KR100952484B1 - Security module of authentificating portable storages such as usb memory devices, portable hdd and method of operating the security module - Google Patents

Abstract

The present invention relates to a security module for authenticating a mobile storage medium such as a USB memory device and a mobile disk device, and a method of operating the security module. More particularly, when a mobile storage medium is connected to a computer terminal, the authentication information is received from a user. A security module for authenticating a connection of the mobile storage medium device, encrypting and transmitting data to an authenticated mobile storage medium device, or decrypting encrypted data transmitted from the mobile storage medium device, and a method of operating the security module. will be. According to the present invention, the authentication of a mobile storage medium such as a mobile storage medium or a record of transmission and reception with the mobile storage medium device can be managed by the server, thereby enabling the integrated use of a mobile storage medium device providing a security function.

Removable storage media, USB memory, authentication, computer terminal, network, intranet

Description

SECURITY MODULE OF AUTHENTIFICATING PORTABLE STORAGES SUCH AS USB MEMORY DEVICES, PORTABLE HDD AND METHOD OF OPERATING THE SECURITY MODULE}

The present invention relates to a security module for authenticating a mobile storage medium and a method of operating the security module. More particularly, when a mobile storage medium is connected to a computer terminal, the present invention provides authentication information from a user to access the mobile storage medium. A security module and a method of operating the security module for authenticating, encrypting and transmitting data to an authenticated mobile storage medium, or decrypting encrypted data transmitted from the mobile storage medium.

Today, users use mobile storage media to store data recorded on computer terminals. Such a mobile storage medium typically includes a USB (Universal Serial Bus) memory device, and a user may use the USB memory device to back up data recorded in a computer terminal or to store data recorded in the USB memory device to the computer terminal. I use it. In this case, the computer terminal loads a device driver corresponding to the USB memory device to the operating system and recognizes the USB memory device as one internal memory device, thereby enabling the data transmission and reception. Removable storage media including such USB memory devices can also back up important documents recorded on computer terminals. Therefore, the important document is likely to be leaked out through the mobile storage medium. In order to solve this problem, the technical idea of encrypting the data recorded in the computer terminal and transmitting the data to the mobile storage medium or decrypting the encrypted data recorded in the mobile storage medium in the computer terminal has emerged. Due to the lack of the integrated management of the encryption and decryption of the data, there is a problem that the general use of the mobile storage medium is difficult to be practical.

SUMMARY OF THE INVENTION The present invention has been made to improve the prior art as described above, and an object thereof is to enhance security of data recorded in a computer terminal by authenticating a mobile storage medium and encrypting data transmitted and received with the mobile storage medium. .

An object of the present invention is to enable the integrated use of a mobile storage medium providing a security function by managing the authentication of the mobile storage medium or the record of transmission and reception with the mobile storage medium at the server.

Another object of the present invention is to provide an enhanced security function by limiting the number of computer terminals to which a mobile storage medium is accessible.

It is still another object of the present invention to provide enhanced security by setting time information of data recorded on a mobile storage medium.

In order to achieve the above object and to solve the above-mentioned problems of the prior art, the operation method of the security module according to an embodiment of the present invention is a security module installed in a computer terminal for transmitting and receiving a predetermined data with a mobile storage medium; An operating method comprising: a first step of loading a device driver corresponding to the mobile storage medium into an operating system when the mobile storage medium is connected to the computer terminal; A second step of receiving authentication information for access to the mobile storage medium from a user; The authentication input from the user by comparing the authentication information received in the second step with the authentication information recorded in the storage area divided into the system level of the mobile storage medium or the authentication information recorded in the firmware of the mobile storage medium. A third step of determining validity of the information; And after the third step of authentication, requesting transmission of the encryption / decryption module to the mobile storage medium, receiving and installing the encryption / decryption module from the mobile storage medium, and encrypting predetermined data recorded in the computer terminal. And a fourth step of transmitting to the mobile storage medium or receiving and decoding predetermined data from the mobile storage medium.

In addition, the operating method of the mobile storage medium according to an embodiment of the present invention, when the mobile storage medium is connected to the computer terminal, transmitting the authentication information to the computer terminal through the firmware recorded on the mobile storage medium; Step 1, when the security module authenticates the access to the mobile storage medium, a second step of transmitting a data encryption / decryption module to the computer terminal, and recording or encrypting the encrypted data through the encryption / decryption module. And a fourth step of transmitting predetermined data to the encryption / decryption module.

A security module according to an embodiment of the present invention is a security module installed in a computer terminal for transmitting and receiving data to and from a mobile storage medium. When the mobile storage medium is connected to the computer terminal, the security module corresponds to the mobile storage medium. A connection setting unit which loads the device driver to be an operating system; Receive authentication information for access to the mobile storage medium from a user, authentication information recorded in the storage area divided into the authentication information and the system level of the mobile storage medium or authentication information recorded in the firmware of the mobile storage medium. A user authentication unit which compares with each other and determines validity of the authentication information input from the user; And requesting transmission of an encryption / decryption module to the mobile storage medium after the validity authentication, receiving and installing the encryption / decryption module from the mobile storage medium, encrypting predetermined data recorded in the computer terminal, and storing the movement. And a transmission / reception control unit for transmitting to a medium or receiving and decoding predetermined data from the mobile storage medium.

When the mobile storage medium according to an embodiment of the present invention is connected to the computer terminal, the authentication information providing unit for transmitting the authentication information to the computer terminal through the firmware recorded on the mobile storage medium, the security module in the mobile When access to a storage medium is authenticated, an encryption / decryption module transmission unit which transmits a data encryption / decryption module to the computer terminal, and records encrypted data through the encryption / decryption module, or encrypts predetermined data. Characterized in that the transmission and reception control unit for transmitting to the decoding module.

According to the present invention, it is possible to enhance the security of data recorded in a computer terminal by authenticating a mobile storage medium and encrypting data transmitted and received with the mobile storage medium.

According to the present invention, the authentication of the mobile storage medium or the record of transmission and reception with the mobile storage medium are managed by the server, thereby enabling the integrated use of the mobile storage medium providing the security function.

According to the present invention, it is possible to provide an enhanced security function by limiting the number of computer terminals accessible by the mobile storage medium.

According to the present invention, it is possible to provide an enhanced security function by limiting time information of data recorded on the mobile storage medium.

Hereinafter, a security module and a method of operating the security module according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating the interworking of a computer terminal for authenticating the use of a mobile storage medium and a communication security control server connected to the computer terminal through a wired or wireless communication network according to the present invention.

Referring to FIG. 1, when the USB memory device 100 is connected, the computer terminal 110 loads a device driver corresponding to the USB memory device 100 in an operating system. The computer terminal 110 maintains a predetermined security module, and the security module requests predetermined authentication information from the user through the display means of the computer terminal 110. The authentication information according to an embodiment of the present invention includes ID / password authentication information or public key infrastructure (PKI) authentication information, and the like. The user may input the authentication information through an input means such as a keyboard or a mouse. Enter it. Accordingly, the security module determines whether the first authentication information recorded in the firmware of the USB memory device 100 corresponds to the authentication information input from the user. As a result of determination, when the first authentication information and the authentication information correspond, the computer terminal 110 receives a predetermined encryption / decryption module from the USB memory device 100. The computer terminal 110 installs the received encryption / decryption module, encrypts data recorded in a storage means such as a hard disk through the encryption / decryption module, and transmits the encrypted data to the USB memory device 100 or a USB memory device ( The encrypted data recorded in 100 may be decrypted to read the data.

The computer terminal 110 according to an embodiment of the present invention may be connected to the communication security control server 120 through a wired or wireless communication network.

When the computer terminal 110 receives a data transfer command from the user to the USB memory device 100 after authentication of the USB memory device 100, the computer terminal 110 communicates with the communication security control server 120 to provide predetermined groupware or predetermined electronic payment. Perform the payment procedure through software. That is, the computer terminal 110 may be implemented to drive the groupware or the electronic payment software and to store the corresponding data in the USB memory after completing the payment procedure through the groupware.

When the computer terminal 110 transmits and receives encrypted data after authentication with the USB memory device 100, the computer terminal 110 transmits the transmission / reception information of the data as the log information to the communication security control server 120. Can be. The communication security control server 120 records the log information in a predetermined database and, if necessary, provides the authenticated administrator to perform a security check on what data has been transferred to the USB memory device in the company or the group. Can be implemented. The log information may include user affiliation information, computer terminal information, external memory information, file name, file size information, and last modified date information of the corresponding data.

The computer terminal 110 according to an embodiment of the present invention may download the security module from the communication security control server 120 in advance or may be divided into the system level of the USB memory device 100 after the USB memory device 100 is connected. You can download from the storage area.

2 is a flowchart illustrating a method of operating a security module and a mobile storage medium installed in a computer terminal according to an embodiment of the present invention.

Referring to FIG. 2, when the mobile storage medium is connected, the computer terminal loads a device driver corresponding to the mobile storage medium to the operating system in step 201. In general, a computer terminal maintains one or more device drivers for performing wired and wireless short-range communication with the external device in order to interwork with one or more external devices. Accordingly, the computer terminal requests a user for authentication information for access to the mobile storage medium.

The authentication information for access may include ID / password authentication information or public key infrastructure (PKI) authentication information, and the user may request ID / password authentication information, public key or personal at the request of the computer terminal. Enter authentication information such as a key. In step 202, the security module of the computer terminal receives the authentication information from the user, and determines whether it corresponds to the authentication information recorded in the storage area divided into the system level of the mobile storage medium (step 203). . If the authentication information received from the user is valid, the security module of the computer terminal requests transmission of an encryption / decryption module to a mobile storage medium, and the mobile storage medium transmits the encryption / decryption module to the security module through a USB communication port. Send it.

The security module that receives the encryption / decryption module from the mobile storage medium controls data transmission / reception with the mobile storage medium according to the encryption / decryption module (step 205). That is, when data recorded in the storage means of the computer terminal is transmitted to the external memory, the security module encrypts the data through the encryption / decryption module and transmits the data to the mobile storage medium.

In addition, in order to receive the encrypted data recorded on the mobile storage medium, the security module may decrypt the encrypted data through the encryption and decryption module and record the encrypted data in the storage means of the computer terminal.

The security module according to an embodiment of the present invention, in step 201, may receive group information of a computer terminal to which the mobile storage medium is accessible from the mobile storage medium. For example, the mobile storage medium records a serial number of an operating system (OS) capable of uniquely identifying the computer terminal or MAC address according to Ethernet communication as group information of the accessible computer terminal.

Thus, in step 203, the security module further determines whether the serial number or the MAC address received from the mobile storage medium corresponds to the computer terminal. That is, the security module may transmit and receive data with the computer terminal selected according to the group information of the computer terminal. In addition, when the security module according to an embodiment of the present invention encrypts and transmits the data to the mobile storage medium through the encryption module in step 205, the time information corresponding to the data is stored in the mobile storage. Can write on the medium.

Therefore, the security module installed in another second computer terminal connected to the mobile storage medium checks the time information of the data recorded on the mobile storage medium, and if the time information exceeds a predetermined period, the data Delete it. Therefore, the valid period of the data recorded on the mobile storage medium can be set.

The security module according to an embodiment of the present invention interworks with a predetermined communication security control server through a wired or wireless communication network. When the mobile storage medium is authenticated, the security module receives a predetermined data transmission command from a user and encrypts the data through an encryption module. Accordingly, the security module drives the groupware or the electronic payment software and communicates with the communication security control server to perform a payment procedure through the predetermined groupware or the predetermined electronic payment software. That is, the security module installed in the computer terminal may be implemented to drive the groupware or the electronic payment software, and to store the corresponding data in the USB memory after completing the payment procedure through the groupware.

When the payment related to the USB memory transfer for the data is completed according to the payment procedure, the security module transmits the encrypted data to the mobile storage medium. In addition, the security module may transmit log information about the data transmitted to the mobile storage medium and the data received from the mobile storage medium to the communication security control server through the wired / wireless communication network. If the mobile storage medium includes a security module and transmits and receives data with a second computer terminal that is not connected to the communication security control server through a wired or wireless communication network, the log information may be recorded in the mobile storage medium. .

Thereafter, when the mobile storage medium is connected to a predetermined computer terminal connected to the communication security control server, the mobile storage medium transmits the log information to the communication security control server through the computer terminal.

In addition, when a user instructs uninstall of the security module installed in the computer terminal, the security module may be implemented to report the command to the communication security control server. For example, when the communication security control server does not perform the authentication process for the reporting, the computer terminal stops the uninstall process according to the uninstall command for the security module. Therefore, only an authenticated user can perform the uninstall process of the security module.

The security module according to another embodiment of the present invention transmits the transmission / reception information of the data to the security control server when the selected character string is included in the file name or file content of the data transmitted / received with the mobile storage medium. For example, the user may set a string of 'confidential' through input means such as a keyboard or a mouse of the computer terminal in advance.

Therefore, when the computer terminal is to transmit the data of the file name or the file content including the 'confidential' character string among the data recorded in the storage means to the mobile storage medium, the security module informs the communication security control server To send. In this way, the predetermined administrator can prevent the situation where important documents classified as confidential in the company or the like are transferred to the USB memory and leaked to the outside.

3 is a block diagram illustrating an internal configuration of a security module and a mobile storage medium according to an embodiment of the present invention.

Referring to FIG. 3, a security module 300 installed in a computer terminal according to an embodiment of the present invention includes a connection setting unit 301, a user authentication unit 302, and a transmission / reception control unit 303.

In addition, the mobile storage medium 310 according to an embodiment of the present invention includes an authentication information providing unit 311, an encryption / decryption module transmission unit 312, a transmission and reception control unit 313, and a storage unit 314.

When the mobile storage medium 310 is connected to the communication port of the computer terminal, the security module 300 loads a device driver corresponding to the mobile storage medium 310 to the operating system through the connection setting unit 301.

The user authentication unit 302 receives authentication information for accessing the mobile storage medium 310 from the user, and determines the validity of the authentication information input from the user. That is, when the device driver is loaded in the operating system, the user authentication unit 302 requests the authentication information from the user through the output means of the computer terminal, and collects the authentication information from the user.

The authentication information includes ID / password authentication information or public key infrastructure (PKI) authentication information, and the user inputs authentication information into a computer terminal according to the type of authentication information.

Therefore, the user authentication unit 302 collects the authentication information recorded in the storage means 314 of the mobile storage medium 310 through the authentication information providing unit 311, and whether the correspondence with the authentication information collected from the user Judge. If the authentication information collected from the user is valid, the connection setting unit 301 requests the encryption / decryption module to the encryption / decryption module transmission unit 312 of the mobile storage medium 310.

The transmission / reception control unit 303 encrypts predetermined data recorded in the storage unit 304 of the computer terminal through the encryption / decryption module and transmits the encrypted data to the transmission / reception control unit 313 of the mobile storage medium 310 or the transmission / reception control unit 313 Receive and decrypt the encrypted data. For example, when the security module 300 receives a data transmission command from the mobile storage medium 310, the security module 300 receives a predetermined authority from the communication security control server through the transmission / reception control unit 303.

Accordingly, the security module 300 may selectively grant a right to copy, move, read, write, save, or delete to the user who inputs the transmission command. The communication security control server may use the ID / password authentication information or public key infrastructure (PKI) authentication information to identify the user.

The mobile storage medium 310 according to an embodiment of the present invention may be a USB memory device that transmits and receives data through universal serial bus (USB) communication. Thus, the computer terminal has a USB communication port according to the USB communication, and maintains a device driver for the USB communication port.

Thus, the security module and the mobile storage medium according to the present invention can not only enhance the security of data recorded in the computer terminal, but also manage the authentication of the mobile storage medium or the data transmission / reception records of the mobile storage medium and the computer terminal in the server. It can enable integrated use of mobile storage media that provide security functions.

4 is an internal block diagram of a general purpose computer device that may be employed to perform the method of operating a security module and the method of operating a mobile storage medium in accordance with the present invention.

Embodiments of the present invention include computer readable media including program instructions for performing various computer implemented operations. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical recording media such as CD-ROMs, DVDs, magnetic-optical media such as floppy disks, and ROM, RAM, flash memory, and the like. Hardware devices specifically configured to store and execute program instructions are included.

The medium may be a transmission medium such as an optical or metal line, a wave guide, or the like, including a carrier wave for transmitting a signal designating a program command, a data structure, or the like. Examples of program instructions include machine code, such as produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter.

Computer device 400 includes one or more processors 410 connected to a main memory including random access memory (RAM) 420 and read only memory (ROM) 430. The processor 410 is also called a central processing unit (CPU). As is well known in the art, the ROM 430 serves to transfer data and instructions to the CPU unidirectionally, and the RAM 420 typically transfers data and instructions bidirectionally. Used to.

The RAM 420 and the ROM 430 may include any suitable form of computer readable media. Mass storage 440 is bi-directionally coupled to processor 410 to provide additional data storage capabilities, and may be any of the computer readable recording media described above. The mass storage device 440 is used to store programs, data, and the like, and is a secondary memory device such as a hard disk which is generally slower than the main memory device. Certain mass storage devices such as CD ROM 460 may be used.

The processor 410 may include one or more input / output devices, such as a video monitor, trackball, mouse, keyboard, microphone, touchscreen display, card reader, magnetic or paper tape reader, voice or handwriting reader, joystick, or other known computer input / output device. Is connected to the interface 450. Finally, the processor 410 may be connected to a wired or wireless communication network through the network interface 470. Through this network connection, the procedure of the method described above can be performed. The apparatus and tools described above are well known to those skilled in the computer hardware and software arts.

While specific embodiments of the present invention have been described so far, various modifications are possible without departing from the scope of the present invention.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

1 is a diagram illustrating the interworking of a computer terminal for authenticating the use of an external memory device according to the present invention and a communication security control server connected to the computer terminal through a wired / wireless communication network.

2 is a flowchart illustrating a method of operating a security module and a mobile storage medium installed in a computer terminal according to an embodiment of the present invention.

3 is a block diagram illustrating an internal configuration of a security module and a mobile storage medium according to an embodiment of the present invention.

4 is an internal block diagram of a general purpose computer device that may be employed to perform the method of operating a security module and the method of operating a mobile storage medium in accordance with the present invention.

<Explanation of symbols for the main parts of the drawings>

300: security module 301: connection setting unit

302: user authentication unit 303: transmission and reception control unit

304: storage means 310: mobile storage medium

311: authentication information provider 312: encryption and decryption module transmission unit

313: transmission and reception control unit 314: storage means

Claims (10)

In the operating method of the security module installed in the computer terminal for transmitting and receiving a predetermined data with a mobile storage medium, When the mobile storage medium is connected to the computer terminal, loading a device driver corresponding to the mobile storage medium into an operating system; A second step of receiving authentication information for access to the mobile storage medium from a user; The authentication information input from the user by comparing the authentication information received in the second step and the authentication information recorded in the storage area divided into the system level of the mobile storage medium or the authentication information recorded in the firmware of the mobile storage medium, respectively. A third step of determining validity of the information; And After the authentication of the third step, requesting transmission of the encryption / decryption module to the mobile storage medium, receiving and installing the encryption / decryption module from the mobile storage medium, encrypting predetermined data recorded in the computer terminal, and And transmitting the data to a mobile storage medium, or receiving and decrypting predetermined data from the mobile storage medium. The method of claim 1, The security module receives the group information of the accessible computer terminal from the mobile storage medium in the first step, The computer terminal further determines whether the computer terminal is included in the group information in the third step. The method of claim 1, The computer terminal is interlocked with a predetermined communication security control server through a predetermined wired or wireless communication network, And when the user commands the uninstall of the security module, reporting the command to the communication security control server. The method of claim 1, The computer terminal interworks with a predetermined communication security control server through a predetermined wired / wireless communication network, and in the fourth step, when the computer terminal encrypts and transmits the data to the mobile storage medium, the predetermined groupware or predetermined electronics are transmitted. Operating a payment software and transmitting the data to the mobile storage medium after a predetermined payment procedure. The method of claim 1, The fourth step further comprises the step of transmitting the data transmission log information from the computer terminal to a communication security control server connected to a predetermined wired or wireless communication network. The method of claim 1, In the fourth step, When the data is transmitted to the mobile storage medium, the transmission time information of the data is recorded on the mobile storage medium, And when the transmission time information exceeds a predetermined period, the security module deletes the data recorded on the mobile storage medium. The method of claim 1, The computer terminal is interlocked with a predetermined communication security control server through a predetermined wired or wireless communication network, In the fourth step, if a selected character string is included in the file name or file content of the data to be transmitted and received, the method of operating the security module, characterized in that for transmitting and receiving information of the data to the communication security control server. delete A security module installed in a computer terminal for transmitting and receiving data with a mobile storage medium, A connection setting unit configured to load a device driver corresponding to the mobile storage medium into an operating system when the mobile storage medium is connected to the computer terminal; Receive authentication information for access to the mobile storage medium from a user, authentication information recorded in the storage area divided into the authentication information and the system level of the mobile storage medium or authentication information recorded in the firmware of the mobile storage medium. A user authentication unit which determines a validity of the authentication information inputted from the user by comparing the two; And After the validity authentication, requesting transmission of the encryption / decryption module to the mobile storage medium, receiving and installing the encryption / decryption module from the mobile storage medium, encrypting predetermined data recorded in the computer terminal, and encrypting the mobile storage medium. And a transmission / reception control unit for transmitting to or receiving and decrypting predetermined data from the mobile storage medium. delete

Images