KR20090080412A - Data processing device and data securing method for storage device using the same - Google Patents

Abstract

An information processing apparatus and a data security method for a portable storage device using the same are provided to generate a common key between the information processing apparatus and the portable storage device, thereby accessing data stored in the portable storage device without inputting a password every time. A memory(40) stores a common key for a portable storage device(200). The portable storage device is connected to an interface(10). A processor(20) accesses the portable storage device to process data. An interface controller(30) produces the common key with the portable storage device and stores the common key in the memory and the portable storage device.

Description

DATA PROCESSING DEVICE AND DATA SECURING METHOD FOR STORAGE DEVICE USING THE SAME}

The present invention relates to a portable storage device and an information processing device, and more particularly, to an information processing device capable of preventing unauthorized access to data stored in the portable storage device and a data security method of the portable storage device using the same. .

Recently, various portable storage media such as SD cards (Secure Digital Cards), CF cards (Compact Flash Cards), memory sticks, and USB memories are widely used and installed in various electronic devices.

Digital cameras, computers, electronic dictionaries, mobile phones, PMPs and the like are provided with a removable storage device for storing various data. At this time, the portable storage device can be separated and carried from the various electronic devices listed above, so the portability is good, so there is a high risk of loss.

If the portable storage device is lost, data stored in the portable storage device may be exposed to others. In particular, personal information of users may be leaked or company confidential information may be leaked.

Therefore, the security technology for such a portable storage device has been recently developed.

In the case of an SD card, if you set a password, you will be asked to enter the password every time you connect to the device, so that you can access the data stored on the SD card only if the password matches that set.

However, according to such a prior art, there are the following problems.

In other words, if you do not set a password on the mobile storage device, there is a problem that the data stored in it can be exposed to others, and when setting the password, it is cumbersome because the password must be entered every time the mobile storage device is connected to the device. There was a problem.

Accordingly, the present invention has been made to solve the above-mentioned conventional problems, and an object of the present invention is to provide an information processing device and data of a portable storage device using the same, which can prevent the data stored in the portable storage device from being exposed to others. It is to provide a security method.

Another object of the present invention is to generate a public key between the information processing device and the portable storage device, so that the information processing device in which the public key is generated can access information stored in the portable storage device without entering a password every time. It is to provide a data security method of a processing device and a portable storage device using the same.

According to a feature of the invention for achieving the above object, a memory for storing a public key for the portable storage device; An interface to which the portable storage device is connected; A processor which accesses the portable storage device and processes data; And an interface control unit for generating a public key with the portable storage device and storing the public key in the memory and the portable storage device.

The interface controller may generate a public key by combining a unique number of the information processing device and a unique number of the portable storage device.

The interface controller may determine whether the authority required for generating a public key for the portable storage device is present.

The interface controller may generate a public key only when it is determined that the information processing device has a public key generation authority with respect to the portable storage device.

At this time, when the interface control unit is logged in to the public certificate stored in the portable storage device, it may determine that the public key generation authority.

The interface controller may be configured to: compare the public key stored in the memory with the public key stored in the portable storage device when it is detected that the portable storage device is connected to the interface; As a result of comparing the public key, if the public key stored in the memory and the public key stored in the portable storage device do not match, access to the portable storage device of the processor may be blocked.

On the other hand, the data security method of a portable storage device according to the present invention comprises the steps of: (A) comparing the public key stored in the portable storage device and the public key stored in the information processing device when the portable storage device is connected to the information processing device; (B1) accessing data stored in the portable storage device when the portable storage device and the public key matched with the information processing device are found to be stored as a result of the determination in step (A); If it is determined that the public key matching the portable storage device and the memory is not stored as a result of the determination of step (A), the access to the data stored in the portable storage device is blocked (B2). Can be.

And a plurality of common keys each generated for various portable storage devices are stored in the memory of the information processing device; In the portable storage device, a plurality of public keys each generated between various information processing devices may be stored.

In this case, the public key may be generated by forming a character string combining a unique number of the information processing device and a unique number of the portable storage device.

Alternatively, the public key may be generated by combining a predetermined number or more characters randomly extracted.

In addition, the data security method, if the access to the data is blocked in the step (B2), the step of receiving a command whether to generate a public key for the portable storage device in the information processing device (C) It may be performed further including.

The data security method may further include: (D) checking a presence or absence of a right to generate a public key when a command is input to generate a public key for the portable storage device in the step (C); (E) generating, by the information processing apparatus, a public key for the portable storage device when it is determined that the public key is authorized in the step (D); And (F) storing the public key generated in the step (E) in the information processing device and the portable storage device, respectively.

In this case, the data security method may further include a step (G) of releasing blocking of access to data stored in the portable storage device when the generation of the public key is completed in the step (D).

In addition, (C) step (C1) is provided with a user interface for receiving an authentication key to prove the existence of the public key generation authority; And (C2) comparing the authentication key input through the user interface with the authentication key stored in the portable storage device.

And (C) step (C3) of displaying a login screen of an authorized certificate stored in the portable storage device; (C4) inputting a password of the public certificate; And it may include the step (C5) that the password for the official certificate is sent to the authentication server to log in.

On the other hand, the data security method, (D ') comparing the public key generated in the step (D) with the public key previously stored in the memory and the public key previously stored in the portable storage device; As a result of the comparison in the step (D '), if the same public key as the public key generated in the step (D) is already stored in the memory or the portable storage device, the public key generated in the step (D) And (D ") regenerating a public key including a different character string.

In the data processing method of the information processing device and the portable storage device using the same as described above in detail can be expected the following effects.

That is, if a public key is not generated between the information processing device and the portable storage device, the information processing device cannot be accessed by the portable storage device, thereby preventing the data stored in the portable storage device from being exposed to others. .

In addition, in the data processing method of the information processing apparatus and portable storage device using the same according to the present invention, after the public key is generated between the information processing apparatus and the portable storage device through a public key generation procedure, the information processing apparatus generates a password every time. It has the advantage of being convenient because it can utilize the data of the portable storage device without the hassle of typing.

Hereinafter, specific embodiments of the information processing apparatus according to the present invention as described above will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a schematic configuration of an information processing apparatus according to a specific embodiment of the present invention.

As shown in FIG. 1, the information processing apparatus 100 according to the present invention includes an interface 10 to which the portable storage device 200 is connected.

In this case, the information processing apparatus 100 reads data from a storage medium such as a personal computer, a workstation, a personal digital assistant (PDA), a mobile phone, an electronic dictionary, a portable multimedia player (PMP), a digital camera, and processes the data. Includes all electronic devices that can.

The portable storage device 200 includes a memory card such as an SD card, a compact flash card, a memory stick, and various portable storage media such as a USB memory.

The interface 10 reads data from the portable storage device 200 as a part of the portable storage device 200 connected to the information processing device 100, and also transfers data to the portable storage device 200. It serves to store.

The interface 10 is connected to the processor 20. The processor 20 serves as a main controller of the information processing apparatus 100, decodes and executes various commands, and also reads, processes, and stores data from a storage medium.

Therefore, the processor 20 processes data read from the portable storage device 200 through the interface 10.

On the other hand, the information processing apparatus 100 according to the present invention is provided with an interface controller 30.

The interface controller 30 stores data in the portable storage device 200 or receives data stored in the portable storage device 200 according to a command of the processor 20.

The processor 20 generates a public key for the portable storage device 200.

The public key is a character string commonly stored in the information processing device 100 and the portable storage device 200. The information processing device 100 processes the information in order to access the portable storage device 200. The public key consisting of the same character string must be stored together in the device 100 and the portable storage device 200.

If a public key is not generated between the information processing device 100 and the portable storage device 200, the information processing device 100 enters a question-and-answer mode about whether to generate a public key. When the user instructs to generate a public key, the public key is generated according to a predetermined procedure.

The processor 20 may generate the public key by various methods. First of all, a string of more than a certain length can be generated as a combination of randomly extracted numbers and / or letters.

Alternatively, a unique number such as a serial number or MAC address of the information processing device 100 and a unique number of the portable storage device 200 may be generated. To this end, the interface 10 reads the unique number of the portable storage device 200 from the portable storage device 200, where the unique number of the portable storage device 200 is basically accessible without a public key. Are stored in.

The processor 20 also generates a public key, wherein the information processing apparatus 100 or the portable storage device 200 has a plurality of public keys already generated between the portable storage device and another information processing device. If it is stored, it is possible to compare whether the newly generated public keys are the same as these, and if they are the same, the public keys can be regenerated into different strings.

In this way, the public key generated by the processor 20 is stored in the memory 40 included in the information processing apparatus 100.

Here, the memory 40 may be a storage means that is typically provided in an information processing device such as a computer, and in particular, may be a nonvolatile storage device for permanently storing a public key.

The memory 40 may store a plurality of public keys for each of the plurality of portable storage devices connected to the information processing device 100.

The processor 20 also stores the generated public key in the portable storage device 200 through the interface controller 30.

Meanwhile, in order for the processor 20 to generate a public key, the user is required to generate a public key.

If a public key is not generated between the information processing device 100 and the portable storage device 200, the information processing device 100 enters a question-and-answer mode about whether to generate a public key.

When the user instructs the public key generation, the processor 20 generates the public key only when the existence of the public key generation authority is confirmed by checking the existence of the authority for the public key generation.

The processor 20 verifies the authority of public key generation in various ways. For example, when a user commands generation of a public key in the question answering mode for whether a public key is generated, an input window for receiving an authentication key from the user is displayed.

And when the user enters the correct authentication key, it creates a public key.

Here, the authentication key is stored in the portable storage device 200 as a password for authenticating the user's authority. Therefore, the interface controller 30 reads the authentication key from the portable storage device 200 through the interface 10, and the processor 20 compares the authentication key input by the user and if both are identical. Recognize that you have authority to generate public keys.

At this time, the authentication key is also stored in the portable storage device 200 in an area basically accessible by the interface 10 without a public key.

On the other hand, the processor 20 may determine whether or not the authority to generate a public key by another method.

When the official certificate is stored in the portable storage device 200, the information processing apparatus 100 retrieves the public certificate stored in the portable storage device 200 and displays the official certificate login screen.

In addition, the user receives the password for the public certificate from the user and transmits the public certificate to the authorized server.

At this time, the information processing apparatus 100 should be provided with an Internet module to be able to access the authentication server.

When the authority for generating the public key is authenticated as described above and the public key is generated by the processor 20, the generated public key is stored in the portable storage device 200 by the interface controller 30. In this case, the interface control unit 30 stores the public key in an accessible area regardless of other authentication procedures or public key matching confirmation procedures in the portable storage device 200.

The public key stored in the memory 40 is used to access data stored in the portable storage device 200 when the portable storage device 200 is connected to the information processing device 100 later.

That is, the processor 20 may include one or more public keys generated by the processor 20 of the information processing device 100 and stored in the memory 40, and one or more common keys stored in the portable storage device 200. Compare keys to each other to determine if there is a matching public key.

When the comparison result coincides with one of the public keys stored in the memory 40 of the information processing apparatus 100 and the public keys stored in the portable storage device 200, the interface 10 is configured to execute the portable storage device ( Access to data stored in 200).

However, if the matching public key does not exist in the memory 40 and the portable storage device 200, the interface 10 cannot access the data of the portable storage device 200.

In this case, the portable storage device 200 may be divided into two or more areas, and may be divided into an area in which the public key, an authentication key, an authentication certificate, and the like are stored, and an area in which other general data is stored.

Here, the area in which the public key, the authentication key, the public certificate, etc. are stored is an area directly accessible without any additional procedures. However, the area where the remaining general data is stored is stored in a form that cannot be accessed if the public key does not match, or is not recognizable by the information processing apparatus 100 even if it is accessible.

That is, the interface control unit 30 of the information processing apparatus 100 is connected to the portable storage device 200 of the interface 10 until a matching public key is found as a result of comparing the public key of the processor 20. Block access.

In this case, an area of the portable storage device 200 in which access is blocked is an area in which general data is stored among the divided areas described above.

That is, the portable storage device 200 includes an accessible area only when the information processing device 100 and the public key match, and an accessible area regardless of whether the public key matches or not, and the public key, authentication key, and public certificate. The interface controller 30 classifies this and stores it in an accessible area even if the public key does not match.

On the other hand, if the public key comparison result of the processor 20, the public key stored in the memory 40 and the public key stored in the portable storage device 200, the interface controller 30 is the interface 10 Accesses all areas of the portable storage device 200 to use data.

In this case, the interface controller 30 may block access to data of a specific area of the portable storage device 200 by various methods.

For example, the interface controller 30 may control the access of the interface 10 to the portable storage device 200 by software. That is, the interface 10 prevents access to the accessible region only when the public key matches in the portable storage device 200 through a program, or until the interface 10 confirms whether the public key matches. I do not get off.

At this time, the information necessary to identify such an area is stored in an area basically accessible from the portable storage device 200 so that the interface controller 30 can recognize it.

In addition, the interface controller 30 may block access to the portable storage device 200 by various other methods. As another example, the interface control unit 30 stores the data for the public key, authentication key, public certificate, etc. in the portable storage device 200 through the interface 10 in a general manner.

However, other general data is encoded in a specific manner and stored in the portable storage device 200.

In addition, in reading and decoding data that has been encoded from the portable storage device 200, as a result of comparing the public key of the processor 20, the common key stored in the memory 40 and the portable storage device 200 in common. Only when there is a, the interface control unit 30 performs data decryption or provides information related to data decryption, so that the data cannot be decrypted if the public key does not match so that the processor 20 Should not be recognized.

However, since the data for the public key, the authentication key, the public certificate, the unique number of the portable storage device, etc. are not subjected to the encoding process according to the specific method as described above, the information processing apparatus 100 is connected to the portable storage device 200. The processor 20 and other components of the processor 20 can smoothly perform an authentication process using an authentication key or a public certificate, a public key generation process using a unique number, a public key comparison process using a stored public key, and the like.

In this manner, the interface controller 30 blocks access to data stored in a specific area of the portable storage device 200. When there is a matching public key stored in the portable storage device 200 and the memory 50 as a result of comparing the public key of the processor 20, the software 20 is stored in a specific area of the portable storage device 200. By allowing access or decoding data normally, the data stored in the portable storage device 200 can be utilized.

Hereinafter, a data security method of a portable storage device according to a specific embodiment of the present invention, another embodiment, and another embodiment will be described in detail with reference to the accompanying drawings.

2 is a flowchart illustrating a data security method of a portable storage device according to a specific embodiment of the present invention, and FIG. 3 is a flowchart illustrating a data security method of a portable storage device according to another embodiment of the present invention. 4 is a flowchart illustrating a method for generating a public key step by step in the embodiment of the present invention.

As shown in FIG. 2, the data security method of a portable storage device according to a specific embodiment of the present invention first starts from the step S100 of detecting that the portable storage device 200 is connected to the information processing device 100. do.

Here, the portable storage device 200 and the information processing device 100 have been described with reference to FIG. 1.

The information processing apparatus 100 reads the public key stored in the portable storage device 200 by accessing a region accessible from the portable storage device 200 regardless of whether the public key matches. The public keys read are compared with the public keys stored in the memory 40, which is a storage means provided in the information processing apparatus 100, to determine whether there is a corresponding public key (S200).

Here, the public key has been described with reference to FIG. 1 for the information processing apparatus according to the specific embodiment of the present invention.

In step 200, if it is determined that the matching common key is stored in the portable storage device 200 and the information processing device 100, the interface 10 of the information processing device 100 is the portable storage. The data stored in the device 200 is accessed and processed by the processor 20.

However, when it is determined in step 200 that there is no common key stored in the memory 40 and the portable storage device 200 of the information processing apparatus 100, the information processing apparatus 100 may determine that a user is not present. The information processing apparatus 100 enters a question-and-answer mode asking whether to generate a public key for the portable storage device 200. Accordingly, the user may input a public key generation command.

When the user inputs a command for generating a public key (S400), the information processing apparatus 100 performs an authentication step (S500) as to whether or not the user has the authority to access the portable storage device 200.

That is, a user interface for receiving an authentication key for verifying a user's authority to generate a public key is displayed (S510). Accordingly, when the user inputs an authentication key (S530), the information processing apparatus 100 performs the authentication. The keys are compared with the authentication keys stored in the portable storage device 200 to determine whether they match (S550).

If the authentication key input by the user in step 550 and the authentication key stored in the portable storage device 200 match, it is determined that the user has authority to generate a public key for the portable storage device 200. The information processing apparatus 100 generates a public key (S600).

In operation S700, the public key generated in operation 600 is stored in the memory 40 and the portable storage device 200 of the information processing apparatus 100.

When the public key is stored in the information processing apparatus 100 and the portable storage device 200 in step 700, the information processing apparatus 100 makes the data stored in the portable storage device 200 accessible. It becomes (S300).

On the other hand, if the user does not input the public key generation command in step 400, the user will not be able to access the data stored in the portable storage device 200 through the information processing device (100) (S800).

Here, the portable storage device 200 may include two or more storage areas, wherein some of the plurality of storage areas become areas accessible from the information processing device 100 regardless of whether a public key matches or does not have a right. In other words, the remaining storage area can be accessed only if the public key matches or the authentication authority is provided.

Therefore, information necessary for public key comparison or authorization authentication, that is, public key or authentication key, is stored in an accessible area regardless of whether the public key matches.

Meanwhile, as shown in FIG. 3, another embodiment of the present invention controls access to data stored in the portable storage device 200 according to the same method as the specific embodiment of the present invention described with reference to FIG. 2. Only the authentication step (S500) is performed differently.

In the portable storage device 200, the public certificate is stored. Therefore, when the user inputs a public key generation command in step 400, the information processing device 100 stores the public certificate in the mobile storage device 200. Recognizes and imports the data and outputs the screen required to log in the official certificate (S520).

The user inputs the information necessary to log in to the public certificate through the screen output in step 520. When a plurality of public certificates are stored in the portable storage device 200, one of them is selected and a password for the public certificate is selected. Enter (S540).

The information processing apparatus 100 transmits the information input in step 540 to an authorized authentication server (S560). In this case, the information processing apparatus 100 should be provided with an internet module using wired or wireless.

In step 560, when the password for logging in to the public certificate is transmitted to the authentication server, the authentication server determines whether to log in to the public certificate according to a predetermined procedure, and the information processing apparatus 100 receives the result. (S580).

If the login is granted in step 580, the information processing apparatus 100 generates a public key for the portable storage device 200 (S600), and the subsequent procedure will be described in the specific embodiment of the present invention. As shown.

On the other hand, if the login is not allowed according to the result received from the authentication server in step 580, the authentication fails and the public key is not generated and access to the portable storage device 200 is also impossible (S800).

At this time, the public certificate is also stored in an accessible area irrespective of whether the public key matches among the plurality of storage areas of the portable storage device 200 such as public key or authentication key information.

On the other hand, as shown in Figure 4, the step 600, that is, the public key generation step in a specific embodiment and the other embodiment of the present invention, can be performed by a variety of methods, but first the information processing apparatus 100 In step S610, the serial number of the portable storage device 200 may be read.

The serial number is a unique number of the portable storage device 200, and becomes a serial number of a product. The serial number is stored in an accessible space irrespective of whether a common key matches among a plurality of storage areas provided in the portable storage device 200.

In operation 610, a serial number of the portable storage device 200 read from the portable storage device 200 and a unique number of the information processing device 100 are combined to form a string to be a public key. A configuration step S630 is performed.

In this case, the unique number of the information processing apparatus 100 may be a product serial number or MAC address of the information processing apparatus 100.

The string combined as described above becomes a common key of the portable storage device 200 and the information processing device 100.

In this case, the information processing device 100 is a public key generated by the above process, the information processing device different from the other portable storage device, respectively stored in the information processing device 100 or the portable storage device 200, respectively When the same as the public key generated between and, the serial number of the portable storage device 200 and the unique number of the information processing device 100 can be recombined to generate a new string.

The rights of the present invention are not limited to the embodiments described above, but are defined by the claims, and various changes and modifications can be made by those skilled in the art within the scope of the claims. It is self-evident.

1 is a block diagram showing a schematic configuration of an information processing apparatus according to a specific embodiment of the present invention.

2 is a flowchart illustrating a data security method of a portable storage device according to a specific embodiment of the present invention step by step.

3 is a flowchart illustrating a data security method of a portable storage device according to another embodiment of the present invention in stages.

4 is a flowchart illustrating a method for generating a public key in an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100: information processing device 200: portable storage device

10: interface 20: processor

30: interface controller 40: memory

Claims (16)

A memory for storing a public key for the portable storage device; An interface to which the portable storage device is connected; A processor which accesses the portable storage device and processes data; And an interface controller for generating a common key with the portable storage device and storing the shared key in the memory and the portable storage device. The method of claim 1, The interface control unit, And a unique key of the information processing device and a unique number of the portable storage device to generate a public key. The method according to claim 1 or 2, The interface control unit, And determining whether there is a right required for generating a public key for the portable storage device. The method of claim 3, The interface control unit, And generating a public key only when it is determined that the information processing device has a public key generation authority with respect to the portable storage device. The method of claim 4, wherein The interface control unit, And logging in to the public certificate stored in the portable storage device, determining that the public key is authorized. The method of claim 4, wherein The interface control unit, When it is detected that the portable storage device is connected to the interface, Comparing the public key stored in the memory with the public key stored in the portable storage device; And comparing the public key stored in the memory with the public key stored in the portable storage device to block access of the processor to the portable storage device. (A) comparing the public key stored in the portable storage device with the public key stored in the information processing device when the portable storage device is connected to the information processing device; (B1) accessing data stored in the portable storage device when the portable storage device and the public key matched with the information processing device are found to be stored as a result of the determination in step (A); If it is determined that the public key corresponding to the portable storage device and the memory is not stored as a result of the determination in the step (A), access to the data stored in the portable storage device is blocked (B2). Data security method of a portable storage device characterized in that. The method of claim 7, wherein In the memory of the information processing apparatus, A plurality of public keys each generated for various portable storage devices are stored; The portable storage device, A data security method of a portable storage device, characterized in that a plurality of public keys each generated between the various information processing device is stored. The method of claim 8, The public key, And a character string combining the unique number of the information processing device and the unique number of the portable storage device. The method of claim 8, The public key, A data security method of a portable storage device, characterized in that it is generated by a combination of randomly extracted a certain number of characters. The method according to any one of claims 7 to 10, The data security method, And if access to the data is blocked in step (B2), further comprising the step (C) of receiving an instruction of whether to generate a public key for the portable storage device in the information processing device. Data security method of the portable storage device. The method of claim 11, The data security method, (D) checking a presence or absence of a right to generate a public key when a command is input to generate a public key for the portable storage device in step (C); (E) generating, by the information processing apparatus, a public key for the portable storage device when it is determined that the public key is authorized in the step (D); And (F) storing the public key generated in the step (E) in the information processing device and the portable storage device, respectively. The method of claim 12, The data security method, When the generation of the public key is completed in the step (D), the data security method of the portable storage device further comprising the step (G) of removing the access to the data stored in the portable storage device. The method of claim 12, Step (C) is, (C1) providing a user interface for receiving an authentication key for proving the existence of the public key generation authority; And (C2) comparing the authentication key input through the user interface with the authentication key stored in the portable storage device. The method of claim 12, Step (C) is, (C3) displaying a login screen of the public certificate stored in the portable storage device; (C4) inputting a password of the public certificate; And And a password for the authorized certificate is transmitted to the authentication server and logged in (C5). The method of claim 12, The data security method, (D ') comparing the public key generated in the step (D) with a public key previously stored in the memory and a public key previously stored in the portable storage device; As a result of the comparison in the step (D '), if the same public key as the public key generated in the step (D) is already stored in the memory or the portable storage device, the public key generated in the step (D) And (D ") regenerating a public key including a different string from the data storage method of the portable storage device.

Images