KR100678927B1 - How to assign a security zone to an insecure zone and a portable storage device providing the same - Google Patents

Abstract

The present invention relates to a portable storage device, and more particularly, to a method for extending the security area of a portable storage device and a portable storage device providing the same.

According to an embodiment of the present invention, there is provided a method of allocating a secure area to a non-secure area of a portable storage device. Transmitting the data to the host device, receiving the location information and the data to be stored in the secure area from the security application of the host device, and encrypting and storing the data in the non-secure area using the location information. Include.

Secure Multimedia Card (Secure MMC), Secure Area, Authentication, Encryption

Description

How to assign a security zone to an insecure zone and a portable storage device for providing the same

1 is a block diagram showing the configuration of a conventional portable storage device.

2 is a block diagram of a portable storage device having an unsecured area including a secured area according to an embodiment of the present invention.

FIG. 3 is an exemplary diagram illustrating another method of storing data of a secure area in the portable storage device of FIG. 2.

4 is a structure of a mapping table existing in a portable storage device according to an embodiment of the present invention.

5 is an exemplary view illustrating a process of preventing access to an unauthorized security area according to an embodiment of the present invention.

6 is a block diagram of a portable storage device according to an embodiment of the present invention.

7 is a flowchart illustrating a process of storing or accessing data of a portable storage device according to an embodiment of the present invention.

8 is a flowchart illustrating a process of storing or accessing data of a portable storage device according to another embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: portable storage device 200: system area

300: read-only security zone 400: non-secure zone

311, 312, 313: read / write secure zone

500: security application 900: host device

TECHNICAL FIELD The present invention relates to portable storage devices, and more particularly, to a method of expanding a secure area of a portable storage device and a portable storage device providing the same.

Portable storage devices are removable and attachable devices that can store and move data from various digital devices such as mobile phones, computers, and digital cameras, and are composed of storage space for storing data and operations and controls. MMC (MultiMedia Card), which is one of such portable storage devices, plays a role of storing multimedia data for use in various types of digital devices, beyond the limitations of conventional hard disks and compact disks. In addition, the card has an operation unit that does not exist in a conventional storage medium, and in addition to simply storing data, functions such as control, encryption, and authentication are possible. As a result, it is suitable for accommodating a large amount of various multimedia data. Recently, a security multimedia card (SecureMMC) capable of security and copyright protection and storage of digital contents by adding a security function to the multimedia card has been developed, thereby enabling the protection of digital contents. The introduction of Digital Rights Management (DRM) for digital content requires the need for security and encryption of Right Objects, and the need for portable storage devices that provide both security and encryption. It became. Hereinafter, digital devices such as portable storage devices, digital cameras, mobile phones, computers, and digital camcorders will be collectively referred to as host devices.

In addition to the ability to store data, portable storage devices also have security zones to protect the data and to prevent unauthorized users or applications from accessing or changing the data.

1 is a block diagram showing the configuration of a conventional portable storage device. The portable storage device 10 is divided into a system area 20, a security area 30, and a non-security area 40. The system area 20 is a space for storing system information, version information, and the like stored in the portable storage device 10. The secure area 30 is formatted as a separate file system, and the non-secure area 40 is formatted as a general file system.

In the related art, since the security area has a fixed size, the size of the security area cannot be changed. As a result, even if the amount of security data to be stored in the security area increases, it cannot be stored in the security area. To overcome the limitations of fixed-size security zones, there has been a way to change the size of the security zone through the format. This separates the storage of the portable storage device into secure and non-secure areas. When the security zone is formatted with a special file system to provide security functions, the non-secure zone is formatted with a general file system such as FAT16 (File Allocation Table) or NTFS (New Technology File System). Reformatting.

However, this method requires formatting before changing the size of the area, and thus requires a process of copying or moving data back to the portable storage device after the data is backed up and formatted.

Accordingly, there is a need for a method of expanding a secure area without backing up data and a portable storage device providing the same.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to easily expand the security area of a portable storage device.

Another object of the present invention is to allocate a security zone within the non-security zone to protect data in the security zone, while not being limited to the size of the security zone.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

The present invention relates to a portable storage device, and more particularly, to a method for extending the security area of a portable storage device and a portable storage device providing the same.

According to an embodiment of the present invention, there is provided a method of allocating a secure area to a non-secure area of a portable storage device. Transmitting the data to the host device, receiving the location information and the data to be stored in the secure area from the security application of the host device, and encrypting and storing the data in the non-secure area using the location information. Include.

According to another aspect of the present invention, there is provided a method of allocating a secure area to a non-secure area of a portable storage device, the method comprising: receiving data to be stored in the secure area from a security application of a host device, and storing the secure area within the non-secure area. Encrypting and storing the data, and transmitting the stored result to the host.

According to an embodiment of the present invention, a portable storage device for allocating a secure area to a non-secure area includes a storage including a non-secure area and a secure area, a transmitter for transmitting location information of the secure area to the host device, and And a receiving unit for receiving the location information and data to be stored in the secure area from a host device, and a security application for encrypting and storing the data in the storage unit using the location information.

According to another aspect of the present invention, there is provided a portable storage device which allocates a secure area to a non-secure area, including a storage including a non-secure area and a secure area, a receiving unit receiving data to be stored in the secure area from the host device, And a security application that secures a space of a security area necessary for storage in the storage unit, encrypts and stores the data, and a transmission unit that transmits a result of storing the data to the host.

Specific details of other embodiments are included in the detailed description and the drawings.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Hereinafter, the present invention will be described with reference to a block diagram or a flowchart illustrating a method of allocating a security area to an insecure area and a portable storage device providing the same according to embodiments of the present invention. At this point, it will be understood that each block of the flowchart illustrations and combinations of flowchart illustrations may be performed by computer program instructions. Since these computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, those instructions executed through the processor of the computer or other programmable data processing equipment are described in flow chart block (s). It will create a means to perform the specified functions. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in the flowchart block (s). Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions for performing the processing equipment may also provide steps for performing the functions described in the flowchart block (s).

In addition, each block may represent a portion of a module, segment, or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative implementations, the functions noted in the blocks may occur out of order. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending on the functionality involved.

2 is a block diagram of a portable storage device having an unsecured area including a secured area according to an embodiment of the present invention. And a portable storage device 100 and a host device 900. The host device 900 is one of a laptop, a mobile phone, a PDA, an mp3 player, and the like, and communicates with the portable storage device 100 through the security application 950. The portable storage device 500 includes a security application 500, a system area 200, a read-only security area 300, and a non-security area 400. As described above, the system area 200 is a space for storing information about the system. The read-only secure area 300 is an area accessible only to a portable storage device and an authenticated application, and typically stores data related to security before the portable storage device is manufactured or before sale. And you cannot change or delete it.

The non-secure area 400 is an area in which data can be freely stored and read. In addition, there are secure areas 311, 312, and 313 that can be read and written in the non-secure area 400. Therefore, a security area may be generated and stored in the non-security area 400 through the security application 500, and data of the area may be read through the security application 500.

As illustrated in FIG. 2, the operation performed to store and read secure data in the non-secure area 400 is as follows. First, in step S11, the host 900 secures a space according to a mechanism of a file system in the non-secure area 400 of the portable storage device 100 through the security application 950. This operation is the same as storing data in ordinary FAT16 / 32. The space reserved here becomes a read / write secure area. And the address value for the secured area is received (S12).

The security application 950 of the host 900 transfers the received address value and data to be stored in the security area to the security application 500 of the portable storage device 100 (S13). In this case, the security application 500 of the portable storage device 100 may have a table that maps an address value for a security area existing in the non-security area to a relative address value that can be understood by the user. The security application 500 stores data at the corresponding address (S14). At this time, the information to be stored is stored after being protected using a protection technique such as encryption.

Data stored in the secure area secured in the non-secure area through the processes S11 to S14 may be read, deleted, or updated through the secure application 500.

The security application 950 of the host device 900 transmits a read, update, or delete command for data stored in the secure area. The identifier of the data is transmitted together, and when the security application 500 of the portable storage device 100 is an application that passes the normal authentication process, the data identifier is stored. The security zone 312 is accessed to read data, update data, or delete data. At this time, since the stored data is encrypted, when the data is read, the data is decrypted and transmitted to the host device 900.

FIG. 3 is an exemplary diagram illustrating another method of storing data of a secure area in the portable storage device of FIG. 2. The security area is created in the non-secure area and the data is stored in the same manner. Unlike the case of FIG. 2, however, the host device 900 transmits data and information indicating that the data is stored in the secure area to the portable storage device 100 (S21). The portable storage device finds a space 312 in which the data can be stored in the non-secure area and stores the data (S22). To store data in a secure area, it goes through an encryption process. In operation S23, the host device 900 notifies that data is stored in the secure area.

The data stored in the secure area secured in the non-secure area through the process S21 to S23 may be read, deleted, or updated through the secure application 500.

In the case of inputting and outputting data in the security area described with reference to FIGS. 2 and 3, an encryption scheme promised between the security application 950 in the host device and the security application 500 in the portable storage device for the security of data transmitted to and from the command or The encrypted data or command may be transmitted and received through the encryption key.

4 is a structure of a mapping table existing in a portable storage device according to an embodiment of the present invention. The mapping table 510 includes data identifiers, hashing values of file locations, file locations, and the like. The data identifier is required when the host device accesses data stored in the secure area through the data identifier. When a specific application of the host device transmits a data identifier, the security application checks whether the specific application is an authorized valid application. After confirming the authentication, the storage location of the data indicated by the data identifier may be extracted through the file location item, and the extracted location information may be used to access the data in the secure area in the non-secure area. Of course, since the data is encrypted and stored, a decryption process is required to access the data in the secure area and transmit the data to the host device. The information about the file location is not accessible from the outside, and when the data is stored in the secure area, the data is encrypted and stored so that the data can be secured even when the data in the secure area is forcibly accessed from the outside.

The same applies to sending hashing values rather than file identifiers. The hashing value prevents the host device from knowing the physical location where the data is stored, providing the ability to prevent direct access. In the example of FIG. 2, the location information delivered to the security application 950 of the host device 900 may use a hashed value. In this case, in operation S13, the security application 950 of the host device 900 transmits the hashed value and the data to be stored, and the security application 500 of the portable storage device 100 corresponds to the hashed value in the mapping table. You can get location information.

5 is an exemplary view illustrating a process of preventing access to an unauthorized security area according to an embodiment of the present invention. The non-secure application 990 wants to access data in the secure area without authentication. At this time, the access method is a method of accessing the security area in the non-security area at random or extracting location information. In this case, even when attempting to access the data in the security area 311 through the location information, since the data stored in the security area 311 is encrypted data, the non-secure application 990 cannot read the data. As a result, the non-secure application 990 cannot access the data stored in the secure area 311 in the non-secure area.

On the contrary, when the secure application 950 attempts to access the non-secure area through the data identifier received through the secure application 500 in the portable storage device, the location is not known. Not accessible It is possible through the secure application 500 of the portable storage device 100 to know the location stored through the hashed value or through the data identifier, which is a non-secure application 990 of the secure application 500 of the portable storage device 100. Communication is impossible. Therefore, you cannot access the data in the security zone.

6 is a block diagram of a portable storage device according to an embodiment of the present invention. As used herein, the term 'unit', that is, 'module' or 'table' or the like, refers to a hardware component such as software, a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC). The module performs some functions. However, modules are not meant to be limited to software or hardware. The module may be configured to be in an addressable storage medium and may be configured to play one or more processors. Thus, as an example, a module may include components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, procedures, subroutines. , Segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables. The functionality provided within the components and modules may be combined into a smaller number of components and modules or further separated into additional components and modules. In addition, the components and modules may be implemented to reproduce one or more CPUs in a device.

The portable storage device 100 includes a receiver 141 and a transmitter 142 for transmitting and receiving data with the host device. The storage unit 410 is a space for storing data. Data may be stored in the non-secure area and the secure area, respectively, and the data to be stored in the secure area is encrypted and stored as described with reference to FIGS. 2 and 3. Since the data of the non-security area and the data of the security area are stored together, the storage unit 410 stores the data encrypted through the security application 500 in the security area. The security application 500 stores data that needs to be stored in the secure area in the storage unit 410 and controls access to these data. The security application 500 may maintain security by using the mapping table illustrated by way of example in FIG. 4, and also encrypt and store data to exclude access of unauthorized data.

The security application 500 may perform authentication with the host device 900 by itself, and may perform operations related to authentication using authentication, encryption, and decryption functions provided by the authentication unit 160. The authentication unit 160 provides a function for encryption and decryption by a symmetric key algorithm or an asymmetric key algorithm, and generates a session key. The function provided by the authenticator 160 performs a process of identifying and authenticating the host device 900 when the security application 500 is coupled with the host device 900 through wire or wirelessly. In addition, the security application 950 and the security application 500 of the portable storage device 500 in the host device 900 may be authenticated to transmit and receive data through a channel that is secured with each other, or in a secured manner. It provides encryption and decryption functions.

The secure area storage unit 300 may optionally include. As described above with reference to FIGS. 2 and 3, when the portable storage device locates the secure area in a storage space within the non-secure area, read-only data may be independently stored in the secure area storage unit 300. In addition, some of the data in the secure area that can be read and written uses the secure area storage unit 300, and when there is no more space in the secure area storage unit 300, the data is stored in the non-secure area of the storage unit 410. The space can be reserved and used as a security area. For example, the security zone storage unit 300 is set to a space of 50Mbytes, the storage unit 41 is set to a space of 500Mbytes, and the security zone storage unit 300 is a read-only security zone and can read and write. Security zones can coexist. In this case, when the secure area storage unit 300 no longer has a space for storing data, the secure area storage unit 300 may secure the secure area in the storage unit 410 to store the data.

The ratio or how to provide the non-security area and the security area may vary depending on implementation, and is not limited to the embodiments presented herein.

7 is a flowchart illustrating a process of storing or accessing data of a portable storage device according to an embodiment of the present invention. 7 is an embodiment for implementing the method described in FIG. A command is received from the host device (S101). If the command is not a command for the secure area (S103), the request for the non-secure area is processed and terminated (S105). If the received command is a command for requesting to secure a space for storing data in the secure area (S108), the secure application searches for the location information of the secure area for storing data of the corresponding size in the non-secure area (S111). The location information is hashed or stored in a mapping table (S112). This is to prevent direct access to the location from unauthorized outside. The hashed position information or information for finding the position information of the security area in the mapping table is transmitted to the host device (S113).

If it is not a command including size information for storing data, it is determined whether the command is a data access request in step S120. When the command is not an access request, the host device receiving the location information in step S113 transmits the location information and data to be stored in the location information together. Therefore, the received data is encrypted (S121). The encrypted data is then stored in the area indicated by the received location information (S122). The location information of the actual security area can be obtained from the received location information using a hashing table or a mapping table.

In the case of the command for requesting data access in operation S120, decryption, which is a necessary operation for data access to the secure area, is performed. First, data of an area indicated by location information is extracted (S125). In this case, since the location information may be location information changed by the hashing table or the mapping table, the location information of the actual security area may be obtained using the hashing table and the mapping table. The data of the corresponding position is decoded (S126). Then, the requested command is performed on the data (S127).

You can add an authentication process to store or access data in the security zone. The authentication process is possible through a secure application in the host device.

8 is a flowchart illustrating a process of storing or accessing data of a portable storage device according to another embodiment of the present invention. 8 is an embodiment for implementing the scheme described in FIG. A command is received from the host device (S151). If the command is not a command for the secure area (S153), the request for the non-secure area is processed and terminated (S155). If the received command is a command for storing data in the secure area (S158), the secure application secures a space of the secure area in the non-secure area to store data (S161). The data is encrypted and stored (S162). The stored result is transmitted to the host device (S163). In this case, the stored result may include location information of an area in which data is stored. When the location information is transmitted together, the location information may be converted through a hashing function or a mapping table. This is to prevent access to the location directly from unauthorized applications.

If it is not the command to store the data in step S158 performs the operation to access the data. Data can be accessed using information about the data to be accessed. When the information about the data includes the location information, the data of the area indicated by the location information is extracted (S171). In this case, when the location information is converted through the hashing function or the mapping table as described above, the security area may be accessed using the original location information before the conversion. Meanwhile, when the information on the data to be accessed is a data identifier rather than the location information, the location information may be identified using the mapping table illustrated in FIG. 4. The data of the corresponding position is decoded (S172). The requested command is performed on the decoded data (S173).

You can add an authentication process to store or access data in the security zone. The authentication process is possible through a secure application in the host device.

Those skilled in the art will appreciate that the present invention can be embodied in other specific forms without changing the technical spirit or essential features of the present invention. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is indicated by the scope of the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and the equivalent concept are included in the scope of the present invention. Should be interpreted.

By implementing the present invention, it is possible to easily extend the security area of the portable storage device.

By implementing the present invention, it is possible to store data requiring security in an insecure area, and to prevent unauthorized access to the data.

Claims (23)

Allocating a secure area within the non-secure area for storing data to be received; Transmitting location information of the secure area allocated in the non-secure area to a host device; Receiving data to be stored in the location information and the secure area from a security application of the host device; And Encrypting and storing the data in the non-secure area using the location information. The method of claim 1, The allocating may include receiving information on the size of the data from the host device; And Allocating a secure area within the non-secure area in which the data of the size can be stored. The method of claim 1, And further modifying the location information using a hashing or mapping table. The method of claim 1, And authenticating with the secure application of the host device. The method of claim 1, Receiving an access request for the data from the security application of the host device; Extracting and decrypting the data from a secure area within the non-secure area; And And transmitting the decrypted data to the host device. The method of claim 5, The step of transmitting the decoded data to the host device Encrypting the decrypted data by a predetermined encryption scheme promised with the security application of the host device; And And transmitting the encrypted data to the host device. Receiving data to be stored in the secure area from the secure application of the host device; Encrypting and storing the data by securing a secure area for storing the data within an unsecured area; And And transmitting the stored result to the host. The method of claim 7, wherein And the result of the storing includes location information of the secure area in which the data is stored in the non-secure area. The method of claim 8, And modifying location information of the secure area using a hashing or mapping table. The method of claim 7, wherein And authenticating with the secure application of the host device. The method of claim 7, wherein Receiving an access request for the data from the security application of the host device; Extracting and decrypting the data from a secure area within the non-secure area; And And transmitting the decrypted data to the host device. The method of claim 11, The step of transmitting the decoded data to the host device Encrypting the decrypted data by a predetermined encryption scheme promised with the security application of the host device; And And transmitting the encrypted data to the host device. A storage unit including an insecure area and a secure area; A transmitter for transmitting location information of a security area of the storage unit to the host device; A receiving unit which receives the location information and data to be stored in the secure area from the host device; And And a security application for encrypting and storing the data in the storage unit by using the location information. The method of claim 13, And the security application assigns a security zone to an unsecured zone that modifies the location information using a hashing or mapping table. The method of claim 13, And the secure application assigns a secure area to the non-secure area that authenticates with the host device. The method of claim 13, The receiving unit receives an access request for the data from the security application of the host device, The security application extracts and decrypts the data from the security area in the storage unit, And the transmitting unit allocates the secure area to the non-secure area for transmitting the decrypted data to the host device. The method of claim 16, The security application encrypts the decrypted data by a predetermined encryption scheme promised with the host device. And the transmitting unit allocates the secure area to the non-secure area for transmitting the encrypted data to the host device. A storage unit including an insecure area and a secure area; A receiver which receives data to be stored in a secure area of the storage unit from a host device; A security application that secures a space of a security area necessary for storing the data in the storage unit, and encrypts and stores the data; And And a transmitting unit for transmitting a result of storing the data to the host, in the storage unit. The method of claim 18, And the result of the storing includes location information of the secure area in which the data is stored in the non-secure area. The method of claim 19, And the security application assigns a security zone to an unsecured zone that modifies the location information using a hashing or mapping table. The method of claim 18, And the secure application assigns a secure area to the non-secure area that authenticates with the host device. The method of claim 18, The receiving unit receives an access request for the data from the host device, The security application extracts and decrypts the data from a security area within the storage unit. And the transmitting unit allocates the secure area to the non-secure area for transmitting the decrypted data to the host device. The method of claim 22, And the secure application allocates the secure area to the non-secure area, which encrypts the decrypted data by a predetermined encryption scheme promised with the host device.

Images