KR20140105681A - Apparatus and method for encryption data in secure mode - Google Patents

Abstract

Various embodiments of the present invention have been described with respect to various embodiments related to data encryption. According to one embodiment, a key generation unit for generating a key necessary for encryption using at least one of data of first data or second data, And an encryption module for encrypting the data using the generated key and storing the encrypted data in a secure mode data area distinguished from the normal mode data area in the secure mode, Do.

Description

[0001] APPARATUS AND METHOD FOR ENCRYPTION DATA IN SECURE MODE [0002]

Various embodiments of the present invention are directed to an apparatus and method for encrypting data in secure mode.

Recently, mobile devices such as terminals are configured to perform various functions. Examples of various functions include data and voice communication, the ability to shoot pictures or movies through a camera, audio storage, playback of music files through a speaker system, and display of images or video. Such mobile devices are often used for personal use, but may also be implemented for business or business use.

Moreover, as mobile devices such as smart phones and tablets become popular, a trend called BYOD (Bring Your Own Device) is becoming an issue. BYOD stands for the use of devices such as personal laptops or smartphones in business. As a result, devices are increasingly used not only for personal use but also for business use in places such as companies. For example, users often use personal mobile devices in various tasks such as accessing a business system using personal mobile devices, browsing important business documents, making business calls, and the like.

However, when personal devices are used for business, security is required to protect information related to business. As a result, companies that use a single device for personal use and business use have to install a security solution to enhance security when devices are used for business purposes. For example, companies have implemented a security solution in a personal device owned by the user to use the device as a business device, or a business device having a security solution separately from the personal device is provided to the user for use. Accordingly, security solutions to be installed in business devices are being developed variously by various security solution companies.

For example, a security solution according to the prior art includes a VMWARE (Virtual Machine Software) type security solution, an application redundancy type security solution, and an OS (Operating System) type security solution.

The VMWare-based security solution has a virtual process that executes an application in a separate domain from a main process that executes an application in a general domain, and executes a business application through a separate virtual process. An OS partitioning security solution is a method of installing different OSs in one device, executing general applications through one OS, and running business applications through another OS. The application duplication security solution allows a general application and a third party to reuse the business application reproduced by the general application for business together with the device, the general application to be executable in the general domain, and the business application to the business So that it can be executed in the area.

However, when the VMWARE-based security solution is applied to the device, the main process and the virtual process are driven by one CPU, respectively, and occupy each memory area, so that CPU resources and memory resources are consumed in multiple. Therefore, when the VMWARE-based security solution is used, the CPU resource and the memory resource that can be individually used by the user are reduced, while the performance is degraded because the CPU resource and the memory resource are used in multiple ways.

In addition, even in the case of the OS partitioning method, since two OSs in one device use memory resources, memory resources are consumed in a large amount, which is inefficient. In addition, since two OSs operate independently, There is a problem in that it is difficult to interwork between the OSs. In addition, it is inefficient because it requires separate resources for interoperation between OSes in order to enable interoperation between OSs.

On the other hand, even in the case of a security solution using an application redundancy method, since general applications and business applications use memory resources, there is a problem that memory resources are consumed inefficiently. On the other hand, the security solution of the application duplication method is inconvenient because the third party reproduces the general application as business for the business application, and it is inconvenient that the business application is not easily registered, removed or changed by the user or the enterprise.

Therefore, there is a problem that the above-described security solutions are not suitable to be applied to BYOD.

Accordingly, various embodiments of the present invention provide an apparatus and method for encrypting data in a secure mode so as to protect information related to a task when a user's personal device is used for business.

In addition, various embodiments of the present invention provide an apparatus and method for encrypting data in a secure mode in which a password is not leaked by encrypting data using the encrypted password as a key in a secure mode.

According to various embodiments of the present invention, there is provided a data encryption apparatus comprising: a key generator for generating a key required for encryption using at least one of data of first data or second data; And an encryption module for encrypting the data using the encryption key and storing the encrypted data in a secure mode data area distinguished from the normal mode data area.

Also, in various embodiments of the present invention,

An operation of generating a key necessary for encryption using at least one of data of the first data or the second data, an operation of encrypting data using the generated key in the case of a secure mode, And storing the data in the data area.

The data encryption apparatus and method according to the present invention enable security by enabling encryption on a security board such as when using a user's personal device for business, and can consume less resources of the device.

In addition, in various embodiments of the present invention, in the security mode, data is encrypted using the security area, thereby making it impossible to access the data in the security mode, thereby providing complete access protection to the data in the security area.

In addition, various embodiments of the present invention have an effect of preventing a password from being leaked by encrypting data by using an encrypted password as a key in a secure mode.

1 is a schematic block diagram illustrating a device according to an embodiment of the present invention.
2 is a conceptual diagram for explaining a normal mode data area and a security mode data area according to an embodiment of the present invention.
3 is a flowchart illustrating a method of accessing a normal mode data area and a secure mode data area according to an embodiment of the present invention.
4 is a conceptual diagram illustrating an encryption apparatus in a secure mode according to an embodiment of the present invention.
5 is a block diagram of an encryption apparatus in a secure mode according to an embodiment of the present invention.
6 is a flowchart of a password and PIN registration method in the encryption apparatus according to the embodiment of the present invention.
7 is a flowchart illustrating a security mode authentication process for entering a security mode in an encryption apparatus according to an embodiment of the present invention.
8 is a flowchart of a data encryption method in a state where the encryption device enters the security mode in the encryption device according to the embodiment of the present invention.
9 is a diagram illustrating encrypted data according to an embodiment of the present invention
FIG. 10 is a flowchart illustrating a method of decrypting data in a state where the encryption apparatus enters the security mode in the encryption apparatus according to the embodiment of the present invention.

The terms used in this specification will be briefly described and the present invention will be described in detail.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Also, in certain cases, there may be a term selected arbitrarily by the applicant, in which case the meaning thereof will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term, not on the name of a simple term, but on the entire contents of the present invention.

When an element is referred to as "including" an element throughout the specification, it is to be understood that the element may include other elements, without departing from the spirit or scope of the present invention. Also, the terms "part," " module, "and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

Throughout the specification, "application" refers to a set of computer programs designed to perform particular functions. The applications described herein may vary. Examples include, but are not limited to, a mail application, a camera application, a camera application, and the like.

The term "multimode application" as used throughout the specification refers to an application having a plurality of operating modes, in which data is processed using the normal mode data area in the normal mode and data is processed using the secure mode data area in the secure mode .

Throughout the specification, "general application " refers to an application that processes data without distinguishing between operating modes.

Hereinafter, various embodiments according to the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to or limited by the various embodiments. Like reference numerals in the drawings denote members performing substantially the same function.

1 is a schematic block diagram illustrating a device according to an embodiment of the present invention.

1, the device 100 may be a mobile terminal or the like and may be connected to an external device (not shown) using the mobile communication module 120, the sub communication module 130 and the connector 165 have. The external device may include other devices (not shown), a mobile phone (not shown), a smart phone (not shown), a tablet PC (not shown) and a server (not shown).

Referring to FIG. 1, the device 100 may include a touch screen 190 and a touch screen controller 195. The device 100 includes a controller 110, a mobile communication module 120, a sub communication module 130, a multimedia module 140, a camera module 150, a GPS module 155, an input / output module 160 A sensor module 170, a storage unit 175, and a power supply unit 180. The sub communication module 130 includes at least one of a wireless LAN module 131 and a local communication module 132. The multimedia module 140 includes a broadcasting communication module 141, an audio reproduction module 142, (143). The camera module 150 includes at least one of a first camera 151 and a second camera 152. The input / output module 160 includes a button 161, a microphone 162, a speaker 163, A motor 164, a connector 165, and a keypad 166.

The control unit 110 stores a ROM or ROM 112 storing a control program for controlling the device 100 and a signal or data input from the outside of the device 100, And a RAM (RAM) 113 used as a storage area for a work to be performed. The CPU 111 may include a single core, a dual core, a triple core, or a quad core. The CPU 111, the ROM 112, and the RAM 113 may be interconnected via an internal bus.

The control unit 110 includes a mobile communication module 120, a sub communication module 130, a multimedia module 140, a camera module 150, a GPS module 155, an input / output module 160, a sensor module 170, The storage unit 175, the power supply unit 180, the first touch screen 190a, the second touch screen 190b, and the touch screen controller 195, as shown in FIG.

The mobile communication module 120 may connect the device 100 to an external device through mobile communication using at least one or more antennas (not shown) under the control of the controller 110. [ The mobile communication module 120 is capable of communicating with a mobile phone (not shown), a smartphone (not shown), a tablet PC or other device (not shown) having a phone number input to the device 100, And can transmit / receive a wireless signal for a text message (SMS) or a multimedia message (MMS).

The sub communication module 130 may include at least one of a wireless LAN module 131 and a local area communication module 132. For example, it may include only the wireless LAN module 131, only the short range communication module 132, or both the wireless LAN module 131 and the short range communication module 132.

The wireless LAN module 131 may be connected to the Internet at a place where a wireless access point (not shown) is installed under the control of the controller 110. [ The wireless LAN module 131 may support IEEE 802.11x of the IEEE Institute of Electrical and Electronics Engineers (IEEE). The short-range communication module 132 can perform short-range wireless communication between the device 100 and the image forming apparatus (not shown) under the control of the controller 110. [ The local area communication method may include bluetooth, infrared data association (IrDA), and the like.

The device 100 may include at least one of a mobile communication module 120, a wireless LAN module 131, and a local communication module 132 according to performance. For example, the device 100 may include a combination of a mobile communication module 120, a wireless LAN module 131, and a short range communication module 132 depending on performance.

The multimedia module 140 may include a broadcasting communication module 141, an audio reproducing module 142, or a moving picture reproducing module 143. The broadcast communication module 141 receives a broadcast signal (e.g., a TV broadcast signal, a radio broadcast signal, or a data broadcast signal) transmitted from a broadcast station through a broadcast communication antenna (not shown) under the control of the controller 110, (E. G., An Electric Program Guide (EPS) or an Electric Service Guide (ESG)). The audio playback module 142 may play back a digital audio file (e.g., a file having a file extension of mp3, wma, ogg, or wav) that is stored or received under the control of the controller 110. [ The moving picture playback module 143 may play back digital moving picture files (e.g., files having file extensions mpeg, mpg, mp4, avi, mov, or mkv) stored or received under the control of the controller 110. [ The moving picture reproducing module 143 can reproduce the digital audio file.

The multimedia module 140 may include an audio reproduction module 142 and a moving picture reproduction module 143 except for the broadcasting communication module 141. [ The audio reproducing module 142 or the moving picture reproducing module 143 of the multimedia module 140 may be included in the controller 100.

The camera module 150 may include at least one of a first camera 151 and a second camera 152 for capturing still images or moving images under the control of the controller 110. [ In addition, the first camera 151 or the second camera 152 may include an auxiliary light source (e.g., a flash (not shown)) for providing the light amount necessary for photographing. The first camera 151 may be disposed on the front side of the device 100 and the second camera 152 may be disposed on the rear side of the device 100. [ The distance between the first camera 151 and the second camera 152 is larger than 1 cm and smaller than 8 cm) in a manner different from the first camera 151 and the second camera 152 Dimensional still image or a three-dimensional moving image.

The GPS module 155 receives the radio waves from a plurality of GPS satellites (not shown) on the earth orbit, and uses the time of arrival from the GPS satellites (not shown) to the device 100 The position of the device 100 can be calculated.

The input / output module 160 may include at least one of a plurality of buttons 161, a microphone 162, a speaker 163, a vibration motor 164, a connector 165, and a keypad 166.

Button 161 may be formed on the front, side, or rear surface of the housing of the device 100 and may include a power / lock button (not shown), a volume button (not shown), a menu button, A back button, and a search button 161. [

The microphone 162 may receive a voice or a sound according to the control of the controller 110 to generate an electrical signal.

The speaker 163 may transmit various signals (for example, a radio signal, a broadcast signal, a radio signal, a radio signal, a radio signal, a radio signal, and the like) of the mobile communication module 120, the sub communication module 130, the multimedia module 140, or the camera module 150 under the control of the controller 110. [ A digital audio file, a digital moving picture file, a picture photographing, or the like) to the outside of the device 100. The speaker 163 may output sound corresponding to the function performed by the device 100 (e.g., a button operation sound corresponding to a telephone call or a ring back tone). The speaker 163 may be formed at one or a plurality of positions at appropriate positions or positions of the housing of the device 100.

The vibration motor 164 can convert an electrical signal into a mechanical vibration under the control of the control unit 110. [ For example, the device 100 in the vibration mode may operate the vibration motor 164 when a voice call is received from another device (not shown). May be formed in the housing of the device 100 in one or more. The vibration motor 164 may operate in response to the user's touching operation on the touch screen 190 and the continuous movement of the touch on the touch screen 190.

The connector 165 may be used as an interface for connecting the device 100 to an external device (not shown) or a power source (not shown). The data stored in the storage unit 175 of the device 100 is transferred to an external device (not shown) via a wired cable connected to the connector 165 under the control of the control unit 110 or an external device (not shown) Lt; / RTI > Power can be input from a power source (not shown) or can be charged to a battery (not shown) through a wired cable connected to the connector 165. [

The keypad 166 may receive a key input from a user for control of the device 100. The keypad 166 includes a physical keypad (not shown) formed on the device 100 or a virtual keypad (not shown) displayed on the touch screen 190. A physical keypad (not shown) formed in the device 100 may be excluded depending on the performance or structure of the device 100.

The sensor module 170 includes at least one sensor for detecting the state of the device 100. [ For example, the sensor module 170 may include a proximity sensor that detects whether a user is approaching the device 100, an illuminance sensor (not shown) that detects the amount of light around the device 100, (Not shown) that detects motion of the device 100 (e.g., rotation of the device 100, acceleration or vibration applied to the device 100). At least one of the sensors may detect the state, generate a signal corresponding to the detection, and transmit the signal to the control unit 110. The sensor of the sensor module 170 may be added or deleted depending on the performance of the device 100.

The storage unit 175 is connected to the mobile communication module 120, the sub communication module 130, the multimedia module 140, the camera module 150, the GPS module 155, the input / And may store signals or data input / output corresponding to the operation of the touch panel 160, the sensor module 170, and the touch screen 190. The storage unit 175 may store control programs and applications for controlling the device 100 or the control unit 110. [

 The term " storage unit " refers to a storage unit 175, a ROM 112 in the control unit 110, a RAM 113, or a memory card (not shown) ). The storage unit may include a nonvolatile memory, a volatile memory, a hard disk drive (HDD), or a solid state drive (SSD).

The power supply unit 180 may supply power to one or a plurality of batteries (not shown) disposed in the housing of the device 100 under the control of the controller 110. One or more batteries (not shown) supply power to the device 100. In addition, the power supply unit 180 can supply power to the device 100 from an external power source (not shown) through a wired cable connected to the connector 165.

The touch screen 190 may provide a user interface corresponding to various services (e.g., call, data transmission, broadcasting, photographing) to the user. The touch screen 190 may transmit an analog signal corresponding to at least one touch input to the user interface to the touch screen controller 195. The touch screen 190 can receive at least one touch through a user's body (e.g., a finger including a thumb) or a touchable input means (e.g., a stylus pen). Also, the touch screen 190 can receive a continuous movement of one touch among at least one touch. The touch screen 190 may transmit an analog signal corresponding to the continuous movement of the input touch to the touch screen controller 195.

In the present invention, the touch is not limited to the contact between the touch screen 190 and the user's body or touchable input means, but may be a non-contact (e.g., between the touch screen 190 and the user's body, 1 mm or less). The interval that can be detected on the touch screen 190 may be changed according to the performance or structure of the device 100.

The touch screen 190 may be implemented by, for example, a resistive method, a capacitive method, an infrared method, or an acoustic wave method.

The touch screen controller 195 may convert the analog signal received from the touch screen 190 into a digital signal (e.g., X and Y coordinates) and transmit the digital signal to the controller 110. [ The controller 110 may control the touch screen 190 using the digital signal received from the touch screen controller 195. For example, the control unit 110 may execute a shortcut execution icon (not shown) displayed on the touch screen 190 in response to a touch or execute a shortcut execution icon (not shown). Also, the touch screen controller 195 may be included in the control unit 110. [

The device 100 configured as described above may operate in a normal mode and a secure mode. The normal mode may be the case where the device 100 is used for an application for which security is not required, and the security mode may be a case where the device 100 is used for security required applications. For example, the normal mode may be applied when the device 100 is used for the user's personal use, and the secure mode may be applied when the device 100 is used for business in the enterprise.

The device 100 processes data using the normal mode data area when the device 100 operates in the normal mode at the time of executing the multimode application and uses the secure mode data area when the device 100 operates in the secure mode So that the data can be processed.

2 is a conceptual diagram for explaining a normal mode data area and a security mode data area in a device according to an embodiment of the present invention.

Referring to FIG. 2, the device 100 may include a general data area 175-1 and a secure data area 175-2 in the storage unit 175. The general data area 175-1 is an area where data is stored in the normal mode and access to stored data is allowed. The secure data area 175-2 is an area in which encrypted data is stored in the secure mode and access to the stored encrypted data is permitted. The security data area 175-1 is an area isolated from the general data area 175-2. In the normal mode, access is allowed to the normal data area 175-2, and access to the secure data area 175-1 is not permitted. In the security mode, access to both the general data area 175-2 and the security data area 175-1 is allowed, or access to only the security data area 175-1 is allowed.

The multi-mode application 200 can be executed through the control unit 110 of the device 100. [ The multi-mode application 200 may include a mode determination unit 210, a function processing unit 220, and an encryption and decryption unit 230.

The mode determination unit 210 can determine whether the mode of the device 100 is the normal mode or the secure mode. At this time, the mode of the device 100 may be preset by a user or set by a predetermined mode condition. For example, the mode of the device 100 may be set to either the normal mode or the secure mode according to the user's selection. If the location of the device 100 is inside the company, the security mode may be set. If the location of the device 100 is outside the company, the security mode may be set.

The function processor 220 can process the functions of the application using general command codes processed in the general mode and security command codes processed in the security board.

The function processor 220 stores the data in the normal mode data area 175-2 when data is required to be stored in the function mode of the application in the normal mode and stores the data in the normal mode data area 175-2 The stored data can be accessed. In addition, the function processing unit 220 executes a storage function corresponding to an instruction code to store data such as a file or a database at the time of function processing of an application in the security mode, Acquire a key for encryption, encrypt the data using the obtained key and the encryption / decryption module 230, and store the encrypted data in the secure mode data area 175-1. Also, the function processor 220 authenticates the user in a predetermined manner as the read function corresponding to the command to read the data stored in the secure mode data area 175-1 is executed, and when the user is authenticated, And the encrypted data stored in the secure mode data area 175-1 can be read and decrypted using the obtained key and the encryption and decryption unit 230. [

3 is a flowchart of an access method of the normal mode data area 175-2 and the secure mode data area 175-2 in the device 100 according to the embodiment of the present invention.

Referring to FIG. 3, in operation 310, the device 100 may execute the multi-mode application 200 according to user input. For example, if the multi-mode application icon displayed on the touch screen 190 is touched by the user, the device 100 may execute the corresponding multi-mode application.

In operation 320, the device 100 may determine whether the mode is the normal mode or the secure mode through the three mode determination unit 210 as the multimode application 200 is executed.

In operation 330, if the device is in the normal mode, the device 100 may process the data using the normal mode data area 175-2. For example, the device 100 performs a corresponding function using the general mode command codes of the function processing unit 220, stores the data in the normal mode data area 175-2 when data is required to be stored when performing the function, If stored data access is required, data stored in the normal mode data area 175-2 can be accessed.

In operation 340, in secure mode, the device 100 may process data using the secure mode data area 175-1. For example, the device 100 may execute a storage function corresponding to an instruction code to store data such as a file or a database at the time of function processing of an application in a security mode, Acquire a key for encryption, encrypt the data using the obtained key and the encryption / decryption module 230, and store the encrypted data in the secure mode data area 175-1. Also, the function processor 220 authenticates the user in a predetermined manner as the read function corresponding to the command to read the data stored in the secure mode data area 175-1 is executed, and when the user is authenticated, And decrypts the encrypted data stored in the secure mode data area 175-1 by using the obtained key and the encryption / decryption module 230. [0050] FIG. At this time, the device 100 can compare the password encrypted by the hash method and the password input by the user with the password encrypted by the hash method, and authenticate the user when they match.

According to an embodiment of the present invention, the device 100 may encrypt data in a secure board via an encryption device in secure mode.

4 is a conceptual diagram illustrating an encryption apparatus in a secure mode according to an embodiment of the present invention. Referring to FIG. 4, the encryption apparatus 400 according to the embodiment of the present invention may include a key generation unit 410 and an encryption module 420.

The key generation unit 410 can generate a key necessary for encryption. The encryption module 420 can encrypt data such as a file and a database by using the generated key to output an encrypted file and an encrypted database. The encrypted file and the encrypted database may be stored in the file system 430 corresponding to the secure mode data area 175-1.

The encryption apparatus according to the embodiment of the present invention will be described in more detail.

5 is a block diagram of the encryption apparatus 400 in the secure mode according to the embodiment of the present invention. 5, the encryption apparatus 400 includes a 1-Way HASH module 402, a HASHED password registration unit 404, a key generation unit 410, an encryption module 420, an encryption algorithm selection unit 450, And an algorithm storage unit 440.

The 1-Way HASH module 402 can output the HASHED password by encrypting the password using the 1-way HASH method. HASHED Password means password encrypted with 1-Way HASH method. The HASHED password registration unit 404 can register the HASHED password.

The key generation unit 410 can generate a key necessary for encryption. The key generation unit 410 may generate a key using at least one of first data (e.g., a password) or second data (e.g., a PIN (Personal Identification Number) The key generation unit 410 may generate the PIN as the first key Kpin and may be used to encrypt the password, for example. The key generation unit 410 may generate the encrypted password Epwd as a second key KEpwd and use it to encrypt the data. According to various embodiments, 420, or may be configured as a module separate from the encryption module 420 as shown in FIG.

The encryption module 420 may receive the password and PIN and register the encrypted password Epwd and the encrypted PIN Epin. Also, the encryption module 420 may perform the security mode authentication if there is a request to enter the security mode, and enter the security mode if the security mode authentication is successful. The encryption module 420 encrypts data by using the encrypted password Epwd as the second key (KEpwd) according to a randomly selected encryption algorithm, such as a file and a database, while entering the security mode, And an encrypted file or an encrypted database in the file system 500 belonging to the secure mode data area 175-1.

The encryption algorithm storage unit 440 may store a plurality of encryption algorithms. For example, the encryption algorithm storage unit 440 may store various encryption algorithms such as AES, RAS, or ATK.

The encryption algorithm selecting unit 450 may randomly select any one of a plurality of encryption algorithms (AES, RAS, or ATK) stored in the encryption algorithm storage unit 450. [

 Hereinafter, the process of registering the encrypted password Epwd and the encrypted PIN Epin by receiving the password and PIN from the encryption apparatus 400 configured as described above will be described.

6 is a flowchart illustrating a password and PIN registration method in the encryption apparatus 400 according to the embodiment of the present invention. Referring to FIG. 6, the encryption apparatus 400 may receive a password and a PIN in step 610. FIG. At this time, the password and PIN can be input by the user.

The encryption apparatus 400 can encrypt the password using the PIN as the first key in step 620 and register the encrypted password. For example, the encryption apparatus 400 can encrypt the password using the first key Kpin and register the encrypted password Epwd as in Equation (1) below.

Here, E represents a symmetric key cryptosystem. P means plain data, that is, data to be encrypted, and Ppwd indicates a case where data to be encrypted is a password. Also, K means a key to be used for encryption, and Kpin denotes a case where a key to be used for encryption is a PIN. Epwd represents an encrypted password.

The encryption apparatus 400 can encrypt the PIN using the password as the second key in step 630 and register the encrypted password. For example, the encryption apparatus 400 can encrypt the PIN using the second key KEpwd and register the encrypted PIN (Epin) as shown in Equation (2).

Here, E represents a symmetric key cryptosystem. P indicates plaintext data, that is, data to be encrypted, and Ppin indicates that the data to be encrypted is a PIN. K denotes a key to be used for encryption, and KEpwd denotes a case where a key to be used for encryption is an encrypted password (Epwd).

If the encrypted PIN (Epin) and the encrypted password (Epwd) are registered, the encryption apparatus 400 can perform the user authentication by inputting the PIN instead of the password when the user forgets the password for user authentication .

For example, the encryption apparatus 400 encrypts the PIN (Ppin) using the encrypted password Epwd as the third key when the PIN is input for user authentication as shown in Equation (3) below, and the encrypted PIN (Epin) If it is the same as the pre-registered encrypted PIN (Epin), it can authenticate as an appropriate user.

&Quot; (3) "

Accordingly, various embodiments of the present invention store the encrypted PIN (Epin) and the encrypted password (Epwd) in the encryption apparatus 400 to authenticate the user.

7 is a flowchart illustrating a security mode authentication process for entering a secure mode in the encryption apparatus 400 according to an embodiment of the present invention.

Referring to FIG. 7, in operation 710, the encryption apparatus 400 may determine whether secure mode authentication for entering the secure mode is required. If secure mode authentication is required, in operation 720, the encryption device 400 may receive a password for entering the secure mode from the user. In operation 730, the encryption apparatus 400 encrypts the input password using the 1-Way HASH scheme, and outputs the password as a result of encryption.

Also, in operation 740, the encryption apparatus 400 can compare whether the HASHED password of the encryption result matches the HASHED password registered in the HASHED password registration unit 404.

If the HASHED password of the encryption result matches the HASHED password registered in the HASHED password registering unit 404, the encryption apparatus 400 can perform the security mode authentication in the operation 750 and enter the security mode. If the encryption result HASHED password does not match the HASHED password registered in the HASHED password registration unit 404, the encryption apparatus 400 recognizes the failure of the security mode authentication in operation 760 and can end without entering the security mode.

FIG. 8 is a flowchart of a data encryption method in a state where the encryption device 400 enters the security mode according to an embodiment of the present invention. Referring to FIG. 8, in operation 810, the encryption apparatus 400 may determine whether the security mode is entered in operation 810.

In operation 820, if the security mode is entered, the encryption apparatus 400 may determine whether data storage is necessary.

In operation 830, if data storage is required, the encryption device 400 may select an encryption algorithm to encrypt data, such as a file or a database. At this time, the encryption apparatus 400 can randomly select any one of a plurality of encryption algorithms (AES, RSA, or ATK) stored in the encryption algorithm storage unit 450 through the encryption algorithm selection unit 450 .

In operation 840, the encryption apparatus 400 can encrypt data such as a file or a database using the selected encryption algorithm and the encrypted password Epwd as the key (KEpwd).

In operation 850, the encryption device 400 may store the encryption algorithm ID and encryption data indicating which encryption algorithm was used in the file system 500 of the secure mode data area 175-1.

9 is a diagram illustrating encrypted data according to an embodiment of the present invention. Referring to FIG. 9, an encryption algorithm ID may be added to the encrypted data to indicate which algorithm is used and encrypted. At this time, the encryption algorithm ID may be a unique ID of each encryption algorithm, and it is preferable that only the encryption apparatus 400 can identify which encryption algorithm the encryption algorithm ID represents.

10 is a flowchart of a data decryption method in a state where the encryption device 400 enters the security mode according to an embodiment of the present invention. Referring to FIG. 10, the encryption apparatus 400 may perform decryption. In operation 1010, the encryption apparatus 400 may determine whether or not it is in the security mode.

In operation 1020, if the secure mode is entered, the encryption apparatus 400 may determine whether access to the stored data is necessary.

In step 1030, if access to the stored data is required, the encryption apparatus 400 may select an encryption algorithm for decrypting the encrypted data, such as the previously stored encrypted file or the encrypted database. At this time, the encryption apparatus 400 can recognize the encryption algorithm ID corresponding to the encrypted data and select a decryption algorithm. The encryption apparatus 400 can randomly select any one of a plurality of encryption algorithms AES, RSA, and ATK stored in the encryption algorithm storage unit 450 through the encryption algorithm selection unit 450.

In operation 1040, the encryption device 400 may decrypt the encrypted data, such as an encrypted file or an encrypted database, using the selected encryption algorithm and the encrypted password Epwd as the key (KEpwd).

Various embodiments of the present invention enable security by enabling encryption on a security board, such as when using a user's personal device for business purposes, while consuming less resources of the device. Also, in various embodiments of the present invention, in the security mode, data is encrypted using the security area, thereby making it impossible to access the data in the security mode, thereby providing complete access protection to the data in the security area. In addition, various embodiments of the present invention utilize the encrypted password as a key in the secure mode to encrypt the data, thereby preventing the password from being leaked.

The methods according to various embodiments of the present invention may be implemented in the form of program instructions that may be executed on various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. Program instructions to be recorded on the medium may be those specially designed and constructed for the present invention or may be known and available to those of ordinary skill in the computer software arts.

Claims (16)

In the apparatus,
A key generation unit for generating a key necessary for encryption using at least one of the first data and the second data;
An encryption module for encrypting data using the generated key and storing the encrypted data in a secure mode data area distinguished from a normal mode data area when the secure mode is a secure mode. The apparatus of claim 1, wherein the at least one data comprises a password or a PIN. 3. The apparatus of claim 2, wherein the key generation unit
And generates a key necessary for the encryption using the encrypted data obtained by encrypting the at least one data. The method according to claim 1,
Wherein the encryption module is configured to encrypt the data using at least one algorithm selected from a plurality of encryption algorithms. 5. The method of claim 4,
Wherein the plurality of encryption algorithms comprise AES, RSA, or ATK. 2. The information processing apparatus according to claim 1,
And store the encryption algorithm ID corresponding to the encryption algorithm used for encrypting the data in the secure mode data area. The method according to claim 1,
A HASHED password registration unit for storing a previously registered HASHED password;
Way HASH module that performs 1-way HASH encryption,
When the security mode authentication for entering the security mode is requested, the encryption module receives the password for entering the security mode and encrypts the password using the 1-Way HASH method, and transmits the HASHED password and the previously registered HASHED password And if they match, the device is set to enter the secure mode. 2. The information processing apparatus according to claim 1,
And to decrypt the encrypted data stored in the secure data area using the generated encryption key when the stored data access is requested in the state of entering the security mode. In the data encryption method,
An operation of generating a key necessary for encryption using at least one of the first data or the second data,
Encrypting data using the generated key if the encryption key is in a secure mode,
And storing the encrypted data in a secure mode data area. 10. The method of claim 9, wherein the at least one data comprises a password or a PIN. 11. The method of claim 10, wherein the act of generating a key required for encryption comprises:
And generating a key required for the encryption using the encrypted data that has encrypted the at least one data. 10. The method of claim 9,
Selecting an encryption algorithm randomly among a plurality of encryption algorithms. 13. The method of claim 12,
Wherein the plurality of encryption algorithms comprise AES, RSA, or ATK. 10. The method of claim 9,
Further comprising storing in the secure mode data area an encryption algorithm ID corresponding to an encryption algorithm used to encrypt the data. 10. The method of claim 9,
Registering the HASHED password,
When the security mode authentication for entering the security mode is requested, the security mode entering password is received and encrypted using the 1-Way HASH method, and if the HASHED password matches the pre-registered HASHED password, , ≪ / RTI > entering the secure mode. 10. The method of claim 9,
And decrypting the encrypted data stored in the secure data area using the generated key when the stored data access is requested in the secure mode.

Images