KR20100128413A - Certificate Management System and Method - Google Patents

Abstract

A certificate management system and method are disclosed.

The disclosed certificate management system receives the device information of the medium in which the certificate is stored through the user terminal, generates the original confirmation value, and transmits the original confirmation value to the user terminal, thereby generating the original confirmation value to be inserted into the private key paired with the certificate. Contains wealth.

Description

System and Method for Management of Certificate

The present invention relates to a certificate-based authentication system, and more particularly to a certificate management system and method.

Transactions made online, such as the Internet, are non-face-to-face transactions made in cyberspace without seeing each other. In this non-face-to-face transaction, identification of the other party is most important. For this purpose, user authentication is performed using a certificate.

In order to perform e-commerce payments and bank transactions using a certificate, a private key and a public key are first generated. The certificate authority issues a certificate using the public key, and encrypts the private key with a password. When the electronic payment is entered, if a password given to the private key is inputted when the certificate is issued, the electronic signature value is transmitted to the target service authority, and user authentication is performed.

These certificates are stored and used in personal computers, portable terminals and portable data storage devices. However, when the certificate and the password are leaked due to a hacker attack or the certificate storage medium is lost, the electronic payment can be made by others.

In recent years, there has been a frequent case of denying a transaction after a certificate holder himself performs an electronic payment. In this case, there is no way to prove that this is the intended transaction by the certificate holder.

As such, electronic payment systems using current certificates are vulnerable to external leakage of certificates and passwords and cannot prove transaction denials. Therefore, not only users who use electronic transaction services, but also service providers and financial companies suffer mental and economic damage.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and there is a technical problem to provide a certificate management system and method capable of accurately determining the legality of a certificate.

The certificate management system according to an embodiment of the present invention for achieving the above technical problem is a certificate management system connected to a user terminal through a communication network, by receiving the device information of the medium in which the certificate is stored through the user terminal to verify the original And an original confirmation value generation unit for generating a value and transmitting the generated original value to the user terminal to insert the original confirmation value into a private key paired with the certificate.

On the other hand, the certificate management method according to an embodiment of the present invention is a certificate management method in the certificate management system including an original confirmation value generation unit for generating an original confirmation value according to the device information of the medium in which the certificate is stored, the user the certificate is stored Receiving, by the original confirmation value generation unit, device information of the medium in which the certificate is stored from the user terminal when the terminal or the user terminal in which the medium in which the certificate is stored is externally connected to the certificate management system; Generating an original confirmation value by using the received device information by the original confirmation value generation unit; And generating the original certificate by transmitting the original confirmation value generation unit to the user terminal and inserting the original confirmation value into the private key paired with the certificate.

According to the present invention, the validity of a certificate can be determined using the device information of the digital device storing the certificate, so that the certificate can be used only in the registered device.

In addition, when the certificate is to be used outside the registered device, a certificate as a copy of the original handwriting is generated through a user authentication process, so that electronic payment by a legitimate user can be smoothly performed.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a view for explaining a connection relationship between a certificate management system and a communication network according to an embodiment of the present invention.

The certificate management system 10 according to an embodiment of the present invention is connected to the user terminal 30 and a service provider (SP) server 40 through the communication network 20.

The communication network 20 may include a wired communication network or a wireless communication network, and the user terminal 30 may be a communication terminal, and a certificate may be stored in itself, or a digital device storing the certificate may be external.

The SP server 40 may be any web server that provides an electronic transaction service through a communication network such as a financial company server or an online shopping mall server, and a user who has received a certificate and a password from a certification authority is provided by the SP server 40. Electronic transaction services are available.

In the present invention, the certificate management system 10 adds the original verification value to the private key paired with the certificate issued by the user from the certification authority. To this end, the user accesses the certificate management system 10 using his terminal 30 and transmits the device information of the medium in which the certificate is stored.

Accordingly, the certificate management system 10 generates an original confirmation value based on the device information and transmits it to the user terminal 30 so that the original confirmation value is inserted into the private key paired with the certificate.

When the user with the private key to which the original confirmation value is added performs electronic payment, the SP server 40 requests verification of the certificate to the certificate management system 10. That is, the SP server 40 transmits the electronic signature, the original confirmation value, and the device information of the digital device in which the certificate is stored to the certificate management system 10 to request whether the user is a legitimate user. Accordingly, the certificate management system 10 verifies the digital signature and the original confirmation value. That is, it is to check whether the device information used in generating the original confirmation value and the device information transmitted in the authentication request are the same. And, if it is confirmed that the validity of the digital signature and the original confirmation value as a result of the electronic payment is to be performed.

In another embodiment of the present invention, the certificate management system 10 may provide a solution for verifying a certificate to the SP server 40 so that the SP server 40 can verify the certificate by itself.

If the verification result of the certificate is verified as an invalid certificate, especially when the original verification value does not match, it may be determined that the digital device storing the certificate is not a registered device. In this case, ask the user for device information of the digital device where the certificate is stored and reissue the original confirmation value. The reissued original confirmation value is inserted into the private key paired with the certificate, and the certificate is managed as a copy of the original replacement.

In this sense, a certificate paired with a private key with the original issued original verification value inserted may be defined as an original certificate, and a certificate paired with a private key with a reissued original verified value inserted as an original collation copy certificate. In addition, in the case of the original countercopy copy certificate, it is also possible to limit the electronic payment possible range by granting separate authority separate from the original certificate.

Therefore, when the device information of the digital device on which the original certificate or the original copy copy certificate is stored does not match the device information used to generate the original confirmation value, the electronic payment may be restricted by classifying it as an illegal copy certificate.

2 is a configuration diagram of the certificate management system shown in FIG.

Referring to FIG. 2, the certificate management system 10 includes a control unit 110, an original confirmation value generation unit 120, an original authentication unit 130, and a database 160 that control overall operations.

The original confirmation value generation unit 120 receives the device information of the medium in which the certificate is stored from the user terminal to generate the original certificate, generates the original confirmation value, and transmits the generated original confirmation value to the user terminal to pair with the certificate. It should be inserted into the private key. The original confirmation value and device information generated by the original confirmation value generation unit 120 are stored in the database 160.

In addition, the original authentication unit 130 receives the electronic signature, the original confirmation value, and the device information of the medium in which the certificate is stored from the user terminal when performing the electronic payment. The device information of the medium on which the certificate is stored is compared with the device information used to generate the original confirmation value, and if it matches, it is determined that the request is an electronic payment request by a legitimate user.

If the device information does not match, the user terminal can be requested to reissue the original confirmation value. Accordingly, when the device information of the medium in which the certificate is stored is transmitted from the user terminal, the original confirmation value generating unit 120 reissues the original confirmation value and inserts it into the private key paired with the certificate.

In this case, it is preferable to store the certificate of the original handwriting copy as a certificate issuance record by re-issuing the original confirmation value from the device information of the other medium, not the device information of the medium used to issue the original original confirmation value. To this end, the certificate management system 10 further includes a history management unit 140 to store and manage the original control copy certificate issuance details in the database 160.

On the other hand, when re-issuing the original confirmation value to generate the original counter-copy copy certificate, it is preferable that the authentication for the payment requester is performed. In order to perform the user authentication, the certificate management system 10 may further include a user authentication unit 150. Before re-issuing the original verification value, the user authentication unit 150 attempts to reissue the original verification value by using any one of various authentication methods such as a Short Message Service (SMS) method, a security card method, and an One Time Password (OTP) method. Make sure the user you are using is a legitimate user. To this end, the certificate management system 10 must be collected in advance of the user's mobile terminal number, security card information, OTP information, etc. to be used for authentication.

As described above, the present invention does not simply perform user authentication based on the digital signature value of the certificate, but authenticates the certificate using device information of a medium in which the certificate is stored. Therefore, when requesting an electronic payment using a certificate stored in an unregistered medium, a copy of the original handwriting certificate may be issued, or the certificate may be managed as a copy to prevent malicious payment according to the validity of the requestor. have.

3 is a flowchart illustrating a certificate management method according to an embodiment of the present invention.

In order to issue the original certificate using the original confirmation value, the user accesses the certificate management system 10 using the terminal 30. Here, the user terminal 30 has a certificate stored on its own or an external medium storing the certificate.

Accordingly, the original confirmation value generation unit 120 of the certificate management system 10 receives the device information of the medium in which the certificate is stored from the user terminal 30 (S103) and generates an original confirmation value (S105).

Thereafter, the generated original confirmation value is transmitted to the user terminal 30 (S107) and inserted into a private key paired with a certificate (S109).

In this way, the original certificate paired with the private key containing the original confirmation value is generated. When the electronic payment is to be performed using the original certificate, verification of the original confirmation value as well as the transcription signature for the certificate should be made. This will be described with reference to FIG. 4.

4 is a flowchart illustrating a certificate management method according to another embodiment of the present invention.

After the user accesses the SP server 40 using the terminal 30 (S201), as the electronic transaction is requested (S203), the SP server 40 sends the verification data about the certificate to the user terminal 30. request. In this case, the user terminal 30 is a terminal that stores a certificate on its own or that is external to a medium in which the certificate is stored.

Accordingly, as the verification data, that is, the electronic signature, the original verification value and the device information for the certificate are transmitted from the user terminal 30 (S205), the SP server 40 transmits the verification data to the certificate management system 10. By requesting authentication for the certificate (S207). The original authentication unit 130 of the certificate management system 10 verifies the digital signature and the original confirmation value by using the verification data transmitted from the SP server 40, and transmits the result to the SP server 40, SP The server 40 checks whether the user who requested the electronic payment is legal according to the verification result (S209).

As a result of the check, if the user is a legitimate user, the electronic payment process is performed (S211).

On the other hand, if the user is not a legitimate user, in particular, the device information used to generate the original confirmation value and the device information transmitted from the user terminal 30 in step S205 does not match the original certificate to the user terminal 30 It is requested to register as a check copy copy certificate (S213).

Accordingly, when the device information of the medium in which the certificate is stored is transmitted from the user terminal 30 to the certificate management system 10 (S215), the original confirmation value generation unit 120 of the certificate management system 10 receives the received device information. Regenerate the original confirmation value using (S219), and transmits it to the user terminal 30 (S221). Then, the original confirmation value transmitted to the user terminal 30 is inserted into the private key paired with the certificate (S223).

In a preferred embodiment of the present invention, after receiving the device information for generating the original confirmation value, before generating the original confirmation value, the authentication process to check whether the user is legitimate by the user authentication unit 150 (S217) Can be further performed. In other words, to confirm whether the user who wants to generate the original certificate is the holder of the certificate, the user who wants to be issued the original verification value using any one of various authentication methods such as SMS method, security card method, and OTP method is a legitimate user. will be. To this end, the certificate management system 10 must be collected in advance of the user's mobile terminal number, security card information, OTP information, etc. to be used for authentication.

In addition, after re-issuing the original confirmation value to generate the original handwritten copy certificate, the history management unit 140 of the certificate management system 10 stores the issuance history of the original handwritten copy certificate in a database, thereby providing evidence of malicious electronic payment. Use it as a resource.

In the above description that the certificate authentication by the verification data is performed in the certificate management system 10, but is not limited thereto. That is, the certificate management system 10 provides a solution for certificate authentication to the SP server 40, and of course, it is also possible to perform certificate authentication by the SP server 40 itself.

As such, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical spirit or essential features thereof. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

The present invention can provide a stable electronic payment service against hacker attacks by verifying the original verification value generated based on the device information even when the certificate and password are leaked.

In addition, by storing the issuance history of the original certificate and the original counter-copy copy certificate, it is possible to prevent the certificate holder of the transaction denial.

In addition, by processing a copy certificate other than the original certificate or the original copy copy certificate registered by the user, it is possible to prevent the financial company from performing arbitrary or malicious electronic payments.

1 is a view for explaining a connection relationship between a certificate management system and a communication network according to an embodiment of the present invention;

2 is a configuration diagram of the certificate management system shown in FIG.

3 is a flowchart illustrating a certificate management method according to an embodiment of the present invention;

4 is a flowchart illustrating a certificate management method according to another embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

10: certificate management system 110: control unit

120: original confirmation value generation unit 130: original authentication unit

140: history management unit 150: user authentication unit

160: database

Claims (12)

A certificate management system connected to a user terminal through a communication network, An original confirmation value generation unit receiving the device information of the medium in which the certificate is stored through the user terminal to generate an original confirmation value and transmitting the original confirmation value to the user terminal to insert the original confirmation value into a private key paired with the certificate. ; Certificate management system comprising a. The method of claim 1, In response to an electronic payment request from the user terminal, an electronic signature, an original confirmation value inserted into a private key paired with the certificate, and device information of a medium in which the certificate is stored are received from the user terminal. Original authenticator for verifying the confirmation value; Certificate management system comprising more. The method of claim 2, The original confirmation value generation unit stores the device information used to generate the original confirmation value, And the original authenticator verifies the original confirmation value by comparing the stored device information with device information received from the user terminal according to the electronic payment request. The method of claim 3, wherein And if the verification of the original verification value fails as a result of the verification of the original authenticator, the original verification value generation unit reissues the original verification value to the user terminal. The method of claim 4, wherein And a history management unit for managing the certificate paired with the private key in which the reissued original confirmation value is inserted as an original handwritten copy certificate, and storing an issuance history of the original handwritten copy certificate. The method of claim 5, The certificate management system further comprises a user authentication unit for confirming whether the user to be issued the original counter-copy copy certificate is legitimate. A certificate management method in a certificate management system including an original identification value generation unit for generating an original identification value according to device information of a medium in which a certificate is stored. Receiving, by the original confirmation value generation unit, device information of the medium in which the certificate is stored from the user terminal when the user terminal in which the certificate is stored or the user terminal in which the medium in which the certificate is stored is connected to the certificate management system; Generating an original confirmation value by using the received device information by the original confirmation value generation unit; And Generating an original certificate by transmitting the original confirmation value generation unit to the user terminal and inserting the original confirmation value into a private key paired with the certificate; Certificate management method comprising a. The method of claim 7, wherein After generating the original certificate, Receiving, by the content provider server, verification data from the user terminal as the user terminal accesses a content provider server and requests electronic payment; Verifying, by the content provider server, the certificate according to the verification data; Proceeding with an electronic payment when it is determined that the certificate is verified as a legitimate user; Certificate management method comprising a. The method of claim 8, The verification data includes an electronic signature, an original confirmation value, and device information of a medium in which the certificate is stored. The verifying of the certificate may include comparing device information used in generating an original confirmation value inserted into the original certificate with device information included in the verification data. The method of claim 8, Requesting registration of an original certificate from the user terminal when it is determined that the certificate is not a legitimate user; Receiving, by the original certificate value generation unit, device information of a medium in which the certificate is stored, from the user terminal according to the original certificate registration request; Regenerating an original confirmation value using the received device information by the original confirmation value generation unit; And Generating an original counter copy copy certificate by transmitting the original confirmation value generation unit to the user terminal and inserting the original confirmation value in the private key paired with the certificate; Certificate management method further comprising. The method of claim 10, And after receiving the device information, before performing the step of regenerating the original confirmation value, confirming whether the user who is to be reissued the original confirmation value is legitimate. The method of claim 9, The certificate management system further includes an original authenticator for authenticating a certificate, wherein the verifying of the certificate according to the verification data by the content provider server comprises: transmitting, by the content provider server, the verification data to the original authenticator. step; And Generating, by the original authentication unit, a verification result according to the verification data, and transmitting the verification result to the content provider server; Certificate management method comprising a.

Images