KR20130101626A - Secure data processing device and method thereof - Google Patents

Abstract

PURPOSE: A security data processing device and a method thereof are provided to enable reliable data processing, to prevent an increase in manufacture cost, to eliminate the need to change a manufacture line of a mobile device, to guarantee the normal operation of a system, and to efficiently uses resources of the system. CONSTITUTION: A plurality of main processors connected with each other are executed under the control of a main operating system (210). A security operating system (310) and the main operating system are operated at the same time. One or more security processes are executed under the control of the security operating system and correspond to the main processes. If one or more of the main processes are in an abnormal operation state, the operation of one or more security processes is stopped and initialized. The security operating system processes data required for security in a specific area of a memory. [Reference numerals] (200) Main unit; (300) Security unit; (404) Audio stream and a video stream where security is requested?; (408) Request an audio stream and a video stream; (410) Receive the request for an audio stream and a video stream and determine the request?; (414) Store the decrypted audio data in a common storage area; (416) Notify the completion of the security decryption of the audio stream; (422) Perform security decryption for the video stream; (424) Store the decrypted video data in a common storage area; (426) Notify the completion of the security decryption of the video stream; (AA) Read an audio stream and a video stream according to a request for executing contents; (BB) No; (CC) Preform the process of an audio and a video stream in a common mode; (DD) Yes; (EE) Video stream decryption; (FF) Audio stream decryption; (GG) Perform security decryption for the audio stream depending on whether the audio stream is a tempered audio stream or not

Description

SECURE DATA PROCESSING DEVICE AND METHOD THEREOF

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data processing apparatus, and more particularly, to a data processing apparatus and a method for improving security by using a security operating system separate from a main operating system (OS).

Recently, mobile devices are required to handle high quality services. For example, a mobile device can be used to remotely download and pay for recent movies or to perform bank payment services for a certain period of time.

In order to provide such various services, the mobile device employs a central processing unit (CPU) and an operating system (OS). Mobile devices employ an Open OS to implement an Open Application Program Interface. Open operating systems are key to the competitiveness of mobile devices and mobile services. In addition, the operating system of the mobile device is strategically opened by major manufacturers and major suppliers, and the application program interface (Application Program Interface), software development kit (Software Development Kit), and even source files are open to the public.

Mobile devices are also downloading a number of applications from the Internet. These applications are often made available after quality inspection and assurance by the manufacturer of the mobile device, but practically not all the functions of the various applications can be examined. Therefore, malicious codes targeting these mobile devices are increasing. In particular, mobile devices using an open operating system are subject to a software attack of malicious codes. Recently, methods for using a secure operating system have been sought.

On the other hand, as mobile devices are required to process high quality services, various digital contents are provided to user devices such as televisions, computers, and portable devices. Examples of digital content include moving pictures, audio files, various applications, and the like. As the provision of such digital contents becomes active, various measures have been proposed to protect the rights of intellectual property of digital contents.

In particular, digital content protection technologies such as DRM (Digital Rights Management) have been proposed as one of methods for protecting digital content. Digital content protection technology is a technology for continuously managing and protecting the rights to digital assets of digital content using encryption technology. That is, it is a technology for safely delivering various contents from a content provider (CP) to a user and preventing a user who receives the contents from illegally distributing the contents. This digital content protection technology can protect information throughout the entire process of creating, distributing, using and disposing of digital content, and protect user rights and usages according to user's rights both online and offline.

In order to use content-protected content (hereinafter referred to as “secure content”) on a user device, the user device first accesses a system that provides the secure content, and provides the secure content and metadata about the secure content. data) and a license to download. Here, the metadata is data in which information about the secure content is stored, and the license is data of a content specifying the decryption key used to decrypt the encrypted secure content and the access authority (for example, the number and duration) of the content. If both the security content and the license are stored in the user device through this process, the security content can be consumed.

An object of the present invention to provide a robust data processing apparatus and method from the attack of malicious codes.

Another object of the present invention is to provide an apparatus and method for secure data processing that can efficiently use resources of a system even when the processes do not operate normally while a plurality of operating systems operate a plurality of processes.

At least one of the above objects of the present invention can be achieved by the following components.

Security data processing apparatus according to an embodiment of the present invention, the main operating system; A plurality of main processes executed under the control of the main operating system and associated with each other; A security operating system operating simultaneously with the main operating system; And at least one security process that is executed under the control of the security operating system and corresponds to the main processes. When at least one of the plurality of main processes is in an abnormal operating state, the request is made by the main operating system. The operation of the at least one security process is interrupted and initialized.

The secure operating system processes data requiring security in a specific area of the memory, and the main operating system may be configured to be inaccessible to the specific area of the memory.

Also, the plurality of main processes may include a decrypt process for decoding content, a decoding process for decoding the content, a rendering process for outputting the content, and a user interface process for providing the content to a user. It may be any one of.

In addition, the at least one security process may include a decrypt process for decrypting content, a decoding process for decoding the content, a rendering process for outputting the content, and a user interface for providing the content to a user. It can be any one of the processes.

The security data processing apparatus may further include a security communication unit that enables switching between a normal mode executed by the main operating system and a security mode executed by the secure operating system.

The secure communication unit may use a predetermined bit to distinguish between a memory area accessible by the main operating system and a memory area accessible by the secure operating system on hardware.

In addition, the security data processing method according to an embodiment of the present invention, the main operating system is executed under the control of the main operating system, the first main process of the plurality of main processes associated with the security operating system running simultaneously with the main operating system Detecting abnormal operation; And stopping and initializing an operation of at least one security process corresponding to the main processes, which is executed under the control of the security operating system simultaneously running with the main operating system.

In addition, the security data processing method according to another embodiment of the present invention may further include the step of stopping and initializing the operation of the main processes other than the first main process.

In addition, the security data processing method according to another embodiment of the present invention, the main operating system further comprises the step of notifying the other main processes other than the first main process that the first main process is abnormally operated. It may include.

In addition, the security data processing method according to another embodiment of the present invention, the main operating system requests that any one of the main processes other than the first main process to stop and initialize the security processes to the main operating system It may further comprise the step.

According to the present invention, by operating a security operating system separate from the main operating system on one system-on-chip (SoC), it is possible to protect important content from attack of malicious codes at the chip level, thereby Due to this there is an advantage that can be processed data reliably.

In addition, the present invention, by operating a security operating system separate from the main operating system on one system-on-chip (SoC), it is not necessary to provide a separate chip for the security processing of data in addition to the central processing unit (CPU) In this case, the manufacturing cost of the mobile device may be prevented from rising due to the provision of the separate security chip, and the manufacturing line of the mobile device may not be changed.

Furthermore, another object of the present invention is to ensure the normal operation of the system even when the processes do not operate normally while a plurality of operating systems are operating a plurality of processes, there is an advantage that can use the resources of the system efficiently.

1 is a schematic block diagram illustrating a mobile device according to an embodiment of the present invention.
2 is a configuration diagram of a CPU processor according to an embodiment of the present invention.
3 is a flowchart illustrating operations of a main unit and a security unit when a content execution request is executed according to an embodiment of the present invention.
4 is a flowchart illustrating a process of performing security decryption on an audio stream according to an embodiment of the present invention.
5A through 5E are diagrams illustrating a method of initialization and synchronization between a plurality of processes when a process operates abnormally while a security mode is executed according to an embodiment of the present invention.

Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the contents described in the accompanying drawings. However, the present invention is not limited to or limited by the exemplary embodiments. Like reference numerals in the drawings denote members performing substantially the same function.

According to an embodiment of the present invention, the secure data processing device receives digital content (hereinafter referred to as 'security content') protected by a content protection technology such as digital rights management (DRM) to execute execution of the secure content when executed. It is executed using the security operating system which is separated from the main operating system and external access. In such embodiments of the present invention, the secure content may be an encrypted (encrypted) audio stream and / or a video stream protected by a content protection technology such as DRM. In addition, in the embodiment of the present invention, the secure data processing device is a device that can receive and use secure content such as a TV, a PC, a mobile terminal, etc., and executes the secure content using a secure operating system in which external access is blocked separately from the main operating system. Any device can be used.

In the present invention, a case where a secure data processing device is applied to a mobile device such as a smartphone will be described as an example.

1 is a schematic block diagram illustrating a mobile device according to an embodiment of the present invention. Referring to FIG. 1, the device 100 may be connected to an external device (not shown) using the mobile communication module 120, the sub communication module 130, and the connector 165. "External device" includes other devices (not shown), mobile phones (not shown), smartphones (not shown), tablet PCs (not shown), and servers (not shown).

Referring to FIG. 1, the device 100 includes a touch screen 190 and a touch screen controller 195. In addition, the device 100 may include a control unit 110, a mobile communication module 120, a sub communication module 130, a multimedia module 140, a camera module 150, a GPS module 155, and an input / output module 160. ), A sensor module 170, a storage unit 175, and a power supply unit 180. The sub communication module 130 includes at least one of a wireless LAN module 131 and a local communication module 132. The multimedia module 140 includes a broadcasting communication module 141, an audio reproduction module 142, (143). The camera module 150 includes at least one of the first camera 151 and the second camera 152, and the input / output module 160 includes a button 161, a microphone 162, a speaker 163, and vibrations. At least one of a motor 164, a connector 165, and a keypad 166.

The control unit 110 stores the CPU 111, a ROM (ROM) 112 in which a control program for controlling the device 100 is stored, and a signal or data input from the outside of the device 100, or in the device 100. The RAM 113 may be used as a storage area for a task to be performed. The CPU 111 may include a single core, a dual core, a triple core, or a quad core. The CPU 111, the ROM 112, and the RAM 113 may be interconnected via an internal bus.

The controller 110 may include a mobile communication module 120, a sub communication module 130, a multimedia module 140, a camera module 150, a GPS module 155, an input / output module 160, and a sensor module 170. The controller 175 may control the storage unit 175, the power supply unit 180, the touch screen 190, and the touch screen controller 195.

The controller 110 performs general execution and security execution using two separate main modes and security modes using one CPU 111 processor. The secure mode is a mode for performing critical execution that requires security, and the normal mode is a mode for performing non-secure execution that does not require security. According to an embodiment of the present invention, the control unit 110 includes a main unit for performing non-secure execution (hereinafter referred to as 'normal execution') and a security unit for performing security execution, and the general mode and the security mode through the main unit and the security unit, respectively. Can be done. A main operating system is executed in the main unit, and a secure operating system is separately executed in the security unit. In addition, the memory area used by the secure operating system is a secure storage area, and access is blocked by the main operating system. Accordingly, even when the main operating system is an open operating system, malicious code cannot access the security operating system and the memory area used by the security operating system.

The controller 110 executes a general program or an application or general content that is not required for security in a normal mode, and executes a program that requires security or an application that requires security or a security content that requires security in a security mode. Herein, a program, an application, or a content requiring security refers to a content requiring high security, such as DRM-configured content, a bank payment service, or an e-commerce. In addition, all the content that requires security is classified between the content that requires a high security and the content that requires a relatively low security, the content requiring high security is processed by the security unit 300, the relatively low Content that requires the security of the main unit 200 may be processed. In particular, according to an embodiment of the present invention, the control unit 110 executes a process for secure content protected by a content protection technology such as DRM in a secure mode. For example, the controller 110 may execute decryption, decoding, and rendering on the audio or / and video stream corresponding to the secure content under the operation of the secure operating system in a secure mode. .

In detail, when the content execution request is received according to a user's request, the controller 110 reads an audio or video stream corresponding to the content in a normal mode, and the audio or / and video stream that has been read is the audio or security request. And whether it is a video stream. The controller 110 processes the security requested audio or / and video stream read by switching to a security mode when security is required. For example, the controller 110 performs decryption, decoding, and rendering on the security-required audio and / or video streams in the security mode, and stores the processing result in a restricted storage storage area. The controller 110 controls the audio or video data stored in the secure storage area to be output through the multimedia module 140 in the secure mode. As such, the controller 110 controls the secure content to be processed using the secured access area 179 restricted in the secure mode, thereby making it difficult to hack the secure content.

Meanwhile, the controller 110 processes only the decryption processing in the security mode for the audio stream and the decoding and rendering processing for the decrypted audio stream when performing processing on the security-required audio or / and video stream. Can be processed in normal mode.

However, when the decoding and rendering process for the decrypted audio stream is processed in the normal mode, after decoding the descripted audio stream, the decoded audio data is stored in the general storage area 177. However, since the general storage area 177 is an insecure storage area and can be accessed regardless of the authority in the normal mode, hacking is possible when the audio data is stored in the general storage area 177. This allows a malicious user to organize data other than audio data (e.g. video data) into an audio stream (hereinafter referred to as a "tempered audio stream") using an identifier that represents the audio data. In this case, there may be cases where it is illegal to use it. In other words, if the video data is composed of a tempered audio stream, even if the tempered audio stream is decrypted in the secure mode, if the decoded tempered audio stream is decoded in the normal mode, the video data is calculated and stored in the normal storage area. Because it can be stored, a malicious user may want to create a tempered audio stream to hack the desired video data.

To prevent this, according to an embodiment of the present invention, the control unit 110 detects the tempered audio stream by determining whether the tempered audio stream is in the secure mode, and performs security decryption only when the tempered audio stream is not. To control. This can prevent hacking of video data using the tempered audio stream.

The mobile communication module 120 allows the device 100 to be connected to an external device through mobile communication using at least one, one, or a plurality of antennas (not shown) under the control of the controller 110. The mobile communication module 120 includes a voice call, a video call with a mobile phone (not shown), a smart phone (not shown), a tablet PC or another device (not shown) having a phone number input to the device 100, Send / receive wireless signals for text messages (SMS) or multimedia messages (MMS).

The sub communication module 130 may include at least one of a wireless LAN module 131 and a local area communication module 132. For example, it may include only the wireless LAN module 131, only the short range communication module 132, or both the wireless LAN module 131 and the short range communication module 132.

The WLAN module 131 may be connected to the Internet at a place where a wireless access point (AP) (not shown) is installed under the control of the controller 110. The wireless LAN module 131 supports the IEEE 802.11x standard of the Institute of Electrical and Electronics Engineers (IEEE). The short range communication module 132 may wirelessly perform short range communication between the apparatus 100 and an image forming apparatus (not shown) under the control of the controller 110. The local area communication method may include bluetooth, infrared data association (IrDA), and the like.

The device 100 may include at least one of a mobile communication module 120, a wireless LAN module 131, and a short range communication module 132 according to performance. For example, the device 100 may include a combination of the mobile communication module 120, the wireless LAN module 131, and the short range communication module 132 according to performance.

At least one of the mobile communication module 120, the wireless LAN module 131, and the short-range communication module 132 transmits a request signal for requesting secure content to an external content provider under the control of the controller 110, or Secure content may be received in response to a content request. In addition, at least one of the mobile communication module 120, the wireless LAN module 131, and the short-range communication module 132 is key data and authentication for decrypting or authenticating protected content such as DRM under the control of the controller 110. Request and receive information.

The multimedia module 140 may include a broadcasting communication module 141, an audio reproducing module 142, or a moving picture reproducing module 143. The broadcast communication module 141 may control a broadcast signal (eg, a TV broadcast signal, a radio broadcast signal or a data broadcast signal) transmitted from a broadcast station through a broadcast communication antenna (not shown) under the control of the controller 110 and the broadcast unit information. For example, an electric program guide (EPS) or an electric service guide (ESG) may be received. The audio playback module 142 may play a digital audio file (eg, a file extension of mp3, wma, ogg, or wav) stored or received under the control of the controller 110. The video playback module 143 may play a digital video file (eg, a file extension of mpeg, mpg, mp4, avi, mov, or mkv) stored or received under the control of the controller 110. The moving picture reproducing module 143 can reproduce the digital audio file.

The multimedia module 140 may include an audio play module 142 and a video play module 143 except for the broadcast communication module 141. The audio reproducing module 142 or the moving picture reproducing module 143 of the multimedia module 140 may be included in the controller 100. The multimedia module 140 processes and outputs audio and / or video data stored in the general storage area 177 in the normal mode under the control of the controller 110, and outputs audio or video data stored in the secure storage area 177 in the security mode. And / or process and output video data.

The camera module 150 may include at least one of a first camera 151 and a second camera 152 for capturing still images or moving images under the control of the controller 110. [ Also, the first camera 151 or the second camera 152 may include an auxiliary light source (eg, a flash (not shown)) that provides a light amount required for photographing. The first camera 151 may be disposed on the front of the device 100, and the second camera 152 may be disposed on the back of the device 100. In a different manner, the first camera 151 and the second camera 152 are adjacent (eg, the distance between the first camera 151 and the second camera 152 is greater than 1 cm and less than 8 cm). It is arranged to take a three-dimensional still image or a three-dimensional video.

The GPS module 155 receives radio waves from a plurality of GPS satellites (not shown) on Earth's orbit, and uses a time of arrival from the GPS satellites (not shown) to the device 100. The location of the device 100 can be calculated.

The input / output module 160 may include at least one of a plurality of buttons 161, a microphone 162, a speaker 163, a vibration motor 164, a connector 165, and a keypad 166.

Button 161 may be formed on the front, side or rear of the housing of the device 100, the power / lock button (not shown), volume button (not shown), menu button, home button, return It may include at least one of a button (back button) and the search button 161.

The microphone 162 receives a voice or a sound under the control of the controller 110 and generates an electrical signal.

The speaker 163 may control various signals (eg, wireless signals, broadcast signals, etc.) of the mobile communication module 120, the sub communication module 130, the multimedia module 140, or the camera module 150 under the control of the controller 110. Sound corresponding to a digital audio file, a digital video file, or a photo capture) may be output to the outside of the apparatus 100. The speaker 163 can output sound corresponding to the function performed by the apparatus 100 (e.g., a button operation sound corresponding to a telephone call or a ring back tone). The speaker 163 may be formed at one or a plurality of positions at appropriate positions or positions of the housing of the apparatus 100.

The vibration motor 164 can convert an electrical signal into a mechanical vibration under the control of the control unit 110. [ For example, when the device 100 in the vibration mode receives a voice call from another device (not shown), the vibration motor 164 operates. May be formed in the housing of the apparatus 100 in one or more. The vibration motor 164 may operate in response to the user's touching operation on the touch screen 190 and the continuous movement of the touch on the touch screen 190.

The connector 165 may be used as an interface for connecting the device 100 and an external device (not shown) or a power source (not shown). Under the control of the controller 110, data stored in the storage unit 175 of the device 100 is transmitted to an external device (not shown) or an external device (not shown) through a wired cable connected to the connector 165. You can receive data from. Power may be input from a power source (not shown) or a battery (not shown) may be charged through a wired cable connected to the connector 165.

Keypad 166 may receive a key input from a user for control of device 100. Keypad 166 includes a physical keypad (not shown) formed on device 100 or a virtual keypad (not shown) displayed on touch screen 190. Physical keypads (not shown) formed in the device 100 may be excluded depending on the performance or structure of the device 100.

Sensor module 170 includes at least one sensor that detects a state of device 100. For example, the sensor module 170 may include a proximity sensor that detects whether the user approaches the device 100, an illuminance sensor (not shown) that detects the amount of light around the device 100, or the device 100. ), A motion sensor (not shown) that detects an operation (eg, rotation of the device 100, acceleration or vibration applied to the device 100). At least one of the sensors may detect the state, generate a signal corresponding to the detection, and transmit the signal to the control unit 110. The sensor of the sensor module 170 may be added or deleted according to the performance of the device 100.

The storage unit 175 is connected to the mobile communication module 120, the sub communication module 130, the multimedia module 140, the camera module 150, the GPS module 155, the input / And may store signals or data input / output corresponding to the operation of the touch panel 160, the sensor module 170, and the touch screen 190. The storage unit 175 may store a control program and applications for controlling the device 100 or the controller 110.

 The term “storage unit” refers to a memory card (not shown) mounted in the storage unit 175, the ROM 112 in the control unit 110, the RAM 113, or the device 100 (eg, an SD card or a memory stick). ). The storage unit may include a nonvolatile memory, a volatile memory, a hard disk drive (HDD), or a solid state drive (SSD).

The storage unit 175 may include a general storage area 177 and a secure storage area 179. In the general storage area 177, general data and programs may be stored, and in the secure storage area 179, data and programs that may be accessed only by components accessed in a secure mode may be stored. According to an embodiment of the present invention, in the general storage area 177, audio corresponding to content downloaded using at least one of the mobile communication module 120, the wireless LAN module 131, and the short-range communication module 132 or / And a video stream can be stored. In addition, the normal storage area 177 may store decrypted audio and / or video data and decoded audio data and / or video data generated when decrypting and decoding general content in the normal mode. The secure storage area 179 may store decrypted audio and / or video data or decoded audio and / or video data generated when decrypting and decoding security content in the secure mode.

The power supply unit 180 may supply power to one or a plurality of batteries (not shown) disposed in the housing of the apparatus 100 under the control of the controller 110. One or more batteries (not shown) supply power to the device 100. In addition, the power supply unit 180 may supply power input from an external power source (not shown) to the device 100 through a wired cable connected to the connector 165.

The touch screen 190 may provide a user interface corresponding to various services (e.g., call, data transmission, broadcasting, photographing) to the user. In particular, according to an embodiment of the present invention, a user interface for performing an application such as a content download application or a content reproduction application may be provided.

The touch screen 190 may transmit an analog signal corresponding to at least one touch input to the user interface to the touch screen controller 195. The touch screen 190 may receive at least one touch through a user's body (eg, a finger including a thumb) or a touchable input means (eg, a stylus pen). Also, the touch screen 190 can receive a continuous movement of one touch among at least one touch. The touch screen 190 may transmit an analog signal corresponding to the continuous movement of the input touch to the touch screen controller 195. For example, an analog signal corresponding to a request for executing a content download application by a user or a touch operation corresponding to various user selections generated while executing the content download application may be transmitted to the touch screen controller 195.

In the present invention, the touch is not limited to the contact between the touch screen 190 and the user's body or touchable input means, and a non-contact (eg, a detectable distance between the touch screen 190 and the user's body or touchable input means) 1 mm or less). The detectable distance on the touch screen 190 may be changed according to the performance or structure of the device 100.

The touch screen 190 may be implemented by, for example, a resistive method, a capacitive method, an infrared method, or an acoustic wave method.

The touch screen controller 195 converts an analog signal received from the touch screen 190 into a digital signal (eg, X and Y coordinates) and transmits the same to the controller 110. The controller 110 may control the touch screen 190 using the digital signal received from the touch screen controller 195. For example, the controller 110 may select a shortcut icon (not shown) displayed on the touch screen 190 or execute a shortcut icon (not shown) in response to the touch. Also, the touch screen controller 195 may be included in the control unit 110. [

2 is a block diagram of a CPU 111 processor of the controller 110 according to an embodiment of the present invention. Referring to FIG. 2, the CPU 111 may include a main unit 200 performing general execution, a security unit 300 performing security execution, and a secure communication unit performing communication between the main unit 200 and the security unit 300 ( 270).

The main unit 200 executes a general program or a general application or a general content that is not required for security in a normal mode, and when the security program, a security application, or a security content required for execution is required through the secure communication unit 270. Command or request the execution to the security unit 300.

The main operating system 210 is executed in the main unit 200, and the security operating system 310 is separately executed in the security unit 300. The main operating system 210 may not directly access the security unit 300, but may command or request execution of specific functions, threads, and processes through the security communication unit 270. The secure communication unit 270 enables the data processing device or the mobile device according to the present invention to switch between the secure mode and the non-secure mode. The secure communication unit 270 divides a memory area accessible by the main unit 200 and a memory area accessible by the security unit 300 by using a predetermined bit on hardware. You can. As a result, the secure storage area 179, which is a memory area used by the security unit 300, is blocked from being accessed by the main unit 200. Accordingly, even when the main operating system 210 of the main unit 200 is an open operating system, malicious code can access the secure operating system 310 and the secure storage area 179 used by the secure operating system 310. There will be no. Hereinafter, a process of processing the content requiring security in the security unit 300 will be described by way of example.

The security unit 300 decrypts, decodes, or renders the security content on the security board when a request for decrypting, decoding, or rendering the security content is requested from the main unit 200.

In particular, when the security decryption request for the audio stream is received, the security unit 300 determines whether the audio stream is a tempered audio stream according to a predetermined audio stream standard before performing the security decryption. In this case, the predetermined audio stream reference may be a frame size of the audio stream or a start code included in the audio stream. The security unit 300 may determine the audio stream as a tampered audio stream when the frame size of the security decryption requested audio stream is larger than a predetermined reference audio frame size. In addition, if the start code included in the security decryption requested audio stream is not the start code corresponding to the audio stream, the security unit 300 may determine the audio stream as a tampered audio stream.

If the security unit 300 determines that the tampered audio stream is before the security decryption is performed, the security unit 300 notifies the main unit 200 without performing the security decryption on the audio stream.

On the other hand, if it is not determined as a tampered audio stream before performing the security decryption, the security decryption on the audio stream is performed.

The security unit 300 determines whether the security decrypted audio stream is a tampered audio stream after performing the security decryption on the audio stream. At this time, the security unit 300 checks the codec corresponding to the decrypted audio stream, and if the codec corresponding to the decrypted audio stream is a video codec rather than an audio codec, it may determine that the secure decrypted audio stream is a tempered audio stream. Can be. On the other hand, if the various information included in the decrypted audio stream as well as the codec is information representing the video stream, the security unit 300 may determine that the decrypted audio stream is a tempered audio stream.

After performing the security decrypt, the security unit 300 informs the main unit 200 that the tampered audio stream is a tampered audio stream, and stops decoding the decrypted audio data.

When the security unit 300 receives a security decrypt command for the video stream from the main unit 200, the security unit 300 performs a security decryption on the video stream using the security key and authentication information, and securely stores the security decrypted audio stream. Store in area 179.

If the configuration of the main unit 200 and the security unit 300 as described above in more detail, the main operating system (Operating System) 210, decrypt unit 220, decoding unit 230, rendering unit 240 ), The application unit 250 is included. The security unit 300 includes a security operating system 310, a provision service unit 320, a secure file system 330, and a security service unit 340.

First, the main OS (Operating System) 210, the decryption unit 220, the decoding unit 230, the rendering unit 240, and the application unit 250 of the main unit 200 will be described.

The main OS 210 is a main operating system of the device 100, and is responsible for operating the entire device 100 in a normal mode, and particularly, executes a general program or general application or general content that is not required to be secured in the general mode. In addition, when execution of a security program or security application or security content required for security is required, the security unit 300 commands or executes the execution to the security unit 300 through the security communication unit 270.

The decryption unit 220 reads the audio and / or video stream corresponding to the requested content from the general storage area 177 when the content execution is requested, and the audio of which the audio and / or video stream is required to be secured. And / or whether it is a video stream. In this case, the decryption unit 220 may determine whether the audio and / or video stream is an audio and / or video stream requiring security by checking whether a content protection system such as DRM is applied. Also, the decryption unit 210 may determine whether the audio and / or video stream is required for security when the audio and / or video stream includes an identifier for allowing the audio and / or video stream to be executed in the security mode. .

The decryption unit 220 divides the unsecured audio or / and video stream into payload units in the general storage area 177 when the requested content is an unsecured audio or / and video stream. And request decoding. If the content requested to be executed is an audio and / or video stream requiring security, the decrypting unit 220 classifies the security-requested audio or / and video stream into payload units, and requests security for payload units. The main OS 210 is requested to perform a security decryption on the audio or video stream. When the decryption unit 210 receives the information indicating that the security decryption is completed from the main OS 210, the decryption unit 210 requests the decoding unit 220 to decode.

The decoding unit 230 includes a video decoding module 232 and an audio decoding module 234. The decoding unit 230 receives the general storage area 177 through the video decoding module 232 and / or the audio decoding module 234 in the normal mode when there is a decoding request for the non-secured normal audio and / or video stream. The audio or / and video stream in units of payloads stored in the device is decoded into audio or / and video data in units of frames using the corresponding audio or video codec. The decoding unit 230 stores the decoded audio or / and video data in the general storage area 177 and requests the rendering unit 240 to render. Meanwhile, if there is a video stream decoding request that requires security, the decoding unit 230 requests the main OS 210 to perform secure decoding in a secure mode. When the decoder 230 receives information indicating that the security decoding is completed from the main OS 210, the decoder 230 requests rendering from the renderer 240.

The renderer 240 includes a video rendering module 242 and an audio rendering module 244. The rendering unit 230 receives the general storage area 177 through the video rendering module 242 or the audio rendering module 244 in the normal mode when there is a rendering request for the non-secured general audio or / and video data. Performs video rendering to generate the decoded video data stored in the 2D or 3D video signal that can be displayed on the touch screen 190, and outputs the same, and performs the rendering to generate the decoded audio data as the analog audio signal. Output

Meanwhile, when there is a video data rendering request that requires security, the rendering unit 240 requests the main OS 210 to perform security rendering in the security mode. When the rendering unit 240 receives information indicating that the security rendering is completed from the main OS 210, the rendering unit 240 requests to output the rendered video signal and the audio signal. The rendered video signal and the audio signal may be output through the display device and the speaker, respectively.

The application unit 250 includes an application such as a content download application or a content reproduction application, and performs a corresponding function when the application is executed according to a user request.

Hereinafter, the security operating system 310 of the security unit 300, the provisioning service unit 320, the secure file system (SFS) 330, and the security service unit 340 will be described.

The security OS 310 is a security operating system of the device 100 and performs execution of security content required for security in a security mode. In particular, the security OS 310 is during the decryption request, the decoding request, the rendering request, and the decryption request for the security-required audio stream from the main OS 210 via the security communication unit 270. If any one is received, it is transmitted to the security service unit 340.

The provision service unit 320 receives a security key and authentication information from an external content protection service provider such as a DRM service provider and records the secure key and authentication information in the SFS 330. In addition, the security key and authentication information may be stored in advance in the SFS (330) by the device manufacturer.

The SFS 330 is a storage area accessible in a secure mode and includes various programs and information for executing security-required secure content such as decryption execution, decoding execution, and rendering execution for audio or video signals. In addition, the SFS 330 stores the security key and authentication information recorded by the provision service unit 320.

The security service unit 340 provides a security decryption service 342 for performing security decryption, a security decoding service 344 for performing security decoding, and a security rendering service 346 for performing secure rendering. The security service unit 340 performs security decryption through the security decryption service 342. The security service unit 340 performs security decoding through the security decoding service 344. The security service unit 340 performs security rendering through the security rendering service 346.

When the decryption request for the security-required video stream is transmitted from the security OS 310, the security service unit 340 uses the security key and authentication information stored in the SFS 330 for the security-required video stream. Secure decrypt is performed and the secure decrypted video stream is stored in secure storage area 179. In addition, when a decoding request for a security-required video stream is transmitted from the security OS 310, the security service unit 340 performs security decoding on the security-required video stream using the corresponding video codec, and securely decoded the video stream. To the secure storage area 179. In addition, the security service unit 340, when the rendering request for the security-required video data from the security OS 310, the security rendering to generate a video signal for displaying the decoded video data in a two-dimensional or three-dimensional screen And output a video signal.

Meanwhile, when the decryption request for the security-required video stream is transmitted from the security OS 310, the security service unit 340 uses the security key and authentication information stored in the SFS 330 to transmit the security-requested audio stream. Performs a secure decrypt on the data and stores the secure decrypted audio stream in the general storage area 179.

As described above, the security service unit 340 stores the decrypted, decoded, and rendered results of the security-required video stream in the secure storage area 179, so that the security of the video stream is further enhanced, making it difficult to hack. do.

However, the security service unit 340 may be at risk of hacking by storing the decrypted audio stream in the general storage area 177 for the security-required video stream. In other words, if a malicious user configures a kind of data other than audio data, such as video data, into a tempered audio stream using an identifier that represents the audio data, the tempered audio stream is decrypted in secure mode, making it vulnerable to hacking. This is because it can be stored in the general storage area 177 that has been created.

To prevent this, the security service unit 340 determines whether it is a tempered audio stream and detects the tempered audio stream when decrypting the audio stream required for security from the security OS 310. In this case, the security service unit 340 may determine whether the tempered audio stream is before the decryption of the audio stream, and stop performing the decryption in the case of the tempered audio stream. In addition, the security service unit 330 may determine whether or not the tempered audio stream after decryption of the audio stream, and may not provide a result of decryption if the tempered audio stream.

3 is a flowchart illustrating operations of the main unit 200 and the security unit 300 when a content execution request is executed according to an embodiment of the present invention. Referring to FIG. 3, in operation 402, the main unit 200 reads an audio and video stream corresponding to a content from a general storage area 177 according to a content execution request by a user. In this case, the user may execute a content reproducing application on the device 100 and input a content execution request by touching a desired content in the content application displayed on the touch screen.

The main unit 200 determines whether the read audio and video streams are required content in step 404. At this time, the decrypt unit 210 included in the main unit 200 may determine whether the audio and video stream is a security protection audio and video stream by checking whether a content protection system such as DRM is applied. In addition, when the decryption unit 210 included in the main unit 200 includes an identifier for allowing the audio and video streams to be executed in the security mode, the audio and video streams may determine whether the decryption unit 210 is an audio and video stream that requires security. Can be.

If the audio and video streams are not security-required content, the main unit 200 proceeds to step 406 to perform audio and video stream processing in the normal mode. For example, the main unit 200 performs decoding on the audio and video streams in the normal mode, and stores the decoded audio and video data in the general storage area 177. The main unit 200 renders and outputs decoded audio and video data.

On the other hand, if the audio and video stream is a security-required content, the main unit 200 requests the security unit 300 to decrypt the audio and video stream in step 408.

The security unit 300 receives a decrypt request for the audio and video stream in step 410, proceeds to step 412 for decrypting the audio stream, and proceeds to step 422 for video decrypting.

The security unit 300 performs security decryption on the audio stream according to a result of determining whether the audio stream is a tempered audio stream in step 412, and stores the security decrypted audio data in the general storage area 177 in step 414. do. In operation 416, the security unit 300 transmits information indicating that the security decryption for the audio stream is completed to the main unit 200.

In operation 422, the security unit 300 performs security decryption on the video stream, and in step 424, the security decrypted video data is stored in the security storage area 179. In operation 426, the security unit 300 transmits information indicating that the security decryption for the video stream is completed to the main unit 200.

As described above, according to an embodiment of the present invention, the security unit 300 performs security decryption on the audio stream according to a result of determining whether the audio stream is a tempered audio stream when performing a security decryption on the audio decryption. In addition, the tempered audio stream may be decrypted to prevent the video data from being stored in the general storage area 177.

Hereinafter, a process of performing security decryption on the audio stream of the security unit 300 as described above will be described in more detail.

4 is a flowchart illustrating a process of performing a security decrypt on an audio stream of the security unit 300 according to an embodiment of the present invention. Referring to FIG. 4, the security service unit 340 of the security unit 300 may receive a decrypt request for an audio stream by the main OS 210 from the security OS 310. If the security service unit 300 requests a decrypt for the audio stream in step 502, the security service unit 300 proceeds to step 504.

In operation 504, the security service unit 340 determines whether the decrypted requested audio stream is a tempered audio stream that does not satisfy the first predetermined criterion. For example, the first predetermined criterion may be a frame size of the audio stream or a start code of the audio stream. The security service unit 340 may determine that the decrypted requested audio stream is larger than the predetermined audio frame size as the tempered audio stream. In addition, the security service unit 340 may determine that the start code of the decrypted requested audio stream is a tempered audio stream when the start code indicating the audio stream is not.

In addition, when the audio stream satisfies the first predetermined criterion, the security service unit 340 performs security decryption on the requested audio stream in step 506.

In operation 508, the security service unit 340 determines whether the secure decrypted audio stream is a tempered audio stream that does not satisfy the second predetermined criterion. For example, the second predetermined criterion may be codec information. When the codec information included in the decrypted audio stream is not the audio codec information corresponding to the second predetermined criterion, for example, the codec information corresponding to the video, the security service unit 240 determines the audio stream as the tempered audio stream. can do.

If the audio stream satisfies the second predetermined criterion, the security service unit 340 stores the secure decrypted audio stream in the general storage area 177 in step 510, and the secure decryption of the audio stream is completed. Inform the secure OS 310.

On the other hand, if the tempered audio stream does not satisfy the first predetermined criterion or the tempered audio stream does not satisfy the second predetermined criterion, the security service unit 340 proceeds to step 512 to stop the decryption. The secure OS 310 is notified that the decrypted requested audio stream is a tempered audio stream.

Accordingly, the security OS 310 notifies the main OS 210 that the decrypted requested audio stream is a tempered audio stream, and the main OS 210 can stop playback or use of the tempered audio stream. .

5A through 5E are diagrams illustrating a method of initialization and synchronization between a plurality of processes when a process operates abnormally while a security mode is executed according to an embodiment of the present invention.

First, referring to FIG. 5A, for example, when a user wants to execute content related to DRM according to an embodiment of the present invention, a plurality of main processes 511, 512, and 513 are executed in the main unit 200. In the security service unit 340 of 300, at least one security process corresponding to the plurality of main processes 511, 512, and 513 is executed. For example, the first to third security processes 521, 522, and 523 corresponding to the plurality of main processes 511, 512, 513 may be executed in the security service unit 340. Here, the first to third main processes 511, 512, and 513 are processes that operate in association with each other to execute one application. For example, when the application is configured to receive and execute content such as a latest movie with DRM set from a remote contents provider, the first to third main processes 511, 512, and 513 are each decrypted ( Any one of a decrypt process executed by 220, a decoding process executed by the decoder 230, a rendering process performed by the renderer 240, and a user interface process for providing content to a user Can be. Accordingly, when any one of the first to third main processes 511, 512, and 513 does not operate normally, the user may not normally watch the movie. In addition, the first to third security processes 521, 522, and 523 correspond to the first to third main processes 511, 512, and 513, respectively. Hereinafter, a case where the first main process 511 is a decrypt process, the second main process 512 is a decoding process, and the third main process 513 is a rendering process will be described as an example.

Next, referring to FIG. 5B, at least one main process does not generate a response or stops due to an unexpected event while the plurality of main processes 511, 512, 513 are operated in the main unit 200. It may not work properly. For example, FIG. 5B illustrates an example in which the first main process 511 crashes and does not operate normally. As such, even if the first main process 511 does not operate normally, the first security process 521 corresponding to the first main process 511 still occupies resources of the system. In addition, the second and third main processes 512 and 513 associated with the first main process 511 and the corresponding second and third security processes 522 and 523 still occupy resources of the system. However, since the first main process 511 does not operate normally, that is, the decryption process for the received frame or payload is not normally performed, many related processes occupy resources of the system. there is a problem.

Referring to FIG. 5C, the main OS 210 detects that the first main process 511 does not operate normally, and indicates that the first main process 511 does not operate normally. Notify processes 511 and 512. In FIG. 5C, the second and third processes 512 and 513 are darker than in FIG. 5B. This is to indicate that the second and third processes 512 and 513 are also not normally operated because the first main process 511 is crashed.

Referring to FIG. 5D, when the second and third main processes 512 and 513 receive notification from the main OS 210 that the related first main process 511 has crashed, the second and third main processes 512 and 513 are crashed. Stops and initializes any running operation. Then, any one of the second and third main processes 512 and 513 requests the main OS 210 to initialize the first to third security processes 521, 522 and 523 running in the security unit 300. In FIG. 5D, the second main process 512 requests the main OS 210 to stop and initialize the first to third security processes running in the security unit 300. Then, the main OS 210 may request the security service unit 340 to stop and initialize the first to third security processes 521, 522, and 523 through the security communication unit 270. 340 may suspend and initialize the first to third security processes 521, 522, 523 according to the request.

Through this process, as shown in FIG. 5, the first to third security processes 521, 522, and 523 corresponding to the first to third main processes 511, 512, 513 may be initialized and synchronized. Thus, even when at least one of the plurality of associated processes operates abnormally in the system running the main OS 210 and the secure OS 310 simultaneously, all of the abnormally operating process and other associated processes By initializing and synchronizing its operation, the problem of unnecessary consumption of system resources can be eliminated. In addition, even if some processes do not operate normally while receiving DRM content, the user may be provided with the DRM content again.

In the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. In the exemplary embodiment of the present invention, the secure data processing apparatus according to the present invention is described using a mobile device as an example, but the present invention may be applied to devices using an operating system such as a digital TV, a set-top box, a personal computer, a laptop, and the like. Those skilled in the art will readily understand. In addition, the methods according to the exemplary embodiments of the present invention may be implemented in the form of program instructions that may be executed by various computer means and may be recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be known and available to those skilled in the computer software field. Therefore, the scope of the present invention should not be defined by the described embodiments, but should be defined by the equivalents of the claims such as the claims.

Claims (15)

Main operating system;
A plurality of main processes executed under the control of the main operating system and associated with each other;
A security operating system operating simultaneously with the main operating system; And
At least one security process executed under the control of the security operating system and corresponding to the main processes;
And when at least one of the plurality of main processes is in an abnormal operation state, an operation of the at least one security process is stopped and initialized by a request of the main operating system.
The apparatus of claim 1, wherein the secure operating system processes data requiring security in a specific area of the memory, and the main operating system cannot access the specific area of the memory.
The method of claim 1, wherein the plurality of main processes include a decrypt process for decrypting content, a decoding process for decoding the content, a rendering process for outputting the content, and a user interface for providing the content to a user. User Interface) security data processing apparatus, characterized in that any one of the process.
The method of claim 1, wherein the at least one security process comprises a decrypt process for decrypting content, a decoding process for decoding the content, a rendering process for outputting the content, and a user interface for providing the content to a user. (User Interface) The security data processing apparatus, characterized in that any one of the process.
The secure data processing of claim 1, further comprising a secure communication unit configured to enable the secure data processing device to switch between a normal mode executed by the main operating system and a secure mode executed by the secure operating system. Device.
The apparatus of claim 1, further comprising a secure communication unit configured to enable the secure data processing device to switch between a normal mode executed by the main operating system and a secure mode executed by the secure operating system.
And the secure communication unit divides a memory region accessible by the main operating system and a memory region accessible by the secure operating system on hardware by using a predetermined bit.
Detecting, by a main operating system, that a first main process of a plurality of main processes associated with a secure operating system running under the control of the main operating system and operating simultaneously with the main operating system is abnormally operated; And
Stopping and initializing an operation of at least one security process corresponding to the main processes, which is executed under the control of the security operating system simultaneously running with the main operating system.
The method of claim 7, wherein
And suspending and initializing operations of other main processes except for the first main process.
8. The method of claim 7, further comprising the step of the main operating system notifying other main processes other than the first main process that the first main process is abnormally operating.
10. The security of claim 9, further comprising the main operating system requesting any one of the main processes other than the first main process to suspend and initialize the secure processes. How data is processed.
8. The method of claim 7, wherein the secure operating system processes data requiring security in a specific area of the memory, and the main operating system cannot access the specific area of the memory.
The method of claim 7, wherein the plurality of main processes include a decrypt process for decrypting content, a decoding process for decoding the content, a rendering process for outputting the content, and a user interface for providing the content to a user. User Interface) process, characterized in that any one of the process.
8. The method of claim 7, wherein the at least one security process comprises a decrypt process for decrypting content, a decoding process for decoding the content, a rendering process for outputting the content, and a user interface for providing the content to a user. (User Interface) The security data processing method, characterized in that any one of the processes.
8. The secure data processing of claim 7, further comprising a secure communication unit configured to enable the secure data processing device to switch between a normal mode executed by the main operating system and a secure mode executed by the secure operating system. Way.
The apparatus of claim 7, further comprising a secure communication unit configured to enable the secure data processing device to switch between a normal mode executed by the main operating system and a secure mode executed by the secure operating system.
And the secure communication unit divides a memory area accessible by the main operating system and a memory area accessible by the secure operating system on hardware using a predetermined bit.

Images