and apparatus having the above-described tamper-proof function according to the present invention according to the present invention are provided with the above-described tamper-blocking chip, which is a hardware-based authentication and encryption device, on an output device and a server. There is an effect that can prevent the above modulation of the output document. In addition, since the server checks whether the output device is directly outputable, there is an effect of solving the problem of responding to the server by changing the output device that is not usable by any modification to the available output device.

Claims (15)

Data output method based on encryption system, In response to a data output request of the PC application, requesting, by the server, an output device certificate from the output device; In response to the certificate request, outputting the output device certificate to the server by the output device; Sending, by the server, the signed encrypted output information and unsigned unencrypted output information to the output device; Transmitting, by the server, a server certificate for authenticating output of information to the output device; And And checking, by the output device, the signature of the server, and decrypting and outputting the encrypted output information. The method of claim 1, wherein the output device And a counterfeit-modulation blocking chip that receives encrypted output information from the server and decrypts the received information. The method of claim 2, wherein the server And a forgery / modulation blocking chip configured to transmit the encrypted output information and the unencrypted output information to the output device. The method of claim 2, wherein the forgery modulation block of the output device, An identifiable certificate issued at the time of manufacture; And Have a private key, The certificate is And a public key paired with the private key. The method of claim 4, wherein the data output method comprises: Encrypting, by the server, the output information by using the public key of the output device certificate, and And decrypting the output information by using the private key. The method of claim 4, wherein the forgery modulation block of the output device, A read only memory (ROM) for storing the certificate including the private key; A function for distinguishing whether the current output device is a mode with a forgery / false blocking function or a normal output mode; when a server requests a certificate, a function for retrieving the certificate stored in the ROM and transmitting it to the server; A controller for checking whether the output document is forged; The RSA engine for decrypting a hash value of encrypted output information; The HASH engine for hashing output information to generate hashed data; And And a random access memory (RAM) for storing the encrypted output information and the unencrypted output information transmitted from the server. According to claim 3, wherein the forgery modulation block of the server, Receiving the output device certificate and confirming the certificate, the output device that requested the output request in the output device certificate in the output device list database (DB), hash the output information and encrypts it with the public key in the output device certificate A controller; An RSA engine for encrypting and outputting input information according to a public key based encryption algorithm; A HASH engine that converts the input data into a predetermined amount of data size and outputs the converted data; Random access memory (RAM) for generating and storing output information; And And a forgery / modulation blocking function, characterized in that it comprises a certificate of a server for authenticating whether the output information is output. The method of claim 7, wherein the data output method, Encrypting, by the server, an output information hash value with the public key of the output device certificate; And And outputting, when the output device compares the encrypted value with the hash value of the output information transmitted without encryption, by comparing the encrypted value with the output value. `Data output method with modulation blocking function. The method of claim 8, wherein the data output method Confirming, by the server, whether an output device that has delivered the output device certificate is outputable; Providing, by the PC application, the personal identification information to the server; And The server further comprises the step of identifying the output device by using the personal identification information and the outputtable device list DB (Data base), and generating the output information. A data output system apparatus based on an encryption system, An output device having a first counterfeit-modulation blocking chip that receives encrypted output information from a server and decrypts and outputs the received information; A PC application responsible for transferring data between the output device and the server; And And a server having a second counterfeit-modulation blocking chip for transmitting encrypted output information and unencrypted output information to an output device. The method of claim 10, The first forgery modulation block, An identifiable certificate issued at the time of manufacture; And Have a private key, The certificate is And a forgery / modulation blocking function comprising a public key paired with the private key. 12. The system of claim 11, wherein the server is And a data forgery blocking function for encrypting the output information using a public key included in the output device certificate. The method of claim 11, wherein the output device Receiving the encrypted output information, the data output system apparatus having a forgery and forgery blocking function, characterized in that for decrypting the output using the private key. 12. The method of claim 11, wherein the first forgery modulation block, A read only memory (ROM) for storing a certificate including the private key; Distinguish whether the current output device is a mode with a forgery / false blocking function or a normal output mode, and when the server requests a certificate, the certificate stored in the ROM is retrieved and transmitted to the server, and is output using the RSA engine and the HASH engine. A controller for checking whether the document is forged; The RSA engine for decrypting a hash value of encrypted output information; The HASH engine for hashing output information to generate hashed data; And And a random access memory (RAM) for storing encrypted output information and unencrypted output information transmitted from the server. The chip of claim 11, wherein the second counterfeit modulation block chip, A controller which receives a certificate of the output device, checks the certificate, checks the output device that requested the output in the certificate in the output device list database (DB), hashes the output information, and encrypts it with the public key in the certificate of the output device; An RSA engine for encrypting and outputting input information according to a public key based encryption algorithm; A HASH engine that converts the input data into a predetermined amount of data size and outputs the converted data; Random access memory (RAM) for generating and storing output information; And And a server certificate for authenticating whether or not the output information is output.

Images