KR102171720B1 - Security system of flash memory and security setting method of flash memory thereof - Google Patents

Abstract

The present invention relates to a flash memory security system and a security setting method of a flash memory using the same. In the present invention, the security server 10 storing the first authentication key and the communication module 33 are embedded to enable wireless communication with the security server 10, and when power is applied, the first The internal security area by comparing the first authentication key and the second authentication key by transmitting the authentication key to the security server 10 by transmitting the authentication key or transmitting the second authentication key previously stored in the security area 31 or input through the interface. (31) or a flash memory (30) for selectively granting access to the data storage unit (35).

Description

Flash memory security system and security setting method of flash memory using the same {Security system of flash memory and security setting method of flash memory thereof}

The present invention relates to a flash memory security system, and more particularly, to a flash memory security system for protecting internally stored information as needed, and a method of maintaining security using the flash memory security system.

Currently, among the auxiliary memory devices of computers, USB memory, which is commonly used for data storage and mobile, is a necessity of modern people who have at least one of them for ordinary people who use computers. In particular, the use of USB memory as a storage space for public certificates increases as the use of design products that can be used as mobile phone accessories, key chains, etc., as well as the usefulness of carrying various files in a small size, and the number of internet banking users increase. have. In addition, the increase in capacity and price decline of the flash memory used as a USB memory has recently made the use of high-capacity USB memory more common.

However, as the storage capacity that can be stored in the USB memory increases and the size of the USB memory itself decreases, a problem of data loss due to loss may occur. Loss of the USB memory itself or loss or leakage of data stored in the USB memory may lead to personal loss, and there is a problem that secondary damage may occur due to data leakage when considering the characteristics of data separately stored in the USB memory.

Various technologies have been proposed to solve this problem, but it is practically impossible to control a USB memory that is lost or remotely, and even if it can be controlled remotely, if you do not know whether you have lost it, someone else will There is a problem in that data stored in memory can be easily obtained.

In addition, even if it is checked through an external server to check the security of the USB memory, communication can only be performed through a specific terminal (for example, a computer), so the moment the terminal is accessed, the USB memory may be hacked or internal data may be damaged You may be exposed to danger.

And in the past, even with a secure USB, internal access rights were limited, and there was a limit to implementing a function to increase security performance by setting additional rights using a secure USB.

Korean Patent Registration No. 10-1659294 Korean Patent Registration No. 10-1581570 Korean Patent Registration No. 10-1465429

The present invention is to solve the problems of the prior art as described above, and an object of the present invention is to allow a flash memory to directly communicate with a security server to receive authentication.

Another object of the present invention is to enable setting of external access rights of a terminal using a flash memory.

According to the features of the present invention for achieving the above object, the present invention provides a security server in which the first authentication key is stored, and the communication module is built-in to enable wireless communication with the security server. The internal security area or data by comparing the first authentication key and the second authentication key by receiving the first authentication key from the server or transmitting the second authentication key previously stored in the security area or input through the interface to the security server. It includes a flash memory that selectively allows access to the storage unit.

The security server may be accessed by a user to select whether to use the first authentication key or change the first authentication key through additional authentication, and if the use of the first authentication key is stopped through additional authentication, the security area or Access to the data storage is not allowed.

The additional authentication may be performed through at least one of information input through an interface of the flash memory, a national authentication number, and a personal telephone number.

When the flash memory is connected, power is applied to the flash memory, the internal third authentication key is transferred to the flash memory, and the flash memory further includes a terminal that transmits the transferred third authentication key to the security server. .

The security server compares the third authentication key transmitted from the flash memory with an authentication code of a pre-stored access permission list, and transmits the presence or absence of a corresponding authentication code to the flash memory, and the flash memory contains a corresponding authentication code. If present, allows the terminal to access the data storage.

A decryption key is stored in the security area of the flash memory, and when the flash memory is connected to a terminal, the decryption key may grant a cloud access right to the terminal or an internal intranet to which the terminal is connected.

The decryption key may be provided to the terminal when the flash memory accesses the security server and the access to the security area is granted through comparison of the first authentication key and the second authentication key.

The decryption key may be provided to the terminal only when the flash memory accesses the security server and confirms that an authentication code corresponding to the third authentication key of the terminal exists in the security server.

According to another feature of the present invention, the present invention provides an initial connection step of accessing a security server through an embedded communication module when power is applied to the flash memory, and a first authentication key previously stored in the security server is transmitted to the flash memory. Alternatively, an authentication key transmission step in which a second authentication key previously stored in the security area of the flash memory or input through the interface is transmitted to the security server, and the flash memory or the security server compares the first authentication key and the second authentication key. It includes an authentication key verification step of confirming whether to respond and transmitting the result to the other party, and an access grant step of selectively granting access to a security area or data storage unit inside the flash memory when the authentication key is verified. .

The security server may be accessed by a user to select whether to use the first authentication key or change the first authentication key through additional authentication, and if the use of the first authentication key is stopped through additional authentication, the security area or Access to the data storage is not allowed.

The additional authentication may be performed through at least one of information input through an interface of the flash memory, a national authentication number, and a personal telephone number.

If authentication fails more than a set number of times in the authentication key verification step, the flash memory deletes the information stored in the data storage unit or deletes the stored information after backing up the information to the security server.

If authentication fails more than a set number of times in the authentication key verification step, the security server transmits authentication attempt information to a previously stored contact.

The application of the power may be provided from the terminal when the flash memory is coupled to the terminal, and further includes a terminal authentication step in which the terminal selectively grants permission to access the flash memory.

In the terminal authentication step, when the flash memory is coupled to the terminal, a third authentication key inside the terminal is transmitted to an authentication key acquisition unit of the flash memory, and the authentication key acquisition unit transmits the transmitted third authentication key to a security server. 1 authentication step, the security server compares the third authentication key transmitted from the flash memory with an authentication code of a pre-stored access permission list, and transmits the presence or absence of a corresponding authentication code to the flash memory, and the flash memory It consists of a second authentication step of allowing the terminal to access the data storage unit if a corresponding authentication code exists.

When the terminal is granted access to the internal security area or data storage unit of the flash memory through the terminal authentication step, the terminal is granted access to the cloud by using the decryption key stored in the security area of the flash memory, or A terminal access grant step of granting access rights to the connected internal intranet is further included.

The flash memory security system and the flash memory security setting method using the same according to the present invention as seen above have the following effects.

In the present invention, since the flash memory directly communicates with a security server without passing through a terminal to set security, there is no fear of information being distorted or manipulated, and security can be easily set from a remote location, thereby improving security.

In addition, according to the present invention, since the flash memory directly communicates with the security server to release security, security can be maintained even if the user does not recognize whether the flash memory is lost. Therefore, security maintenance of the flash memory can be made more reliably.

In addition, in the present invention, a decryption key is stored in the security area of the flash memory, and when the terminal is accessed, the decryption key grants a cloud access right to the terminal or an internal intranet to which the terminal is connected. Therefore, the flash memory itself can function as a kind of security key, and it is also possible to implement double encryption for a specific site through an additional ID/password.

And if the authentication error occurs more than a certain number of times, the security server transmits the fact to the user and at the same time backs up and deletes the information stored in the flash memory to the security server. You can also log in and get your information again.

1 is a conceptual diagram schematically showing an embodiment of a flash memory security system according to the present invention.
2 is a flow chart sequentially showing a method of maintaining security of a flash memory using the flash memory security system according to the present invention.
FIG. 3 is a diagram showing the relationship between components in time series in the process of maintaining security of a flash memory using the present invention.
FIG. 4 is a diagram showing the relationship between components in a time series in a process of managing internal data to maintain security of a flash memory using the present invention.

Hereinafter, some embodiments of the present invention will be described in detail through exemplary drawings. In adding reference numerals to elements of each drawing, it should be noted that the same elements are assigned the same numerals as possible even if they are indicated on different drawings. In addition, in describing the embodiments of the present invention, if it is determined that a detailed description of a related known configuration or function interferes with the understanding of the embodiments of the present invention, the detailed description thereof will be omitted.

The present invention relates to a flash memory security system and a method of setting security of a flash memory using the same. Here, the flash memory 30 may be a USB storage device, an SSD storage device, or a NAND flash memory such as a memory card. The flash memory 30 is capable of reading and writing. According to the present invention, security can be set so that only a specific person or a specific terminal 50 can read or write.

1 shows a flash memory security system according to the present invention. For convenience of explanation, first, the security server 10 will be described. The security server 10 is a kind of server that is physically separated from the flash memory 30 and can remotely access the flash memory 30 to transmit and receive information. I can. The security server 10 has a storage space, and a first authentication key is stored in the storage space. The first authentication key is matched with the second authentication key transmitted from the flash memory 30 as described below, and is used to check access rights to the flash memory 30.

The security server 10 may be one or a plurality. When there are a plurality of security servers 10, the first authentication key may be stored in a manner in which the plurality of security servers 10 distribute and store the first authentication key. The user may access using the flash memory 30 to modify the first authentication key, and in this case, a second authentication may be required as described below. Here, the user means the owner of the flash memory 30.

When a user accesses the security server 10 to select whether to use the first authentication key or change the first authentication key through additional authentication, and when the use of the first authentication key is stopped through additional authentication, the Access to the security area 31 or the data storage unit 35 is not permitted. Here, the additional authentication may be performed through at least one of information input through an interface of the flash memory 30, a national authentication number, and a personal telephone number.

The flash memory 30 is connected to the security server 10. The flash memory 30 is a storage device having a storage unit therein, and a user can write arbitrary data or read written data. Looking at the structure of the flash memory 30, the flash memory 30 has a security area 31. The security area 31 is a part that cannot be accessed or deleted arbitrarily by a user or a third party, and may be a method of dividing an internal partition or a storage space created virtually. A second authentication key is stored in the security area 31, and information desired by an authenticated user may be additionally stored. As will be described below, the second authentication key may not be pre-stored in the security area 31, but may be inputted through the interface unit 36 and temporarily stored when verification is required.

The flash memory 30 includes an authentication key acquisition unit 32. The authentication key acquisition unit 32 is for obtaining a third authentication key that is an internal authentication key of the terminal 50 to which the flash memory 30 is accessed, for example, and may be a part of the security area 31 or the control unit. have. After obtaining the third authentication key, the authentication key acquisition unit 32 transmits the third authentication key to the security server 10 so that the third authentication key can be verified. Here, the third authentication key may be the computer's IP address or MAC address. Of course, if the dedicated program 51 is installed in the terminal 50, the third authentication key may be a dedicated authentication key encrypted by the dedicated program 51.

The flash memory 30 includes a communication module 33. The communication module 33 allows the flash memory 30 to access the security server 10, and allows the flash memory 30 to independently access the security server 10 without going through the terminal 50. . The communication module 33 may be a communication means of various standards such as WIFI, ZigBee, Z-Wave, or LTE. In order to drive the communication module 33, a battery may be embedded in the flash memory 30 or connected to the terminal 50 to receive power from the terminal 50.

In this way, the communication module 33 is embedded in the flash memory 30 to enable wireless communication with the security server 10, and when power is applied, the first authentication key is transmitted from the security server 10 or the security area 31 ) By transmitting the second authentication key previously stored in the security server 10 to compare the first authentication key and the second authentication key to selectively grant access to the internal security area 31 or the data storage unit 35 can do. Here, the object to be allowed to access may be the terminal 50 to be described below, or the portable terminal 50 wirelessly connected to the flash memory 30.

Meanwhile, the second authentication key may be input through an interface and then transmitted to the security server 10 to compare the first authentication key and the second authentication key. Here, the interface is the interface unit 36 or the display unit 38 to be described below.

The flash memory 30 includes a data storage unit 35. The data storage unit 35 is for storing various types of information in the flash memory 30, and refers to a space in which a user actually writes and reads data. The data storage unit 35 may be a part of the security area 31.

The flash memory 30 includes an interface unit 36 and a display unit 38. The interface unit 36 is for inputting information into the flash memory 30, and may be a button for inputting numbers or characters, or a biometric means such as a fingerprint reader or an iris reader. Alternatively, the interface unit 36 may be included in the display unit 38 to input information through a touch of the display unit 38. A second authentication key may be input through the interface unit 36.

Next, referring to the terminal 50, the terminal 50 is independent from the flash memory 30 and the security server 10, and may be a mobile communication means such as a computer, a mobile phone, or a tablet. The flash memory 30 may be connected to the terminal 50. For example, the flash memory 30 and the terminal 50 are connected to each other through a USB terminal to exchange information and power. In this embodiment, the terminal 50 supplies power to the flash memory 30.

Input of the second authentication key through the above-described interface may be performed through the interface unit 36 of the flash memory 30, but may be performed through the input means 53 of the combined terminal 50. The input means 53 of the terminal 50 can use various methods such as a keyboard, a mouse, or a touch input through the display unit 55 which is a screen. At this time, it may be input through dedicated software installed in the terminal 50, and if the dedicated software is not installed in the terminal 50, the flash memory 30 may induce the installation of the dedicated program. Of course, the terminal 50 has a main storage unit 57 for storing a dedicated program 51 and the like.

On the other hand, when the flash memory 30 is connected to the terminal 50, the terminal 50 may apply power to the flash memory 30 and transmit an internal third authentication key to the flash memory 30. . The third authentication key may be the computer's IP address or MAC address. Of course, if the dedicated program 51 is installed in the terminal 50, the third authentication key may be a dedicated authentication key encrypted by the dedicated program 51.

In addition, the security server 10 compares the third authentication key transmitted from the flash memory 30 with an authentication code of a previously stored access permission list to determine whether a corresponding authentication code exists. The result is transmitted to the flash memory 30, and the flash memory 30 allows the terminal 50 to access the data storage unit 35 if a corresponding authentication code exists. Not allowed.

A decryption key may be stored in the security area 31 of the flash memory 30. When the flash memory 30 is connected to the terminal 50, the decryption key may grant access to the cloud 100 to the terminal 50 or to the internal intranet to which the terminal 50 is connected. For example, the terminal 50 may obtain access rights to a specific site by using the provided decryption key, and may implement double encryption for a specific site through an additional ID/password.

The decryption key is transmitted to the terminal 50 when the flash memory 30 accesses the security server 10 and the access to the security area 31 is granted through a comparison of the first authentication key and the second authentication key. In this case, the decryption key may be provided in which the flash memory 30 accesses the security server 10 and an authentication code corresponding to the third authentication key of the terminal 50 exists in the security server 10. It can be provided to the terminal 50 only when it is confirmed.

Next, a flash memory security setting method using the flash memory security system according to the present invention will be described.

First, when power is applied to the flash memory 30, an initial connection step of connecting to the security server 10 through the built-in communication module 33 is preceded (S10). Here, the application of power may be an internal battery of the flash memory 30 or may be provided from the terminal 50. When the flash memory 30 accesses the security server 10, the first authentication key previously stored in the security server 10 is transmitted to the flash memory 30 or the security area 31 of the flash memory 30 The second authentication key previously stored in or input through the interface is transmitted to the security server 10 (authentication key transmission step).

Subsequently, the flash memory 30 or the security server 10 compares the first authentication key and the second authentication key (S20), checks whether the correspondence has been made, and transmits the result to the other party (authentication key confirmation step). If the authentication key is confirmed (S30), the flash memory 30 is followed by a connection grant step of selectively granting access to the security area 31 or the data storage unit 35 inside the flash memory 30 (S40). ) That is, it is to check whether the flash memory 30 is in a normal use state. If the lost flash memory 30 is used by a third party, the first authentication key will not match the second authentication key, and in this case, information inside the flash memory 30 cannot be obtained (S50). , Since the flash memory 30 of the present invention communicates independently and accesses the security server 10, the risk of information being damaged or manipulated in the process of passing through the terminal 50 is greatly reduced.

Meanwhile, if the user loses the flash memory 30, the user may access the security server 10 and select whether to use the first authentication key or change the first authentication key through additional authentication. If the use of the first authentication key is stopped through additional authentication, access to the security area 31 or the data storage unit 35 is denied, so that a third party cannot access. Here, the additional authentication may be performed through at least one of information input through an interface of the flash memory 30, a national authentication number, and a personal telephone number.

On the other hand, if authentication fails for more than a set number of times in the authentication key verification step, the flash memory 30 deletes the information stored in the data storage unit 35 or backs up the information to the security server 10 and then stores the stored information. In this case, since the flash memory 30 has an independent communication module 33, internal information can be backed up to the Bongna server without passing through the terminal 50. In addition, if authentication fails for more than a set number of times in the authentication key verification step, the security server 10 may transmit authentication attempt information to the user terminal 200 as a pre-stored contact information. In this case, the user can initiate a third party's access attempt. Recognize and, as described above, it is possible to select whether to use the first authentication key or change the first authentication key through additional authentication (S59).

In addition, a terminal authentication step in which the right to access the terminal 50 to the flash memory 30 is selectively granted may be added. The terminal authentication step is divided into two steps. First, in the first authentication step, when the flash memory 30 is coupled to the terminal 50, the third authentication key inside the terminal 50 is authenticated by the flash memory 30. It is transmitted to the key acquisition unit 32 (S60), and the authentication key acquisition unit 32 transmits the transmitted third authentication key to the security server 10 (S70).

Subsequently, in the second authentication step, the security server 10 compares the third authentication key transmitted from the flash memory 30 with the authentication code of the previously stored access permission list (S80), and checks whether the corresponding authentication code exists. It transmits to the flash memory 30, and the flash memory 30 allows the terminal 50 to access the data storage unit 35 if a corresponding authentication code exists (S90).

When the terminal 50 is allowed to access the internal security area 31 or the data storage unit 35 of the flash memory 30 through the authentication step of the terminal 50, the security area of the flash memory 30 Using the decryption key stored in (31), the access right of the cloud 100 is granted to the terminal 50, or the access right of the internal intranet to which the terminal 50 is connected is granted (S100, terminal access permission step).

In the terminal access granting step, the decryption key is that the flash memory 30 accesses the security server 10 to allow access to the security area 31 through comparison of the first authentication key and the second authentication key. It may be provided to the terminal 50 only in case. In addition, the decryption key is only when the flash memory 30 accesses the security server 10 and confirms that an authentication code corresponding to the third authentication key of the terminal 50 exists in the security server 10. It may be provided to the terminal 50.

When the decryption key is transmitted to the terminal 50, the user can access a specific site or internal intranet using the terminal 50. Of course, if there is a separate password for access, the decryption key may be for double encryption.

In the above, even if all the constituent elements constituting the embodiment according to the present invention have been described as being combined into one or operating in combination, the present invention is not necessarily limited to this embodiment. That is, within the scope of the object of the present invention, all of the constituent elements may be selectively combined and operated in one or more. In addition, terms such as "include", "consist of" or "have" described above mean that the corresponding component may be present unless otherwise stated, excluding other components Rather, it should be interpreted as being able to further include other components. All terms, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art, unless otherwise defined. Terms generally used, such as terms defined in the dictionary, should be interpreted as being consistent with the meaning of the context of the related technology, and are not interpreted as ideal or excessively formal meanings unless explicitly defined in the present invention.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains will be able to make various modifications and variations without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

10: security server 30: flash memory
50: terminal 100: cloud
200: user terminal

Claims (18)

A security server in which the first authentication key is stored,
It includes a communication module and an interface unit, and wireless communication with the security server is possible through the communication module, and when power is applied, the first authentication key is transmitted from the security server, or the first authentication key stored in the security area or inputted through the interface unit 2A flash memory that transmits the authentication key to the security server to compare the first authentication key and the second authentication key to selectively grant access to an internal security area or data storage unit;
When the flash memory is connected, power is applied to the flash memory, an internal third authentication key is transferred to the flash memory, and the flash memory includes a terminal that transmits the transferred third authentication key to a security server,
The security server compares the third authentication key transmitted from the flash memory with an authentication code of a pre-stored access permission list, and transmits the presence or absence of a corresponding authentication code to the flash memory, and the flash memory contains a corresponding authentication code. If present, allows the terminal to access the data storage unit,
A decryption key is stored in the security area of the flash memory, and when the flash memory is connected to the terminal, the decryption key grants cloud access rights to the terminal or the internal intranet access rights to which the terminal is connected. system.
The method of claim 1, wherein the user accesses the security server to select whether to use the first authentication key or change the first authentication key through additional authentication, and the use of the first authentication key is stopped through additional authentication. Flash memory security system in which access to the security area or data storage unit is prohibited in the state.
The flash memory security system of claim 2, wherein the additional authentication is performed through at least one of information input through an interface of the flash memory, a national authentication number, and a personal telephone number.
delete delete delete The flash memory of claim 1, wherein the decryption key is a flash memory that can be provided to the terminal when the flash memory accesses the security server and access to the security area is granted through comparison of the first authentication key and the second authentication key. Security system.
The method of claim 7, wherein the decryption key is a flash that can be provided to the terminal only when the flash memory accesses the security server and confirms that an authentication code corresponding to the third authentication key of the terminal exists in the security server. Memory security system.
The initial connection step of accessing the security server through the built-in communication module when the flash memory is powered on, and
Authentication in which a first authentication key previously stored in the security server is transmitted to the flash memory, or a second authentication key previously stored in a security area of the flash memory or input through an interface unit included in the flash memory is transmitted to the security server Key transmission step,
The flash memory or the security server compares the first authentication key and the second authentication key, checks whether the correspondence has been made, and transmits the result to the counterpart;
When the authentication key is confirmed, the flash memory selectively grants access to a security area or data storage unit inside the flash memory;
The application of the power may be provided from the terminal when the flash memory is coupled to the terminal, and includes a terminal authentication step in which the terminal is selectively granted permission to access the flash memory,
The terminal authentication step
When the flash memory is coupled to the terminal, a third authentication key inside the terminal is transmitted to an authentication key acquisition unit of the flash memory, and the authentication key acquisition unit transmits the transmitted third authentication key to a security server; ,
The security server compares the third authentication key transmitted from the flash memory with an authentication code of a pre-stored access permission list, and transmits the presence or absence of a corresponding authentication code to the flash memory, and the flash memory contains a corresponding authentication code. If present, it consists of a second authentication step that allows the terminal to access the data storage unit,
When the terminal is granted access to the internal security area or data storage unit of the flash memory through the terminal authentication step, the terminal is granted access to the cloud by using the decryption key stored in the security area of the flash memory, or A method for setting security of a flash memory, further comprising a step of granting access rights to a connected internal intranet.
The method of claim 9, wherein the user accesses the security server to select whether to use the first authentication key or change the first authentication key through additional authentication, and the use of the first authentication key is stopped through additional authentication. In this state, access to the secure area or data storage unit is prohibited.
The method of claim 10, wherein the additional authentication is performed through at least one of information input through an interface of the flash memory, a national authentication number, and a personal telephone number.
10. The flash memory of claim 9, wherein if authentication fails for more than a set number of times in the authentication key verification step, the flash memory deletes information stored in the data storage unit or deletes the stored information after backing up information to a security server. Of security settings
The method of claim 12, wherein if authentication fails for more than a set number of times in the authentication key verification step, the security server transmits authentication attempt information to a previously stored contact number.
delete delete delete The method of claim 9, wherein in the terminal access granting step, the decryption key is transmitted to the terminal when the flash memory accesses the security server and is granted access to the security area through comparison of the first authentication key and the second authentication key. Flash memory security setting method that can be provided.
The method of claim 17, wherein the decryption key is a flash that can be provided to the terminal only when the flash memory accesses the security server and confirms that an authentication code corresponding to the third authentication key of the terminal exists in the security server. How to secure memory.

Images