KR101870042B1 - Efficient public key extraction method from implicit certificates - Google Patents

Abstract

A method and system for extracting an efficient public key from an implicit certificate are disclosed. A public key extraction method according to an exemplary embodiment of the present invention includes receiving an electronic certificate based on a message to which an electronic signature transmitted from a sender is added; Extracting a public key of the sender by reusing a result calculated in a previous public key extraction process when sharing the same certification authorities related to the digital signature; And performing signature verification on the digital signature using the extracted public key.

Description

[0001] EFFICIENT PUBLIC KEY EXTRACTION METHOD FROM IMPLICIT CERTIFICATES [0002]

The following description relates to a public key extraction technique and relates to a method and system for extracting a public key from an implicit certificate.

Because messages can be falsified or tampered by malicious attackers over network communications, the integrity and authenticity of messages must be assured in communication protocols. To solve this problem, the sender of the message sends the message and the digital signature together, and the receiver must be able to verify that the digital signature is valid.

1 is a diagram for explaining a public key extraction process. Such a digital signature is based on a public key cryptosystem. The public key cryptosystem is generated based on a mathematical problem that is very difficult to solve. It is generated from a secret key of a certain type (public key) and public information Use the key pair. Each of the clients (sender and receiver) 110, 120 may each have a certificate of a trusted authority. At this time, the clients 110 and 120 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the clients 110 and 120 include a smart phone, a mobile phone, a navigation device, a computer, a notebook, a digital broadcast terminal, a PDA (Personal Digital Assistants), a PMP (Portable Multimedia Player) . It may also be a server for transmitting a message with an electronic signature added thereto.

The originator 110 may generate a digital signature for the message using the secret key of the sender, and then send the digital signature added message to the recipient 120. The recipient 120 receives the message with the digital signature added thereto from the sender 110. [ The recipient 120 can verify the electronic signature of the message using the sender's public key. Generally, the public key of the sender 110 is provided with an electronic certificate for verifying the validity of the public key. The certification authority (CA) 100 means a trusted authority issuing an electronic certificate. The electronic certificate may be configured in such a manner that the public key information and the related additional information of the sender as the validity proof message are used as a message and the digital signature is added to the message by the certification authority 100.

If the recipient 120 does not know the public key of the certification authority 100, the electronic signature of the certification authority 100 is transmitted to the certificate authority 100, It is necessary to construct a chain of trust chains in such a way that a higher certification authority (CA ') issues an electronic certificate for the public key of the certification authority (CA). At the middle or end of such a chain, the recipient may have a digital signature of the certificate authority that has the public key, from which the validity is verified in the reverse direction, so that the public key of the sender can be confirmed. For example, Referring to FIG. 2, CA ₁ issued to the sender of the electronic certificates are issued a certificate from a more top certification organization CA _2, CA ₂ has been issued a certificate from the CA _3, the way to the root certification authority . In practice, an electronic certificate exists in the form of a chain of multiple certificates connected.

On the other hand, in a special network communication environment, the communication bandwidth may be extremely limited. In order to do so, corresponding protocols may use an implicit certificate in place of the existing explicit certificate including the public key of the sender and the signature of the certification authority . In this case, the certificate is not a combination of the public key and the signature, that is, the two pieces of information, but exists as the certificate itself, and the recipient extracts the public key of the sender from the certificate. This saves bandwidth usage. For example, the IEEE 1609.2 automotive communications standard, Wireless Access in Vehicular Environments (WAVE), uses the Elliptic Curve Digital Signature Algorithm (ECDSA) as an electronic signature algorithm and the Elliptic Curve Qu-Vanstone (ECQV)

The present invention can provide a method of extracting a public key of a sender by using reconstruction information in a certificate and efficiently extracting a public key in a process of performing signature verification.

A public key extraction method includes: receiving an electronic certificate based on a message to which an electronic signature transmitted from a sender is added; Extracting a public key of the sender by reusing a result calculated in a previous public key extraction process when sharing the same certification authorities related to the digital signature; And performing signature verification on the digital signature using the extracted public key.

The extracting of the public key of the sender may include extracting a hash value of the implicit certificate and public key reconstruction information encoded in the implicit certificate according to the use of the implicit certificate as the electronic certificate and extracting the hash value and the reconstruction information And extracting the public key of the sender using the public key of the certification authority that issued the implicit certificate.

The step of extracting the public key of the sender may include extracting a public key of the certification authority from an implicit certificate for the certification authority issued by an authentication authority higher than the certification authority in the case of failing to identify the public key of the certification authority .

In performing the signature verification on the digital signature using the extracted public key, a batch signature verification method including the ECDSA or the modified ECDSA may be applied.

-좌표, 상기 전자 서명이 부가될 메시지의 해시값 및 상기 발신자의 개인키를 이용하여 생성된 제1 서명쌍을 사용하여 상기 임시점을 재구성함에 따라 획득된 재구성점의

-좌표를 비교하거나, 상기 제1 서명쌍 대신 상기 임시점이 포함된 제2 서명쌍을 사용하여 상기 재구성점과 상기 임시점을 비교하는 단계를 포함할 수 있다. Wherein the step of performing the signature verification on the digital signature using the extracted public key comprises the steps of:

- a hash value of the message to which the digital signature is to be added and a first signature pair generated using the sender's private key,

- comparing the coordinates or comparing the temporary point with the reconstruction point using a second signature pair including the temporary point instead of the first signature pair.

A public key extraction system includes: a receiver for receiving an electronic certificate based on a message to which an electronic signature transmitted from a sender is added; An extraction unit for extracting the public key of the sender by reusing the result calculated in the previous public key extraction process when sharing the same certification authorities related to the digital signature; And an execution unit for performing signature verification on the digital signature using the extracted public key.

The present invention can reduce the overall amount of computation by reusing repeated operations in extracting a public key from an implicit certificate of each sender when verifying a signature received from a plurality of senders.

The present invention can reduce the time required for the public key extraction process by reducing the amount of computation by extracting the public key by sharing the inherent certificate operation received from the same certification authority.

1 is a diagram for explaining a public key extraction process.
Fig. 2 is a diagram for explaining a configuration of a chain of trust chains of a certification authority.
3 is a diagram for explaining a method of extracting a public key from an implicit certificate through a certificate tree, according to an embodiment of the present invention.
4 is a block diagram illustrating a configuration of a public key extraction system according to an embodiment.
FIG. 5 is a flowchart illustrating an entire process of signature verification in a public key extraction system according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

In the following embodiment, a procedure for extracting an efficient public key from an implicit certificate will be described. In order to carry out the verification of the digital signature, the public key of the sender of the electronic signature must first be known. In the protocol using the conventional explicit certificate, the public key of the sender included in the certificate is used, whereas in the embodiment, the hash value of the certificate, the reconstruction information in the certificate, and the certificate are issued based on the protocol using the implicit certificate The public key of the sender can be extracted and used by using the public key of the certification authority.

)의 내재적 인증서로부터 인증서의 해시값(

) 및 인증서에 인코딩되어 있는 공개키 재구성 정보(

)를 추출하고, 인증 기관(CA)의 공개키(

)를 사용하여 발신자의 공개키를 아래와 같은 식에 기초하여 추출할 수 있다.For example, using Certicom's ECQV implicit certificate, the public key of the digital signature originator can be extracted from the implicit certificate. Caller(

) From the implicit certificate of the certificate (

) And public key reconstruction information encoded in the certificate (

), Extracts the public key of the certification authority (CA)

) Can be used to extract the public key of the sender based on the following equation.

Equation (1)

)를 알고 있지 않을 경우, 상기 인증 기관보다 상위의 인증 기관이 발급한 인증 기관의 내재적 인증서로부터 인증 기관의 공개키를 추출하는 과정이 추가로 필요하며, 이를 재귀적으로 적용할 수 있다. At this time, the public key of the certification authority

), The process of extracting the public key of the certification authority from the internal certificate of the certification authority issued by the certification authority higher than the certification authority is further needed, and it can be recursively applied.

)를 알고 있다면, 발신자의 공개키는 아래와 같은 식으로 추출할 수 있다.For example, if the implicit certificate of the certificate authority associated with the sender's implicit certificate is L -1 and the recipient is the last public key of the top-level certificate authority (CA _L )

), The sender's public key can be extracted as follows.

Equation 2:

라고 할 때, 발신자 1(U ₁)의 공개키 추출 과정에서 명시적 인증서에 포함된 공개키인 최상위 인증 기관(CA _L )의 공개키(

)를 제외하면, 아래와 같이 부분 결과를 점차적으로 누적하는 형식으로 계산될 수 있다. At this time, the Straus algorithm, which can efficiently obtain a constant multiple of the points on the elliptic curve, can be applied to extract the public key. The size of the window

, The public key of the top-level certification authority (CA _L ), which is a public key included in the explicit certificate in the public key extraction process of the sender 1 ( U ₁ )

), It can be calculated in the form of gradually accumulating partial results as follows.

비트씩 이동하여

회 반복될 수 있다. This calculation process can be used to

Bit by bit

Times.

) 및 인증서에 인코딩되어 있는 공개키 재구성 정보(P)가 동일하기 때문에 이전의 공개키 추출 과정에서 계산한 결과를 재사용할 수 있다. In addition, when a digital signature is input from a plurality of senders, the public key extraction process must be performed a plurality of times. At this time, if the same intermediate certification authorities are shared, the hash value of the certificate

) And the public key reconstruction information ( P ) encoded in the certificate are the same, the result calculated in the previous public key extraction process can be reused.

For example, suppose there are two callers U ₁ , U ₂ . Caller U _1, as is U ₂ above, when sharing the certificate of the L number of the certificate authority connected to the own certificate, the public key extracted expression of U ₁ Equation (3), the public key extracted expression of U ₂ (4) and As shown in Fig.

Equation (3)

Equation 4:

의 계산이 중첩되게 된다. 이에 따라 공개키 계산을 처음 1회 수행한 후, 이후의 계산에서는 계산 결과를 재사용할 수 있다. 더욱 상세하게는, U ₁의 공개키를 추출하는 과정에서, At this time, in extracting the public keys of U ₁ and U ₂ ,

Are superimposed on each other. Thus, after performing the first public key computation once, the computation results can be reused in subsequent computations. More specifically, in the process of extracting the public key of U ₁ ,

을 제외하면, U ₂의 공개키를 추출하는 과정에서도 공통으로 계산해야 하는 부분이므로, 중간 결과를 저장할 수 있다. 이후, 저장된 중간 결과는 U ₂의 공개키를 추출하는데 사용될 수 있다. The process of accumulating the subtotals in the order of

, The intermediate result can be stored because it is a part to be commonly calculated in the process of extracting the public key of U ₂ . The stored intermediate result can then be used to extract the public key of U ₂ .

개의 내재적 인증서를 공유한다고 할 때, U₂공개키 추출에서 한 단계 계산 비용은

(점의 두배 연산

회, 점의 덧셈 연산 L회)에서

(점의 두 배 연산

회, 점의 덧셈 연산

회)로 줄어들게 된다. When the above method is used,

If we share two intrinsic certificates, the cost of one step computation in U ₂ public key extraction is

(Double operation of the point

L, addition operation of point, point)

(Double operation of the point

Addition of point and point

).

) 및 연결된 공개키를 수신자가 이미 알고 있을 때, 발신자의 인증서를

, 연결된 중간 인증 기관의 인증서를

이라고 표시하면, 본 발명의 실시예에 따른 내재적 인증서에서 공개키를 추출하는 방법은 도 3을 참고하면, 인증서 트리를 이용하여 설명할 수 있다. 이때, 모든 발신자(U _i)에 대해

및

의 비트 수는 같으며,

의 배수라고 가정하자. The implicit certificate of the sender is linked to the L- 1 intermediate CA's implicit certificate, and the certificate of the top-level CA

) And the associated public key is already known by the recipient, the certificate of the sender

, The certificate of the connected intermediate certification authority

A method of extracting a public key from an inherent certificate according to an embodiment of the present invention will be described using a certificate tree with reference to FIG. At this time, for all senders ( U _i )

And

Lt; RTI ID = 0.0 >

.

For each sender U _i , the intermediate result

노드가 존재)Is already calculated, (that is,

Node exists)

를 새로운 중간 결과로서 계산하고,

노드에 계산된 중간 결과인

을 저장할 수 있다.

As a new intermediate result,

Intermediate result computed at node

Lt; / RTI >

를 새로운 중간 결과로서 계산하고,

노드에 계산된 중간 결과인

를 저장할 수 있다. Likewise,

As a new intermediate result,

Intermediate result computed at node

Can be stored.

부터 X ₁까지 계산할 수 있다. With this calculation method,

To X ₁ .

를 새로운 중간 결과로 계산하고, CA₁ 노드에 계산된 중간 결과인 X₁을 저장할 수 있다.

As a new intermediate result, and store the intermediate result X ₁ calculated at the CA ₁ node.

를 계산할 수 있다.

는 계산에 발신자의 내재적 인증서 정보를 포함하기 때문에 다른 발신자들과는 공유하지 않는다. 따라서

는 저장하지 않는다.Finally, the final result for U _i

Can be calculated.

Does not share with other senders because it includes the sender's implicit certificate information in the calculation. therefore

Is not stored.

배 연산과

및

각각의 다음

비트들에 대하여 앞서 설명한 계산 과정(중간 결과 계산 과정)을 반복하는 Left-to-Right Straus 알고리즘으로

를 계산할 수 있다. 그 후, 이미 알고 있는 인증 기관의 공개키(

)를 가산함으로써 U _i의 공개키

를 계산할 수 있다. Then, for intermediate result points

Multiplication operation and

And

Each of the following

Left-to-Right Straus algorithm that repeats the above-described calculation process (intermediate result calculation process) on bits

Can be calculated. Then, the public key of the known certification authority (

) To add U _i 's public key

Can be calculated.

-좌표인 r및 메시지의 해시값인 H(m)에 서명자의 개인키를 사용하여 생성하는 서명쌍 (r, s)를 사용할 수 있고, 서명 검증 과정에서는 임시점(R)을 재구성함에 따라 재구성점(R')를 획득하고, 재구성점(R')의

-좌표와 r을 비교하여 서명의 유효성을 검증할 수 있다. In performing digital signature verification, in general, a batch signature verification method is applied to shorten the time for verifying a plurality of signatures inputted from a sender. For bulk signature verification, a modified ECDSA can generally be used. The default ECDSA is the signature of the temporary point (R)

- The signature pair (r, s), which is generated using the signer r and the signer's private key in the hash value H (m) of the message, can be used. In the signature verification process, Obtain the point R ' , and obtain the point R' of the reconstruction point R '

- The validity of the signature can be verified by comparing the coordinates with r.

라고 할 때, 메시지의 전자 서명은 임시점(R)과

를 비교함으로써 검증될 수 있다. 일괄 서명 검증에서는 복수의 전자 서명에 대하여

(

는 난수(randomizer))와

, 다시 말해서, In a modified ECDSA signature pair (r, s) Instead, (R, s) signature pair reconstruction point (R ') and that the temporary use of a (R) can be compared directly. More specifically, the hash value H (m) of the message received from the sender, the base point of the elliptic curve is G, the electronic signature of the message is (R, s), the coordinates of the temporary point R are r, The public key of

, The digital signature of the message is the temporary point R

Lt; / RTI > In the collective signature verification,

(

Is a randomizer) and

, In other words,

를 비교함으로써 보다 빠른 서명 검증이 가능하게 된다.

To enable faster signature verification.

According to one embodiment, the public key extraction system is enabled to obtain the public key of the normal caller. Since the intermediate calculation result of the same implicit certificate is reused as in the existing public key extraction process, the same value as the public key of the sender to be extracted can be obtained.

According to the embodiment, the public key extraction system can reduce the digital signature verification time by applying both the basic digital signature verification in the protocol using the existing inherent certificate and the digital signature verification method applying the collective signature verification method.

FIG. 4 is a block diagram illustrating a configuration of a public key extraction system according to an embodiment. FIG. 5 is a flowchart illustrating an entire process of signature verification in a public key extraction system according to an exemplary embodiment.

The public key extraction system 400 may include a receiving unit 410, an extracting unit 420, and an executing unit 430. The components of the public key extraction system 400 and the public key extraction system 400 may control the public key extraction system to perform the steps 510 to 530, which includes the entire process of signature verification of FIG. 5 . At this time, the components of the public key extraction system 400 and the public key extraction system 400 may be implemented to execute an instruction according to code of an operating system and code of at least one program included in the memory. Here, the components of the public key extraction system 400 may include different functions performed by the public key extraction system 400 in accordance with control commands provided by the program code stored in the public key extraction system 400, ≪ / RTI >

In step 510, the receiving unit 410 may receive the electronic certificate based on the message to which the electronic signature transmitted from the sender is added.

In step 520, if the extraction unit 420 shares the same certification authorities related to the digital signature, it can extract the public key of the sender by reusing the result calculated in the previous public key extraction process. For example, in extracting the public keys of a plurality of senders, a portion of the calculation process may overlap. Accordingly, in the public key extraction calculation after the calculation for extracting the first public key is performed, the overlapping calculation process can be reused.

The extraction unit 420 extracts the hash value of the implicit certificate and the public key reconstruction information encoded in the implicit certificate by using the implicit certificate as the electronic certificate, and outputs the hash value, the reconstruction information, and the publicity of the certification authority that issued the implicit certificate Keys can be used to extract the sender's public key. If the extraction unit 420 can not identify the public key of the certification authority, the extraction unit 420 may extract the public key of the certification authority from the internal certificate for the certification authority issued by the certification authority higher than the certification authority. In this case, the Straus algorithm that efficiently derives a constant multiple of the points on the elliptic curve can be applied in the calculation process of extracting the public key.

In step 530, the execution unit 430 may perform signature verification on the digital signature using the extracted public key. The execution unit 430 may apply the batch signature verification method in order to shorten the time for verifying the inputted multiple signatures in the signature verification of the digital signature. ECDSA modified by signature algorithm for collective signature verification can be applied.

-좌표, 전자 서명이 부가될 메시지의 해시값 및 발신자의 개인키를 이용하여 생성된 제1 서명쌍(r, s)을 사용하여 임시점을 재구성함에 따라 획득된 재구성점의

-좌표를 비교할 수 있다. 또는 수행부(430)는 제1 서명쌍 대신 상기 임시점이 포함된 제2 서명쌍(R, s)을 사용하여 재구성점과 임시점을 비교할 수 있다. The execution unit 430 generates a digital signature based on the obtained temporary point

- coordinates, the hash value of the message to which the digital signature is to be added, and the first signature pair (r, s) generated using the sender's private key to reconstruct the temporary point

- Coordinates can be compared. Alternatively, the performing unit 430 may compare the temporary point with the reconstruction point using the second signature pair (R, s) including the temporary point instead of the first signature pair.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be embodyed temporarily. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (6)

In a public key extraction method,
Receiving an electronic certificate based on a message added with an electronic signature transmitted from a sender;
Extracting a public key of the sender by reusing a result calculated in a previous public key extraction process when sharing the same certification authorities related to the digital signature; And
Performing signature verification on the digital signature using the extracted public key
Lt; / RTI >
Wherein the step of extracting the sender's public key comprises:
Extracting the hash value and the public key reconstruction information encoded in the inherent certificate from the inherent certificate according to the use of the inherent certificate as the electronic certificate and extracting the hash value and the public key of the certification authority that issued the implicit certificate If the public key of the certification authority is not identified, extracts a public key of the certification authority from an implicit certificate for the certification authority issued from a certification authority higher than the certification authority Step of extracting
/ RTI > delete delete The method according to claim 1,
Wherein the step of performing signature verification on the digital signature using the extracted public key comprises:
ECDSA or a modified ECDSA.
Public key extraction method. 5. The method of claim 4,
Wherein the step of performing signature verification on the digital signature using the extracted public key comprises:
The generated temporary signature is generated by generating the digital signature

- a hash value of the message to which the digital signature is to be added and a first signature pair generated using the sender's private key,

- comparing the coordinates or comparing the temporary point with the reconstruction point using a second signature pair including the temporary point instead of the first signature pair
/ RTI > A public key extraction system comprising:
A receiving unit for receiving an electronic certificate based on a message to which an electronic signature transmitted from a sender is added;
An extraction unit for extracting the public key of the sender by reusing the result calculated in the previous public key extraction process when sharing the same certification authorities related to the digital signature; And
And an execution unit for performing signature verification on the digital signature using the extracted public key,
Lt; / RTI >
The extracting unit extracts,
Extracting the hash value and the public key reconstruction information encoded in the inherent certificate from the inherent certificate according to the use of the inherent certificate as the electronic certificate and extracting the hash value and the public key of the certification authority that issued the implicit certificate If the public key of the certification authority is not identified, extracts a public key of the certification authority from an implicit certificate for the certification authority issued from a certification authority higher than the certification authority Extract
Public key extraction system.

Images