KR20190064286A - Security-enhanced wireless communication apparatus - Google Patents

Abstract

The present invention relates to a security-enhanced wireless communication apparatus. The security-enhanced wireless communication apparatus comprises: a memory divided into a plurality of security partitions; a security accelerator providing a plurality of security algorithms; and a processor controlling a plurality of security element adapters, each of which provides a security system call application programming interface (API) in cooperation with an independent security service application, and a virtual machine which enforces a security policy on the security system call API, provides a usage right of the security accelerator according to the security policy, or provides an access right to the security partitions. Therefore, the present invention is able to provide a security solution specialized in a multipurpose service by using a virtual machine.

Description

[0001] SECURITY-ENHANCED WIRELESS COMMUNICATION APPARATUS [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a wireless communication technology, and more particularly, to a security-enhanced wireless communication device capable of providing a security solution specialized in a multipurpose service using a virtual machine.

A wireless push-to-talk (PTT) system may be used in an environment that requires a plurality of groups of people, i.e., members, to communicate with each other in PTM format. Examples of environments in which a push-to-talk (PTT) application is used may include workgroup communications, secure communications, construction site communications, and local army communications. A push-to-talk (PTT) service corresponds to a typical half-duplex, and only one member at a given time can transmit information from another member. Push-to-talk (PTT) services are also important, but security features are very weak.

Korean Patent No. 10-0978987 discloses a method and apparatus for establishing a high-speed security session in a half-duplex AD-HOC group voice cellular network channel. In a wireless dispatch system including a device group, A group of devices may include a first secure device in communication with a plurality of second secure devices through a channel.

Korean Patent No. 10-1048523 (July 23, 2011) relates to a multifunctional radio capable of communicating with a cell phone using Bluetooth, receiving radio waves, and a push-to-talk (PTT) And PTT to wirelessly communicate with each other and enjoy hands free leisure (eg, bicycle, in-line, motorcycle, etc.), thereby greatly improving the quality and reliability of the product, To be planted.

Korea Patent No. 10-0978987 (Aug. 24, 2010) Korean Patent No. 10-1048523 (Jul. 2011)

An embodiment of the present invention is to provide a security-enhanced wireless communication device capable of providing a security solution specialized for a multi-purpose service by using a virtual machine.

One embodiment of the present invention is to provide a security-enhanced wireless communication device capable of determining an independent security policy for each security service and applying an independent security algorithm according to the security policy.

An embodiment of the present invention is to provide a security-enhanced wireless communication device capable of controlling access rights of a security accelerator or a security partition according to a security policy.

Among the embodiments, the security enhanced wireless communication device includes a memory divided into a plurality of security partitions, a security accelerator providing a plurality of security algorithms, and a security system call API A plurality of security element adapters for providing an application programming interface (API) and security policies for the security system call API, providing the use rights of the security accelerator according to the security policy, And a processor that controls a virtual machine that provides access rights to the virtual machine.

The processor can set one of the plurality of security element adapters as a chip operating system for a service related to a smart card and set the other as a file operating system for a service related to remote file processing.

The chip operating system may transmit the payment request through a security system call API used in the payment process of the smart card to the payment approval device in the form of a cloud message to store the payment request in the cloud server.

The chip operating system permits access to the security partition for the smart card, which is one of the plurality of security partitions through the security accelerator, when the approval of the payment request is successfully received, It is possible to prevent access to the payment means.

The chip operating system may provide settlement information derived from the settlement means and completely encrypted by the security accelerator to the settlement processing apparatus.

The file operating system may generate the partially encrypted file through the security accelerator by using the secure system call API in the process of directly transmitting the P2P file, thereby transmitting the partially encrypted file to the file receiving and storing device.

The file operating system may divide the original file into a plurality of intercepts and generate the partially encrypted file by alternating the encrypted intercept with the original intercept.

The processor sets another one of the plurality of security element adapters as a PTT operating system for a PTT service, and the PTT operating system transmits a direct P2P file by a file operating system through a security system call API used before a transmission process of a PTT Transmission of a variable-size PTT message through the security accelerator is performed prior to transmission, and the variable encryption can be performed with a different security algorithm according to the load of the processor.

The disclosed technique may have the following effects. It is to be understood, however, that the scope of the disclosed technology is not to be construed as limited thereby, as it is not meant to imply that a particular embodiment should include all of the following effects or only the following effects.

The security-enhanced wireless communication apparatus according to an exemplary embodiment of the present invention can determine an independent security policy for each security service, and can apply an independent security algorithm according to the security policy.

The security-enhanced wireless communication apparatus according to an exemplary embodiment of the present invention can control the access right of the security accelerator or the security partition according to the security policy.

1 is a diagram illustrating a security-enhanced wireless communication system according to an exemplary embodiment of the present invention.
2 is a block diagram illustrating the wireless communication apparatus of Fig.
3 is a block diagram illustrating the security element of FIG.
4 is a flowchart illustrating a process of providing a smart card settlement service through a chip operating system according to an exemplary embodiment of the present invention.
5 is an exemplary diagram illustrating a process of generating a partially encrypted file in a file operating system.
6 is a diagram illustrating a main function provided in a security enhanced wireless communication apparatus according to an embodiment of the present invention.

The description of the present invention is merely an example for structural or functional explanation, and the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the present invention should be understood to include equivalents capable of realizing technical ideas. Also, the purpose or effect of the present invention should not be construed as limiting the scope of the present invention, since it does not mean that a specific embodiment should include all or only such effect.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

It is to be understood that the singular " include " or "have" are to be construed as including the stated feature, number, step, operation, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

The present invention can be embodied as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all kinds of recording devices for storing data that can be read by a computer system . Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present application.

1 is a diagram illustrating a security-enhanced wireless communication system according to an exemplary embodiment of the present invention.

Referring to FIG. 1, a security enhanced wireless communication system (hereinafter, referred to as a wireless communication system) 100 may include at least two wireless communication devices 110.

The wireless communication device 110 may correspond to a Push-To-Talk (PTT) terminal that can use real-time wireless communication services, one to one or a plurality of which immediately include simple communication. Any one of the plurality of radio communication apparatuses 110 constituting the radio communication system 100 is connected to at least one of the remaining radio communication apparatuses 112 and 113 They can be connected over a network and can send and receive messages.

2 is a block diagram illustrating the wireless communication apparatus of Fig.

2, the wireless communication device 110 includes a security service application 210, a security element adapter 220, a virtual machine 230, a security element 240, . ≪ / RTI >

The security service application 210 may correspond to an application program for providing an independent security service provided by the wireless communication device 110. The wireless communication device 110 may include a security service application 210 that can provide a plurality of security services and independently perform operations for each security service to provide each security service.

For example, the security service application 210 corresponds to an application for providing a smart card solution service, a cloud network service, a P2P direct communication service, a P2P relay communication service, and a file transmission / The present invention can be applied to an application that can directly perform various types of security services provided by the wireless communication device 110. [

The security service application 210 may be installed in the wireless communication device 110 basically, and the wireless communication device 110 may download installation related files through the network and directly install the files. The wireless communication device 110 can be connected to the update server (not shown in FIG. 1) to periodically check whether or not the security service application 210 is updated, and if the update file exists, the wireless communication device 110 automatically performs update can do.

The security element adapter 220 can interwork with the security service application 210 in a one-to-one manner and can provide a security system call API (Application Programming Interface). The security element adapter 220 may provide the security system call API to the security service application 210 linked to the security element adapter 220 according to the security policy.

When the specific security service application 210 is executed, the wireless communication device 110 generates the security element adapter 220 and can link the specific security service application 210 and the generated security element adapter 220 one on another . The wireless communication device 110 may determine an appropriate security policy for the security service application 210 and may apply the determined security policy to the security element adapter 220. [ The wireless communication device 110 may delete the security element adapter 220 associated with the security service application 210 when the security service application 210 completes its operation and is terminated.

The virtual machine 230 can manage the operation of the security element adapter 220. The virtual machine 230 may be controlled by a processor (not shown in FIG. 2) included in the secure element 240. The processor is described in detail in FIG.

The virtual machine 230 may enforce the security policy on the plurality of security element adapters 230 and the security system call API. More specifically, the virtual machine 230 may force the plurality of security element adapters 230 to provide the security system call API to the security service application 210 according to the security policy applied to each.

In one embodiment, the virtual machine 230 can differentially determine a security policy based on the contents of the security service provided by the security service application 210. [ More specifically, the virtual machine 230 can determine a differential security policy according to the order of necessity of high security in the nature of the service. For example, the virtual machine 230 may set a different security policy in the order of applying the high security standard to the smart card solution service, the file transfer / storage service, the P2P relay communication service, the P2P direct communication service and the cloud network service order You can decide.

The virtual machine 230 may either provide the use of the security accelerator (not shown in FIG. 2) or provide access to the security partition of the memory (not shown in FIG. 2) according to the security policy . Here, the security accelerator and the memory will be described in detail in Fig.

The security element 240 may be responsible for the overall security processing of the wireless communication device 110. The security element 240 can provide an execution environment in which the virtual machine 230 can operate and can control the operation of the virtual machine 230. [ The security element 240 may provide an environment in which each security service application 210 operates through the virtual machine 230 and may provide a license for the security accelerator or a memory Can be controlled.

3 is a block diagram illustrating the security element of FIG.

The security element 240 may include a memory 310, a security accelerator 330, and a processor 350.

The memory 310 may be implemented as a flash memory, and may be divided into a plurality of security partitions. Here, the security partition may correspond to a portion of the memory 310, and may be restricted to be used for the provision of the security service in association with the specific security service application 210. Each of the security partitions that constitute the memory 310 may be associated with a particular security service application 210 under the control of the virtual machine 230 under the control of the security element 240.

The memory 310 may include an auxiliary storage device, which is implemented as a nonvolatile memory such as a solid state disk (SSD) or a hard disk drive (HDD), and is used to store data necessary for the wireless communication device 110, And a main memory implemented with a volatile memory such as a RAM (Random Access Memory). The memory 310 may be implemented independently of RAM or ROM (Read Only Memory).

The security accelerator 330 may provide a plurality of security algorithms. The security service application 210 can apply the security policy by the virtual machine 230 and can perform the service operation using the security algorithm by using the security accelerator 330 according to the applied security policy. The wireless communication device 110 may control the right of use of each security service application 210 through the virtual machine 230 to use the security accelerator 330. [

The processor 350 may execute the security service application 210 associated with the primary function of the wireless communication device 110 and may manage the memory 310 that is read or created throughout the process, The synchronization time between the volatile memory and the non-volatile memory can be scheduled. The processor 350 may control the overall operation of the wireless communication device 110 and may be electrically coupled to the memory 310 and the security accelerator 330 to control the data flow between them. The processor 350 may be implemented as a central processing unit (CPU) of the wireless communication device 130.

In one embodiment, the processor 350 configures one of the plurality of security element adapters 220 as a chip operating system for services related to a Smart Card, and sets the other as a service for remote file processing You can set it as a file operating system. Here, the chip operating system may correspond to the system software required to provide the smart card solution service through the wireless communication device 110, and the file operating system may provide the file transfer and storage service through the wireless communication device 110 This may be equivalent to the system software required to do so. The chip operating system and the file operating system can control the operation of the associated security service application 210 under the control of the virtual machine 230, respectively.

In one embodiment, the chip operating system may transmit a payment request through a security system call API used in a payment process of a smart card to a payment approval device as a cloud message, and store the payment request in a cloud server. More specifically, when the chip operating system receives a payment request signal based on the smart card information embedded in the wireless communication device 110, the chip operating system performs security processing of the payment request information through the security system call API and then transmits the payment request information through the cloud network as a cloud message It can be transferred to the payment approval device.

Here, the security processing by the chip operating system may correspond to a task for protecting the settlement request information by encrypting the settlement request information including the personal information by applying a security algorithm through the security system call API. In this case, according to the security policy enforced by the virtual machine 230, the chip operating system can transmit the secured payment request information as a cloud message to the payment approval device through the cloud network. The payment approval device can be connected to the wireless communication device 110 through the cloud network. If the payment approval device receives a payment request from the specific wireless communication device 110 during another operation, the payment approval device transmits a payment request in the order received by the cloud server 110 Can be stored. The payment approval device can process the payment request in the order stored in the cloud server.

In one embodiment, the chip operating system allows access to the secure partition for the smart card, which is one of the plurality of secure partitions via the secure accelerator 330, upon receipt of the approval of the payment request, It is possible to prevent access to the payment means in the secure partition for the smart card.

Since the smart card settlement service corresponds to a service requiring a high level of security, the chip operating system strictly restricts access to the secure partition for the smart card in which the settlement means is stored even in the security service application 210 providing the smart card settlement service Thereby enhancing security.

In one embodiment, the chip operating system may provide settlement information derived from the payment means and fully encrypted by the security accelerator 330 to the payment processing device. The chip operating system may encrypt the security information by applying a security algorithm having the most stringent security criteria through the security accelerator 330 to protect the payment information derived from the payment means. Finally, the encrypted payment information is provided to the payment processing apparatus, and the payment processing apparatus performs payment processing based on the payment information.

In one embodiment, the file operating system may directly generate a partially encrypted file through the security accelerator 330 by using the secure system call API in the process of directly transmitting a Peer To Peer (P2P) file, Encrypted files can be transferred.

In one embodiment, the file operating system may split the original file into a plurality of intercepts and generate a partially encrypted file by alternating the encrypted intercept with the original intercept. 5 is an exemplary diagram illustrating a process of generating a partially encrypted file in a file operating system. Referring to FIG. 5, the file operating system may divide the original file 510 into a plurality of segments 551 and 553. The file operating system may generate encrypted intercepts 553 by applying a security algorithm to the security accelerator 330 through some of the plurality of intercepts. The file operating system may generate the partially encrypted file 530 by alternating the original intercept 551 and the encrypted intercept 553.

In one embodiment, the file operating system may divide the original file into as many as the number of fragments generated by the following equation, and generate the partially encrypted file by alternating the original fragments with the encrypted fragments.

[Mathematical Expression]

Where k is the proportional constant, N is the number of intercepts to be split, P is the workload of the processor, F is the size of the original file, and S is the security level of the security policy. S can be normalized to a certain score according to the security level of the security policy, and the higher the security level, the higher the score.

The file operating system can divide the original file into more segments as the original file size increases, the workload of the processor decreases, and the security level of the security policy increases. The file operating system can encrypt some of the intercepts segmented by an appropriate number according to the above equation using a security algorithm and transmit the original file intact by generating a partially encrypted file by alternating the original intercept and the encrypted intercepts It is possible to enhance the security more than that.

In one embodiment, the file operating system may encrypt by applying a security algorithm across the original file. In addition, by encrypting only a part of the original file in consideration of the workload of the processor 350, the loss due to the load of the workload of the processor can be supplemented through security enhancement of the file. As a result, the file operating system can maintain the overall safety of file processing related services at a certain level.

In one embodiment, the processor 350 may configure another of the plurality of security element adapters 220 as a PTT operating system for a PTT (Push To Talk) service. Here, the PTT operating system may correspond to the system software necessary for providing the PTT service through the wireless communication device 110. [

In one embodiment, the PTT operating system intercepts the transmission of the direct P2P file by the file operating system through the security system call API used before the PTT transmission process, and prioritizes the transmission of the variably encrypted PTT message through the security accelerator 330 can do.

The PTT operating system can directly provide the PTT service independently of the P2P file transmission and can stop the transmission of the P2P file directly and can process the transmission of the PTT message in the intermediate process in which the P2P file is directly transmitted by the file operating system . The virtual machine 230 can determine the priority of operations as well as the operation between the security element adapters 220 and manage the operation of the security element adapter 220 according to the priority.

In one embodiment, the PTT operating system can generate a PTT message by applying variable encryption, performed with a different security algorithm, according to the workload of the processor 350 via the security accelerator 330. [ More specifically, the PTT operating system can monitor the work load of the processor 350 in real time, apply a security algorithm with a relatively low security standard when the workload of the processor 350 is high, When the load is small, the PTT service independent of the work load of the processor 350 can be provided by performing encryption by applying a security algorithm with a relatively high security standard.

4 is a flowchart illustrating a process of providing a smart card settlement service through a chip operating system according to an exemplary embodiment of the present invention.

Referring to FIG. 4, the wireless communication device 110 may set one of a plurality of security element adapters 220 through a processor 350 as a chip operating system for a service related to a smart card (step S410). The wireless communication device 110 may cause the chip operating system to transmit the settlement request to the settlement approval device through the security system call API used in the payment process of the smart card (step S430).

At this time, if the payment approval device receiving the payment request is processing another payment request, the payment request message may be stored in the cloud server. The payment request message stored in the cloud server may be processed by the payment approval device in order according to the storage order.

The wireless communication device 110 may allow the chip operating system to access the smart card security partition via the security accelerator 330 upon receipt of the approval of the payment request (step S470). The wireless communication device 110 may cause the chip operating system to derive from the payment means in the smart card security partition and provide the payment processing device with all of the payment information encrypted by the security accelerator 330 (step S490).

6 is a diagram illustrating a main function provided in a security enhanced wireless communication apparatus according to an embodiment of the present invention.

Referring to FIG. 6, the wireless communication device 660 can provide five types of security services. In order to provide each security service, the wireless communication device 660 includes a security service application 210 that performs operations for each security service independently . To the security service application 210 interworking with the security service application 220.

The wireless communication device 660 may generate the security element adapter 220 when the specific security service application 210 is executed and link the specific security service application 210 and the generated security element adapter 220 on a one- . The wireless communication device 660 may manage the operation of the security element adapter 220 through a virtual machine 230.

The security service provided by the wireless communication device 660 includes a smart card solution service 610, a cloud network service 620, a P2P direct communication service 630, a P2P relay communication service 640 And a file transfer / storage service 650 may be applicable. The wireless communication device 660 can determine an independent security policy for each security service, and can apply an independent security algorithm according to each security policy.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

100: Security-enhanced wireless communication system
110: wireless communication device
210: Security service application 220: Security element adapter
230: virtual machine 240: security element
310: memory 330: security accelerator
350: processor
510: original file 530: encrypted file
551: original intercept 553: encrypted intercept
660: Wireless communication device

Claims (8)

A memory separated into a plurality of secure partitions;
A security accelerator providing a plurality of security algorithms; And
A plurality of element adapters each of which provides a security system call API (Application Programming Interface) in cooperation with an independent security service application, and a plurality of security adapters for enforcing a security policy on the security system calling API, And a processor for controlling a virtual machine that provides usage rights of the security accelerator or provides access rights to the security partition.
2. The apparatus of claim 1, wherein the processor
Wherein one of the plurality of security element adapters is set as a chip operating system for a service related to a smart card and the other is set as a file operating system for a service related to remote file processing. Gt;
The system of claim 2, wherein the chip operating system
And transmits the settlement request to the settlement approval device in a cloud message through the security system call API used in the payment process of the smart card to store the settlement request in the cloud server. .
4. The system of claim 3, wherein the chip operating system
When the acceptance of the payment request is successfully received, access to the security partition for the smart card, which is one of the plurality of security partitions through the security accelerator, is allowed, and the security service application sends the payment request to the payment means in the secure partition for the smart card Wherein the wireless communication device is a wireless communication device.
5. The system of claim 4, wherein the chip operating system
And provides the payment processing apparatus with settlement information derived from the settlement means and completely encrypted by the security accelerator.
3. The system of claim 2, wherein the file operating system
A partially encrypted file is transmitted to a file receiving and storing device by using a security system call API in the process of directly transmitting a direct peer to peer (P2P) file, thereby generating a partially encrypted file through the security accelerator Wherein the wireless communication device is a wireless communication device.
7. The system of claim 6, wherein the file operating system
Wherein the original file is divided into a plurality of intercepts, and the partially encrypted file is generated by alternating the original intercept and the encrypted intercept.
2. The apparatus of claim 1, wherein the processor
Setting another one of the plurality of security element adapters as a PTT operating system for a PTT (Push To Talk) service,
The PTT operating system interrupts the transmission of the direct P2P file by the file operating system through the security system call API used before the transmission process of the PTT, and prioritizes the transmission of the variably encrypted PTT message through the security accelerator,
Wherein the variable encryption is performed with a different security algorithm according to the work load of the processor.

Images