KR102007929B1 - Portable Device For Security Information Management And Operating Method thereof - Google Patents

Abstract

The present invention relates to security data management, and more particularly, a secure memory area provided in a control unit to store secure data according to a preset setting, a secure area provided by assigning a separate area to a storage unit independent of the control unit, and the secure memory area. And an input unit for generating an input signal instructing to write or read the security data to a security area, and a configuration of a terminal and a method of operating the terminal supporting security information management.

Description

Terminal and method for operating security information management {Portable Device For Security Information Management And Operating Method}

The present invention relates to security information management of a terminal, and more particularly, to a terminal and a method of operating a terminal that supports security information management for supporting security information storage more efficiently and easily and maintaining proper security.

A portable terminal is a terminal that supports a communication function based on mobility, and is used in a wide range of fields due to its convenience and ease of portability. These portable terminals have recently been developed in the form of smart phones equipped with various user functions, and provide various conveniences and entertainment. These smartphones enable customers to easily get the information they want by activating the App Store. In addition, the higher performance allows smartphones to handle many of the functions that PCs handle.

Smartphones are based on the open OS, which is a unique feature of smartphones, along with the rapid market expansion, and there are various security threats due to the operator's opening of the network and the use of applications through the open market. For example, smartphones are easily exposed to malwares and are vulnerable to hacking such as Lab Attack. Smartphones infected with malware can cause not only terminal malfunction, but also excessive battery consumption due to continuous network connection, excessive billing, and the leakage of personal and financial information. Currently, these malicious codes are mainly dealt with by software through vaccines. On the other hand, in the case of Lab Attack, which is a hack that reads certain information in the internal storage area of the smartphone or references and changes the information of the device itself, the Lab Attack terminal is hacked to expose the device to the risk of theft such as duplication. Can be.

Various security technologies have been developed and presented to prevent such security damages because they are exposed to various security risks in using the smart phone as described above. For example, when data is stored in the internal memory of the terminal, not only the stored data is encrypted, but also the data that needs security is stored and managed in a storage area allocated to a specific security area. This security area is provided in the form of an internal chip, for example, in the central processing unit area. As a result, the conventional smartphone can support an easy feature in the internal system configuration because there is no attachment or addition of a chip having a separate security area. However, since the conventional smartphone constitutes an area for storing security information in a limited area, the amount of data that can be stored is inevitably small. The security area having such a limited space in a smartphone that needs to operate a variety of security information has a problem that generates a great difficulty in storing and managing the security information that the user actually needs.

Accordingly, an object of the present invention is to solve the problems of the prior art as described above, and to provide a terminal and a method of operating a terminal that supports security information management to support the extended security area.

In another aspect, the present invention provides a terminal and a method for operating the terminal to support security information management that supports the use of security information while extending the storage area by operating the limited security area and extended security area more efficiently.

In addition, the present invention provides a terminal and a method of operating a terminal that supports security information management to increase the security by performing at least one of discarding and warning alarms of the corresponding security data when information change occurs by managing the information in the extended security area. Is in.

The present invention for achieving the above object is a non-secure module for supporting the operation of the user function that does not require secure data operation, a security module for supporting the operation of the user function that requires secure data operation, and a secure memory area for storing secure data And a control unit for moving the secure data to the secure area after performing encryption and change confirmation data insertion of the secure data when the secure data moves from the secure memory area to the secure area. A storage unit including the security area allocated for storing the security data in an area independent of the control unit; And an input unit for generating an input signal instructing to write or read the secure data to a secure memory area and a secure area.

The non-secure module calls a security module when security data is required during operation of a user function, and the security module reads the security data required by the non-secure module from the secure memory area or the secure area and delivers the secure data to the non-secure module, The security data may be controlled to perform a user function that requires the security data based on the read security data.

Meanwhile, the terminal of the present invention may further include a display unit for outputting the secure memory area and a list of secure data stored in the secure area.

The display unit may provide a screen interface for moving security data stored in the secure memory area to the secure area and moving the security data stored in the secure area to the secure memory area.

When the security data stored in the security area is moved to the security memory area, the controller may control to decrypt the security data, remove the change confirmation data, and then move the security data to the security memory area.

The controller may control to write the security data into the security area or the security memory area according to an input signal indicating a security level of the security data or one of the security area and the security memory area when writing new security data. Can be.

The controller checks the space for writing the security data when writing new security data into the secure memory area, and removes some of the security data pre-written in the secure memory area when the space for writing the security data is insufficient. Accordingly, the new security data may be controlled to be written in the space of the secured memory area.

In particular, the controller may remove previously stored security data having a lower security level than the new security data from the secure memory area, or remove data having a large data size from among security data having the same security level as the new security data. The security data having a relatively small size is controlled to be written in the secure memory area, or the secure data having at least one of the access count information of the secure data pre-written in the secure memory area and the writing time information of the secure data is less than or equal to a preset value. It may be controlled to remove from the secure memory area and write the new security data into the corresponding area.

The control unit moves and writes the removed security data to the security area of the storage unit, controls the encrypted security data to be moved, inserts and inserts the change confirmation data into the encrypted security data, and writes the security data into the security area. A location table including indexes and location information of data and indexes and location information of security data written in the secure memory area may be managed.

The present invention may further include receiving an input signal for storing specific security data, and assigning a separate area to a secure memory area provided in a control unit or a storage unit separate from the control unit according to a preset setting. Disclosed is a configuration of a method for operating a terminal that supports security information management including a write step of writing to a secure area.

The writing step may be a step of writing the security data into the security area or the secure memory area according to an input signal requesting to store the security level of the security data or one of the security area and the security memory area. .

The method may further include encrypting the security data, inserting change confirmation data into the encrypted security data, index information of the security data, and the security data when writing the security data to a security area of a storage unit. The method may further include generating a location table including the stored location information.

The method may further include: when the security data is written into the secure memory area, identifying a space to write the secure data; and when the space to write the secure data is insufficient, the method may further include the pre-writing of the secure data into the secure memory area. The method may further include writing a secure memory area to remove a part and write the secure data into a space of the secure memory area secured according to the removal.

The writing of the secure memory area may include removing previously stored secure data having a lower security level than the secure data to be written from the secure memory area and writing the secure data to be written to the corresponding area. Removing the secure data having a larger data size than the secure data to be written and writing the secure data to be written in a corresponding area among the secure data previously stored and having the same security level as the secure data to be written, the secure memory At least one of removing the security data having at least one of access number information of the security data pre-written in the area and writing time information of the security data less than or equal to a preset value and writing the security data to be written in the corresponding area; can do.

The method includes moving and writing the removed secured data into the secured area, encrypting the moved secured data, inserting change confirmation data into the encrypted secured data, and a location to write to the secured area. The method may further include recording.

The present invention also provides an input signal for reading specific security data, a security memory area provided in a control unit, or a security area provided in a separate storage area allocated to a storage unit independent of the control unit. Disclosed is a configuration of a method for operating a terminal that supports security information management, the method comprising: confirming a location of data, and reading the secure data from the identified location.

In this case, the checking step may be a step of checking a location table including an index of the security data and location information to identify a location of the area where the security data is stored.

And when the security data is stored in a security area, decrypting the read security data, performing a change confirmation of the decrypted security data, and when the security data is changed, changing the security data. The method may further include at least one of outputting a warning alarm for the security data and discarding the security data.

As described above, according to the terminal and the method for operating the terminal supporting the security information management according to the present invention, the present invention supports to maintain the security of the security information properly while allowing the use of a limited security area. .

In addition, the present invention can check whether the security information has been changed and can support the maintenance of the security information and the alarm for the information change.

1 is a diagram schematically illustrating a configuration of a terminal supporting a security information storage extension function according to an exemplary embodiment of the present invention.
2 is a view showing in more detail the control unit of Figure 1;
3 is a view for explaining a method of operating a terminal for writing security information during security information management support according to an embodiment of the present invention.
4 is a view for explaining another method of operating a terminal for reading security information during security information management support according to an embodiment of the present invention.
5 is a view for explaining an example of a screen interface output to the terminal according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In describing the embodiments, descriptions of technical contents that are well known in the art to which the present invention pertains and are not directly related to the present invention will be omitted. In addition, detailed description of components having substantially the same configuration and function will be omitted.

For the same reason, some components in the accompanying drawings are exaggerated, omitted, or schematically illustrated, and the size of each component does not entirely reflect the actual size. Therefore, the present invention is not limited by the relative size or spacing drawn in the accompanying drawings.

1 is a block diagram showing the configuration of a terminal 100 to support the expansion of the secure information storage space of the present invention.

Referring to FIG. 1, the terminal 100 supporting the security information storage space expansion function of the present invention includes a communication unit 110, an input unit 120, an audio processor 130, a display unit 140, a storage unit 150, and the like. It may include the configuration of the controller 160.

The terminal 100 of the present invention having such a configuration uses security data stored in the security area 153 of the storage unit 150 or selectively selects a secure memory area included in the control unit 160 during a user function operation process. By using the same, the limited secure memory area may be extended to the storage unit 150 to be used. Herein, the security area 153 is an area included in the storage 150 and is provided independently of the controller 160 and is located in the same physical area as the non-security area 151 where various information necessary for the terminal 100 is stored. This can be In addition, the secure memory area may be provided in the controller 160 to restrict access from the outside, and in particular, may be an area accessed internally by the security module. The secure memory area is an area that can be accessed by a security module including a secure operating system (Operating System) separately provided in the controller 160 after being disposed in a separate chip form in the controller 160.

The communication unit 110 may be configured as a communication module according to at least one communication method among various communication methods for forming a communication channel with the network system. For example, the communication unit 110 may be configured not only with a communication module supporting a communication method such as CDMA, GSM, but also at least one of a communication module supporting various communication methods such as 2G, 3G, 4G, such as WCDMA, OFDMA. The communication unit 110 may perform a web server connection requiring security data according to a user's request. For example, the communication unit 110 may support channel formation with a financial web server using security data, an authentication information request server using security data, and the like. In the channel formation process, the communication unit 110 may transmit security data to a corresponding server under the control of the control unit 160, and at this time, may encrypt and transmit the security data to be transmitted according to a preset policy. Meanwhile, the communication unit 110 may receive security data to be used as security information from the outside, and the received security data is transmitted to the control unit 160 and then, under the control of the control unit 160, the security area of the storage unit 150. Alternatively, the data may be stored in a secure memory area provided in the controller 160.

The input unit 120 may be formed of a key button or the like. When the terminal 100 is manufactured as a full touch screen, the input unit 120 may be configured as a side key or a separate hot key, and may be displayed on the touch screen of the terminal 100. Can be replaced with a key map. The input unit 120 may include a plurality of input keys and function keys for receiving numeric or text information and setting various functions. The function keys may include direction keys, side keys, shortcut keys, and the like, which are set to perform a specific function. In particular, the input unit 120 may generate an input signal related to secure data operation. For example, the input unit 120 may include an input signal for calling a user function for operating security data, an input signal for selecting security data required for performing a function according to activation of a corresponding user function among a plurality of security data, and security data based The user may generate an input signal or the like for terminating the user function. In addition, the input unit 120 of the present invention, in the process of storing the security data input signal, the security area to specify to store the security data in any one of the security area of the storage unit 150 and the security memory area of the control unit 160 And an input signal indicative of a change in the position of the security data in the secure memory area. The generated input signal may be transmitted to the controller 160 to operate as a command for performing a corresponding function.

The audio processor 130 may include a speaker SPK for outputting various audio data generated during the operation of the terminal 100 and a microphone MIC for collecting audio data. In particular, the audio processor 130 of the present invention may support various audio data outputs related to secure data operation. For example, when the security data is called and used from the security area 153 of the storage 150 and the security memory area of the controller 160, the audio processor 130 outputs an effect sound or a guide sound according to the use of the security data. can do. In particular, the audio processor 130 may support different sound effects or guide sounds when security data is called in the security area 153 and security sound is called in the security memory area according to a user setting. In addition, the audio processor 130 may output an alarm regarding a stored location when stored in any one of the security area 153 or the secure memory area in the process of storing the security data. The above alarm and guide sound output may be omitted according to a user setting.

The display unit 140 displays information input by the user or information provided to the user, including various menus of the terminal 100. That is, the display unit 140 may provide various screens according to the use of the terminal 100, for example, a standby screen, a menu screen, a message writing screen, a call screen, a terminal end screen, a terminal boot screen, and the like. The display unit 140 may be formed in the form of a flat panel display panel such as a liquid crystal display (LCD), an organic light emitting diode (OLED), or the like. The display unit 140 may be manufactured in a structure including a display panel and a touch panel according to a manufacturing form. In particular, the display unit 140 of the present invention may display the security data list stored in the security area 153 and the security data list stored in the secure memory area according to a user's request. In this case, the display unit 140 may separately display the security data list of the security area 153 and the security data list of the security memory area in the display process. If there is no secure data in the secure area 153 or the secure memory area, the display unit 140 may output information indicating that there is no stored secure data.

Meanwhile, the display unit 140 of the present invention may provide a screen interface for secure data exchange. That is, the display unit 140 may provide a screen interface for swapping the security data list stored in the security area 153 and the security data list stored in the security memory area according to a user request. Accordingly, the user can easily move the security data stored in the security area 153 to the security memory area by using the display unit 140 of the touch screen function, and also move the security data stored in the security memory area to the security area 153. Can be. In this case, the controller 160 may control to store only one security data in any one area while swapping the security data in the security area 153 and the secure memory area. Meanwhile, the display unit 140 may output a menu item or a widget item for changing a storage location of the security data, and the controller 160 may support to perform a corresponding user function after performing a preset authentication process when selecting the corresponding item.

In addition, the display unit 140 may provide a screen interface for setting the location of the stored area according to the type of security data. That is, the display unit 140 may store information set to a relatively high security level according to the security level of the security data in the secure memory area of the controller 160, and the relatively low level security data may be stored in the storage unit 150. A screen interface configured to be stored in the security area 153 may be provided. The user can define a location to be stored according to each class, and can also define a security level arbitrarily for each security data. In this case, the security level of the security data may be predefined at the time of generation of the data. Accordingly, the user recognizes advance information about the security level of the security data and stores the information in the secure memory area or the security area 153 according to the corresponding level. 140 can be set through.

The storage unit 150 stores various resources (fonts, images, photos, etc.) for configuring the screen to be output on the display unit 140, including an application program required for operating a function according to an exemplary embodiment of the present disclosure. In addition, when the display unit 140 is configured as a touch screen, the storage unit 150 may store a key map or a menu map for operating the touch screen. Here, the key map and the menu map may be in various forms. That is, the key map may be a keyboard map, a 3 * 4 key map, a qwerty key map, or the like, or may be a control key map for operation control of an currently activated application program. In addition, the menu map may be a menu map for controlling the currently running application program. The storage unit 150 may largely include a program area and a data area.

The data area is an area in which data generated according to the use of the terminal 100 is stored, and may store phone book data, at least one icon according to a widget function, and various contents. In particular, the data area may include a security area 153 and a non-security area 151. The security area 153 may be an area where security data is stored under the control of the controller 160. In particular, the security data stored in the security area 153 is an area in which security data processed by the security module of the controller 160 is stored, and may further include a code for checking change data according to the control of the security module. The non-secure area 151 is an area for storing data used for operating a user function of the terminal 100. The non-secure area 151 may store general data that does not require security. Data stored in the non-secure area 151 may be written and read by the non-secure module. The non-secure area 151 and the secure area 153 are not meant to be physically divided areas, but are to be divided according to whether the stored data is secure data or non-secure data.

The program area may include an operating system (OS) for booting the terminal 100 and operating the above-described components, various user functions, for example, a user function for supporting a call function of the terminal 100, and accessing an Internet server. A web browser for playing a video, an MP3 user function for playing other sound sources, an image output function for playing a photo, and an application program for supporting a video play function can be stored. In particular, the program area of the present invention operates based on a non-secure module that supports a user function of the terminal 100 based on the non-secure area 151, and a secure memory area inserted into the secure area 153 and the controller 160. The security module can be stored. The non-secure module and the security module may be loaded into the controller 160 during the booting process of the terminal 100 to support signal processing for supporting the non-secure user function and the secure user function, respectively.

The controller 160 controls power supply to each component of the terminal 100 to support the initialization process of each component. In addition, the controller 160 may control various message transmission / reception required for controlling the secure data write and read operation according to an embodiment of the present invention. To this end, the controller 160 may include a configuration as shown in FIG. 2.

2 is a view showing in more detail the configuration of the controller 160 of the present invention.

Referring to FIG. 2, the controller 160 of the present invention may include a non-secure module 200, a security module 300, and a secure memory 310.

The non-security module 200 may include an operating system (OS) for operating a user function that does not require security data while operating the user function of the terminal 100. The non-security module 200 may perform control for operating a user function according to an input signal input from the input unit 120 or the display unit 140 of the touch screen function. For example, when the user generates an input signal for activating a camera function, the non-security module 200 may control a camera activation, a camera-based image acquisition function, a storage function of the collected image, and the like. In this case, the non-security module 200 may support an image storage function of the camera based on the non-security area 151. Similarly, when the user activates the broadcast reception function, the non-secure module 200 may activate the broadcast reception module and support to output the received broadcast reception signal to the display unit 140. In addition, when an input signal for activating a music file or a video file stored in the non-secure area 151 is generated, the non-secure module 200 may support a file playing function according to the corresponding input signal. To this end, the terminal 100 of the present invention may further include a camera module, a broadcast receiving module, a file playing module, and the like. On the other hand, the non-security module 200 may call the security module 300 when it is necessary to use secure data while operating a user function.

The security module 300 performs a security function called according to a call of the non-security module 200. For example, in the case where the non-secure module 200 performs a music file playing function, when secure data is required for the purchase of a music file, payment of a fee for acquiring a use of a music file, or authentication is required, the security module 300 may be used. Can be called. In this process, the non-secure module 200 may transmit the call information for the required security data to the security module 300.

When the security module 300 is called by the non-secure module 200, the security module 300 may receive the call information from the non-secure module 200 and check the location of the security data to be searched and transmitted or to search and operate. That is, the security module 300 may check whether the security data written in the call information is stored in the security area 153 of the storage unit 150 or in the area of the security memory 310. To this end, the security module 300 may store and manage a location table that records location information of stored security data. In other words, the security module 300 may operate location information that records whether the security data is stored in the security area 153 or the security memory 310 and a location table that defines where the security data is located in the area. Can be. When the security data is retrieved, the security module 300 may deliver the security data to the non-security module 200 or may be temporarily delegated authority for a user function that requires the security data to operate the user function.

In this case, the security module 300 may perform a reliability check on security data read from the security area 153 of the storage 150. That is, the security module 300 may check whether the corresponding security data is changed data by checking a change data code, for example, a parity bit of the security data. The security module 300 may change the reliability of the corresponding security data when the change data code of the security data is changed. That is, the security module 300 may determine that the corresponding security data is not available, and stop the operation of the corresponding user function related to the operation of the security data. In addition, the security module 300 may warn the user with a guide sound or text that the security data has been changed. In the meantime, since the security memory 310 provides relatively higher security than the security area 153, the security module 300 inserts and stores a change data code only when the security data is stored in the security area 153. By doing so, it is possible to check whether the security data has changed.

Meanwhile, the security module 300 supports to output the security data list to the display unit 140. That is, when the user requests a list view of the security data stored in the security area 153 and the security memory 310, the security module 300 supports to output the security data stored in the security memory 310 to the display unit 140. . In addition, the security module 300 may support security data stored in the security area 153 to be differentiated from information stored in the security memory 310. When an input signal for instructing secure data swap is generated from the input unit 120 or the display unit 140 of the input function, the security module 300 secures the secure data of the security area 153 according to the corresponding input signal. Alternatively, the secure data stored in the area of the secure memory 310 may be moved to the secure area 153 of the storage unit 150. In the process of moving the information of the secure memory 310 to the secure area 153, the change data code may be inserted into the corresponding secure data.

The secure memory 310 may be accessed only by the security module 300 and may be implemented by being inserted into the controller 160 in the form of a chip. Various security data may be stored in the secure memory 310, but the storage space of the secure memory 310 may be formed relatively smaller than the storage space of the storage unit 150. Accordingly, it is preferable that the size of the security data stored in the secure memory 310 is smaller than the security data stored in the security area 153 and the information having high importance is stored.

To this end, the security module 300 may check the characteristic of the stored security data and control the security module 300 to store the characteristic in the security region 153 or the security memory 310 according to the characteristic. In more detail, when the security module 300 is requested to store the security data, the security module 300 checks at least one of a grade and a data size of the security data. The security module 300 may control to store the corresponding data in the secure memory 310 first when the level of the secure data is high. In this process, when the size of the security data to be stored is large and cannot be stored in the security memory 310, the security module 300 examines the security data stored in the security memory 310 and stores information having a relatively low security level. Control to move to 153). The security module 300 may control to store secure data having a high security level in the secure memory 310. Meanwhile, the security module 300 may control to automatically store the security data in the security area 153 when the level of the security data to be stored is low. For example, the security module 300 may control security data related to the financial sector to be set at a relatively high level and the corresponding information may be stored in the security memory 310. In addition, the security module 300 may control to set the security data of the phonebook information to a relatively low level, and to store the corresponding information in the security area 153. Here, the class setting for each type of security data may be defined by a user or by a forwarder who delivers corresponding information. On the other hand, the security module 300 is a security area when there is security data of the same grade, that is, the security data to be stored currently has the same level as the security data stored in the security memory 310 but has a relatively large data size. 153 may be controlled to store. Alternatively, the security module 300 may control to store the currently collected security data in the security memory 310 according to a user setting and move the previously stored security data of the same level to the security area 153.

In addition, the security module 300 may determine the swap between the newly stored security data and the previously stored security data based on the information on the number of accesses of the stored security data and the timing of storing the security data. That is, the security module 300 may move the security data having a relatively small number of accesses of the security data to the security area 153 when the storage space of the newly stored security data is insufficient due to the data stored in the security memory 310. Can be. In addition, the security module 300 may move the security data having a relatively old storage time of the security data to the security area 153. In this process, the security module 300 may insert a change data code into the moved security data.

As described above, the security module 300 of the present invention moves to the security area 153 based on at least one of a security level of previously stored security data, a data size of the security data, a storage time of the security data, and the number of times of access of the security data. You can determine the stored security data to move.

3 is a flowchart illustrating a method of operating a terminal for writing security information while supporting the security information storage extension function of the terminal 100 according to an exemplary embodiment of the present invention.

Referring to FIG. 3, in the method of operating a terminal of the present invention, first, when power is supplied in step 301, the controller 160 of the terminal 100 supplies power to each of the components of the terminal 100. In addition, the controller 160 may control to perform a preparation process of each component for supporting a user function. In this process, the controller 160 may control to activate the non-secure module 200.

Thereafter, when an input signal is generated in step 303, the controller 160 checks whether the corresponding input signal is an input signal for storing security data. In this process, if it is not an input signal for storing security data, the controller 160 branches to step 305 to support general data storage according to the corresponding input signal. Alternatively, the controller 160 may support user function operation according to the corresponding input signal. The security data to be stored may be various data such as data for using the financial sector, phone book data, schedule data, and the like. Such security data may be defined as security data according to user settings, or may be generated with a security level at the time of creation.

Meanwhile, when an input signal for storing secure data is generated in step 303, the non-secure module 200 of the controller 160 may control to call the security module 300. Then, the security module 300 checks the security data characteristic in step 307. In operation 309, the security module 300 determines whether the corresponding security data should be stored in the security area 153. That is, the security module 300 checks whether the level of the security data is set to be stored in the security area 153 or whether there is an input signal indicating the area to store the security data to the security area 153. You can check.

If there is information instructing to store the secure data in the secure memory 310 instead of the secure area 153 in step 309, the security module 300 may branch to step 311 to support the secure data in the secure memory area. . In addition, the security module 300 may control to record index information and location information of security data stored in the secure memory area in the location table.

On the other hand, if there is information instructing to store the security data in the security area in step 309, the controller 160 may branch to step 313 to encrypt the security data to be stored in the security area 153. To this end, the terminal 100 may store a predetermined encryption algorithm for secure data encryption.

When the secure data encryption is completed, the controller 160 branches to step 315 and controls to write the change confirmation data in the encrypted secure data. The change confirmation data may be a parity bit as a code for confirming whether the security data has been changed. When writing of the change confirmation data to the encrypted security data is completed, the controller 160 can control to store the corresponding security data in the security area 153 of the storage 150 in step 317.

4 is a flowchart illustrating a method of operating a terminal for reading security information while supporting the security information storage extension function of the terminal 100 according to an embodiment of the present invention.

Referring to FIG. 4, in the method of operating a terminal of the present invention, first, when power is supplied in step 401, similarly to step 301, the control unit 160 of the terminal 100 supplies power supplied to each terminal 100. Supply the configurations. In addition, the controller 160 may control to perform a preparation process of each component for supporting a user function, and for this purpose, may control to activate the non-secure module 200.

Next, the non-security module 200 of the controller 160 may determine whether an input signal or a specific user function operation is for a secure data read operation. In this step, if the non-secure module 200 does not generate an input signal for a secure data read operation, the non-secure module 200 may branch to step 405 to support an operation according to the corresponding input signal, for example, a general data read operation.

On the other hand, if the input signal generated in step 403 is an input signal for reading secure data, the controller 160 branches to step 407 to check the location of the required security data. To this end, the controller 160 may refer to the location table storing the location information of the security data and check where the security data is to be read based on the location table.

In this case, the controller 160 may check whether the security data is stored in the storage 150 in step 409. If the security data is not stored in the security area 153 of the storage unit 150 but stored in the security memory 310, the controller 160 branches to step 411 to store the security data in the area of the security memory 310. Read operation can be performed. In addition, the controller 160 may support to perform a user function based on the read security data.

On the other hand, if the security data is stored in the security area 153 of the storage unit 150 in step 409, the control proceeds to step 413 to perform a read operation of the security data in the security area 153 of the storage unit 150. Can be. Since the secure data stored in the secure area 153 is encrypted, the secure data is also decrypted. In this case, the controller 160 branches to step 415 to check whether the security data to be used is changed. To this end, the controller 160 can read the security data as a temporary read in step 413.

If the change of the security data occurs in step 415, the control unit 160 branches to step 417 to control to output a warning and notification message for changing the security data through the display unit 140 or the audio processor 130. In addition, the controller 160 may selectively control to discard the corresponding security data. In this case, the controller 160 may check whether the security data has been changed by checking a change data code, for example, a parity bit, to confirm the security data change. If there is no change of the security data, the controller 160 may control to perform a corresponding user function based on the security data read by branching to step 419.

5 is a diagram illustrating an example of a screen interface provided based on the terminal 100 according to an exemplary embodiment of the present invention.

Referring to FIG. 5, the display unit 140 of the terminal 100 according to the present invention distinguishes and outputs at least one security data stored in the security area 153 and at least one security data stored in the security memory 310. can do. To this end, the terminal 100 may include a security data view item in a menu and provide the same, and output a corresponding security data list view screen according to a user's request. In this case, the terminal 100 may call the security module 300 for outputting the security data list. Then, the security module 300 may support to collect and output security data stored in the security area 153 and the security memory 310 as shown.

Meanwhile, the user can easily change the storage location of the security data based on the illustrated screen interface. For example, when a user generates an input signal for selecting the security data located in the security area 153 and generates an input signal for moving the security data to the area of the security memory 310, the terminal 100 stores the security data in the security memory. It may be controlled to move to the area of 310. In this process, the security module 300 of the control unit 160 controls to remove the change data code of the security data read from the security area 153 and to decode the encrypted security data and store it in the security memory 310. Can be. Alternatively, the security module 300 may control to store only the changed data code of the security data and store the encrypted security data in the secure memory 310.

On the other hand, in the opposite case, that is, when an input signal for moving the security data located in the secure memory 310 to the security area 153 occurs, the security module 300 of the controller 160 encrypts when the security data is not encrypted. In the meantime, a change data code may be inserted and controlled to be stored in the security area 153.

As described above, the terminal and the method for operating the terminal according to an embodiment of the present invention store the security data to be stored according to the user request or the grade of the security data in the area of the secure memory 310 provided in the controller 160 or the controller 310. Independently provided and stored in the security area 153 of the storage unit 150, which is not guaranteed, it is possible to provide a proper security while securing a secure space for storing secure data.

Meanwhile, the terminal 100 described above may further include various additional modules according to the provision form thereof. That is, in the case of a communication terminal, the terminal 100 is a short-range communication module for short-range communication, an interface for data transmission and reception by a wired communication method or a wireless communication method of the terminal 100, and an internet communication by communicating with an internet network. The module may further include components not mentioned above, such as a digital broadcasting module for performing digital broadcasting reception and reproduction functions. These components can not be enumerated because all of them vary according to the convergence trend of digital devices, but the components equivalent to those mentioned above may be further included in the device. have. In addition, the terminal 100 of the present invention may be excluded from the above configuration or replaced with another configuration according to the form of the present invention. This will be readily understood by those of ordinary skill in the art.

In addition, the terminal 100 according to an embodiment of the present invention may include all types of devices provided with a secure memory in the controller 160. For example, the terminal 100 includes all mobile communication terminals operating in accordance with communication protocols corresponding to various communication systems, including portable multimedia player (PMP) and digital broadcasting. All information and communication devices including multimedia player, PDA (Personal Digital Assistant), music player (e.g. MP3 player), mobile game terminal, smart phone, notebook and handheld PC, and applications It may include.

On the other hand, it has been described with respect to the preferred embodiments of the present invention through the specification and drawings, although specific terms are used, this is only used in a general sense to easily explain the technical details of the present invention and to help the understanding of the invention. It is not intended to limit the scope of the present invention. It will be apparent to those skilled in the art that other modifications based on the technical spirit of the present invention can be carried out even in the embodiments disclosed herein.

The terminal and the method for operating the terminal supporting security information management according to the present invention are applied to various user terminals, in particular, a portable terminal, so that it is possible to extend and use a limited security area while maintaining appropriate security for security information. Support.

In addition, the present invention can check whether the security information has been changed and can support the maintenance of the security information and the alarm for the information change.

100: terminal 110: communication unit
120: input unit 130: audio processing unit
140: display unit 150: storage unit
160: control unit 200: non-secure module
300: security module 310: secure memory area

Claims (22)

And a non-secure module that supports user function operation that does not require secure data operation, a security module that supports user function operation that requires the secure data operation, and a secure memory area for storing the security data. A control unit for writing in a secure area of the secure memory area or an independent area according to a preset setting, and when writing to the secure area, after performing the secure data encryption and insertion of change confirmation data;
A storage unit including the security area allocated for storing the security data in an area independent of the control unit; And
An input unit configured to generate an input signal instructing to write or read the secure data into the secure memory area and the secure area; Including,
The control unit,
Controlling the security data stored in the secure memory area and the list of security data stored in the secure area to be output to the display unit by dividing each area into each display area;
According to a user input, controls to move security data stored in the secure memory area to the secure area, or to move secure data stored in the secure area to the secure memory area,
When the secure data is newly written in the secure memory area, the space to write the secure data is checked, and when there is not enough space to write the secure data, some of the secure data pre-written in the secure memory area are removed. Control to write the secure data in the space of the secure memory secured according to the removal;
Secure information management, wherein the secure data removed from the secure memory area is moved and written to the secure area, the encrypted secure data is encrypted, and the change confirmation data is inserted into the encrypted secure data to control the secure data management. Supported terminal. Claim 2 has been abandoned upon payment of a set-up fee. The method of claim 1, wherein the non-secure module
If the security data is required during the operation of the user function calls the security module,
The security module reads security data required by the non-security module from the security memory area or the security area and transfers the security data to the non-security module or performs a user function requiring the security data based on the read security data. A terminal supporting security information management, characterized in that the. delete Claim 4 has been abandoned upon payment of a setup registration fee. The method of claim 1,
The display unit
And a screen interface for moving security data stored in the security memory area to the security area and moving the security data stored in the security area to the security memory area. . Claim 5 was abandoned upon payment of a set-up fee. The method of claim 1,
The control unit
And moving the secure data stored in the secure area to the secure memory area after decrypting the secure data, removing the change confirmation data, and moving the secure data to the secure memory area. Claim 6 has been abandoned upon payment of a setup registration fee. The method of claim 1,
The control unit
When the new secure data is written, the secure data is written to the secure area or the secure memory area according to an input signal indicating a security level of the secure data or one of the secure area and the secure memory area. Terminal that supports security information management. delete Claim 8 has been abandoned upon payment of a set-up fee. The method of claim 1
The control unit
Among the secure data previously stored in the secure memory area, control to remove previously stored secure data having a lower security level than the secure data to be written from the secure memory area,
Among the secure data previously stored in the secure memory area, the data size is compared with the secure data having the same security level as the secure data to be written, and then control is performed to remove the secure data having a large data size,
And controlling to remove security data having at least one of access count information and writing time information of the security data from the security data pre-written in the secure memory area. delete Claim 10 has been abandoned upon payment of a setup registration fee. The method of claim 1
The control unit
And a location table including an index and location information of security data written in the secure area and an index and location information of security data written in the secure memory area. Receiving an input signal for storing specific security data;
The security data may be written in a secure memory area provided in a control part or a secure area provided in a storage part of an area independent of the control part according to a preset setting, and when the secure data is written in the security area, encryption and change confirmation data of the security data may be inserted. Writing to the secured area after performing; Including,
The filling step is
Dividing the security data stored in the secure memory area and the list of security data stored in the secure area into each display area and outputting the divided data to the display unit;
Moving the secure data stored in the secure memory area to the secure area or moving the secure data stored in the secure area to the secure memory area according to a user input.
In the filling step,
When the secure data is newly written in the secure memory area, the space to write the secure data is checked, and when there is not enough space to write the secure data, some of the secure data pre-written in the secure memory area are removed. Control to write the secure data in the space of the secure memory secured according to the removal;
Secure information management, wherein the secure data removed from the secure memory area is moved and written to the secure area, the encrypted secure data is encrypted, and the change confirmation data is inserted into the encrypted secure data to control the secure data management. Supported terminal operation method. Claim 12 was abandoned upon payment of a set-up fee. The method of claim 11,
The filling step is
And writing the security data into the security area or the security memory area according to a security level of the security data or an input signal required to be stored in one of the security area and the security memory area. Terminal operation method that supports. delete Claim 14 was abandoned upon payment of a set-up fee. The method of claim 11,
Generating a location table including index information of the security data and location information in which the security data is stored;
Terminal operating method for supporting security information management, characterized in that it further comprises. delete Claim 16 was abandoned upon payment of a set-up fee. The method of claim 11,
The filling step is
Remove previously stored security data having a lower security level than the security data to be written from the secure memory area, and write the security data to be written into the corresponding area;
After comparing the data size with the security data previously stored in the secure memory area and having the same security level as the secure data to be written, the data having the smaller data size is written into the secure memory area, or
And removing the security data having at least one of access number information of the secure data pre-written in the secure memory area and writing time information of the secure data less than or equal to a preset value, and writing the secure data to be written in the corresponding area. Terminal operation method that supports information management. Claim 17 was abandoned upon payment of a set-up fee. The method of claim 11,
Moving and removing the removed secured data into the secured area;
Terminal operating method for supporting security information management, characterized in that it further comprises. Claim 18 was abandoned when the set registration fee was paid. The method of claim 17
Encrypting the moved secure data;
Inserting change confirmation data into the encrypted secure data;
Recording a location to write to the secure area;
Terminal operating method for supporting security information management, characterized in that it further comprises. Receiving an input signal for storing specific security data;
The security data may be written in a secure memory area provided in a control part or a secure area provided in a storage part of an area independent of the control part according to a preset setting, and when the secure data is written in the security area, encryption and change confirmation data of the security data may be inserted. Writing to the secured area after performing;
Receiving an input signal for reading specific security data;
Confirming a location of secure data stored in either the secure memory area or the secure area;
A reading step of reading the security data at the identified position; Including,
The filling step is
Dividing the security data stored in the secure memory area and the list of security data stored in the secure area into each display area and outputting the divided data to the display unit;
Moving the secure data stored in the secure memory area to the secure area or moving the secure data stored in the secure area to the secure memory area according to a user input.
In the filling step,
When the secure data is newly written in the secure memory area, the space to write the secure data is checked, and when there is not enough space to write the secure data, some of the secure data pre-written in the secure memory area are removed. Control to write the secure data in the space of the secure memory secured according to the removal;
Secure data removed from the secure memory area is moved to the secure area, and writes the encrypted secured data, and inserts and inserts the change confirmation data into the encrypted secure data to support security information management. Terminal operation method. Claim 20 was abandoned when the set registration fee was paid. The method of claim 19
The checking step is
Confirming a location table including an index of the security data and location information to identify the location of the area where the security data is stored. Claim 21 has been abandoned upon payment of a set-up fee. The method of claim 19
Decrypting the read secure data when the secure data is stored in a secure area;
Performing change confirmation of the decrypted secure data;
Terminal operating method for supporting security information management, characterized in that it further comprises. Claim 22 was abandoned upon payment of a set-up fee. The method of claim 21,
Outputting a warning alarm for the security data change when the security data is changed;
Discarding the secure data;
The method of claim 1, further comprising at least one of the steps.

Images