KR20010047385A - A methode of issuing users' public key certificates in certification authority system - Google Patents

Abstract

PURPOSE: A method for generating a certificate of authentication of a public key for a user of a certificating organization system is provided to maintain the function of the certificating organization system as the optimum state by registering application of the public key certificate. CONSTITUTION: In the method for generating the certificate of authentication of the public key for the user of the certificating organization system, the application(1) of a public key certificate, a waiting line(2) of applying, a public key certificate generating module(3), a public key certificate managing module(4) and a public key certificate generating operation logarithmic managing module(5) are included. If the application(1) of the public key certificate of the user is received in a certificating organization system and the certificating organization system stores it on the waiting line(2) of applying the public key certificate. The request about applying the public key certificate is signed in the public key certificate generating module(3) and the public key certificate is generated. The control of the certificating organization system is converted into the public key certificate managing module(4). The request about applying the public key certificate is managed by the public key certificate generating operation logarithmic managing module(5) and the operation of electronic signature is carried out.

Description

How to generate a public key certificate for a user in a certification authority system {A methode of issuing users' public key certificates in certification authority system}

The present invention relates to a method for generating a public key certificate for a user of a certification authority system capable of quickly generating a public key certificate for a user while maintaining optimal performance of the certification authority system with respect to a user's public key certificate application.

Public key cryptography allows users to create key pairs, one for use as a private key stored in their own system or outside the system, and the other as a public key for public use. When a third party uses this public key to make a plaintext encrypted to the recipient, the recipient, that is, the owner of the public key, converts the ciphertext into plaintext by mathematically inserting the private key corresponding to his public key into the ciphertext, making the contents visible to the recipient. Making it possible is the key to public key cryptography.

In order to use public key cryptography, that is, to publicly disclose a public key securely, a user needs to register his public key with a trusted authority, that is, a certification authority.

It requires the digital signature on the public key of its public key to obtain a public key certificate attached with the digital signature of the certification body, so that other certification authority subscribers can easily obtain the public key cryptography technology. That means providing a foundation.

In the process of issuing such a public key certificate by the certification authority system, it is possible to ensure the optimization of the certification authority system and the management of user services through a balanced system management of the number of user applications and the processing capacity of the system. To this end, the certification authority system requires a technical method of managing the certification authority system to effectively provide a service for the public key certificate application request.

However, conventionally, in issuing such a public key certificate, the certification authority system manages a public key certificate application request management, public key certificate generation, generated public key certificate management, and operation record information management performed by the certification authority system all in one module. Treated in place. As a result, the certification authority system was not efficient and could not provide effective services to users.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and by quickly accepting a user public key certificate application for which the user's identity has been confirmed, a user's public key certificate can be quickly obtained while maintaining optimal performance of the certification authority system. The goal is to provide a method that can be created.

1 is a flow chart of a public key certificate generation operation information for a user of a certification authority system according to the present invention.

2 is a flowchart showing an initialization process for generating a public key certificate of a certification authority system according to the present invention.

3 is a flowchart illustrating a process of managing a public key certificate application request of a certificate authority system user according to the present invention.

4 is a flowchart illustrating a process of generating a public key certificate for a user of a certification authority system according to the present invention.

5 is a flowchart showing a process of controlling switching from public key certificate generation to public key certificate generation job record management in a certificate authority system according to the present invention;

6 is a flowchart illustrating a public key certificate generation job record management process of a certification authority user;

In order to achieve the above object, the present invention provides a method for performing the initialization process of the public key certificate issuing function at the time the certification authority system is first started, and a method for managing a request for a public key certificate application job applied by users. A digital signature method for generating a public key certificate by digitally signing a user's request for a public key certificate using a private key for signing by a certification authority and attaching the resultant value and the digital signature value to the user's public key certificate request information, and the user's public key. After the creation of the public key certificate for the certificate application is completed, the control switching method for managing the public key certificate, and the operation record information performed by the certification authority system (e.g., initialization work, user request, user public key certificate generation, control change, Method to manage log information, which is a separate module. Characterized in that the configuration.

Prior to the description of the present invention, definitions of terms used in the present invention are as follows.

Private Key

Public Key (Asymmetric Key) A key pair generated by a user or a certification authority to use a cryptographic technique is a public key and a private key. Among them, the public key is registered with a certification authority, and the public key is used by others to use for message transmission / reception encryption technology. The private key is stored in a private place (usually a smart card).

Session key (secret key)

A secret key (symmetric key) encryption technology is used to encrypt the original text of an electronic document. The session key can be called a secret key, and the session key generates a random number on the user side and uses it for one-time use.

Certification Authority (CA)

As a certification authority, this system creates and manages public key certificates for users and system administrators. When initializing, the certification authority information is defined to describe unique information (certificate name, service name, etc.) related to certification authority subscriber in public key certificate extension information for user.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an information flow diagram for generating a public key certificate for a user of a certification authority system according to the present invention.

In the figure, the overall information flow from the time when the user's request for requesting a public key certificate to the certification authority system is completed and when the user's generation of the public key certificate is completed and the control is changed to the public key certificate management module inside the certification authority system is summed up. It is shown as.

In other words, when the user's public key certificate application (1) is received by the certification authority system while the certification authority system has completed the initialization process for generating a public key certificate, which will be described later, the certification authority system uses the first-in-first-out public key method. Store in the certificate application queue (2).

Next, the requests for the public key certificate application stored in the application queue 2 are digitally signed in the public key certificate generation module 3 in the order in which they were applied to generate the public key certificate.

When the public key certificate generation is completed for one public key certificate application in the application queue 2, the certification authority system switches control to the public key certificate management module 4 to record the operation record related to the public key certificate generation. Manage.

In addition, the public key certificate generation operation log management module 5 manages the details of the public key certificate application request management and the digital signature.

Hereinafter, a process for generating a public key certificate for a user will be described with reference to FIGS. 2 to 6.

2 is a flowchart illustrating an initialization process for generating a public key certificate of a certification authority system according to the present invention.

First, the certification authority system drives the certification authority related program by the driving command input (administrator password, driving command input) of the certification authority manager (S201 and S202).

Next, it is checked whether or not the signature and encryption key pairs of the certification authority are held (S203). If so, the key pairs are stored in the temporary storage (S204), and then step S206 is performed.

If the verification result in step S203 does not have a key pair for signing and encrypting the certificate authority (first operation) and after performing step S204, a key pair for ciphering and signing of the certificate authority system is generated, and then the And in order to register the two public keys of the signing key pair in the upper certification authority in an offline manner, the person in charge of the certification authority visits the person in charge of the upper authority and receives the public key certificate for the two public keys (S205).

To check whether the user public key certificate generation module of the certification authority system is operating normally, the administrator initializes the certification authority manager menu and presents the administrator account and password and the private key corresponding to the public key certificate issued by the higher certification authority. Next, when the administrator menu is selected and the public key certificate generation status on the menu is selected, when a blank table indicating the menu title and status information is displayed on the screen, it may be determined that the public key certificate generation module operates normally.

3 is a flowchart illustrating a process of managing a public key certificate application request of a certification authority system by the public key certificate application request management module of the present invention.

The user downloads the software for the user from the certification authority through the Internet and installs it on the user's system in advance to obtain a public key certificate online from the certification authority.

In this state, the user runs the certification authority user software installed in the user system, selects the user public key certificate application (or renews the user public key certificate) on the menu, inputs the corresponding information, and creates a new / renew application form (S301). ).

The public key certificate application information includes the applicant's name, e-mail address, postal address, work name, affiliation department, telephone number, distribution of public key certificate revocation list (real time, basic), and use.

The user input contents of the new / update public key certificate application form are checked to repeat steps S301 to S303 until there is no error and exception information.

If there is no error and exception information in the completed new / update public key certificate application form, the user software generates two types of user key pairs for the user, one for encryption and one for signing, of which two public keys Is attached to the user's public key certificate request (or renewal) message and is sent to the certificate authority (S304).

In detail, the encryption processing of the transmission / reception message using the public key encryption technology is performed between the user system and the certification authority system.

In the method of performing message encryption processing, a message cipher text is generated by performing symmetric key encryption on a message to be transmitted using a session key (A). Then, the original message to be transmitted is hashed and added to the information to transmit the signature value B signed by the user's signature private key. The electronic envelope is generated by performing public key encryption on the session key using the cryptographic public key of the certification authority embedded in the software for the user of the certification authority of the user system (C).

The user sends the symmetric key encrypted cipher text, electronic envelope and signature value to the certification authority for the original message.

When the user fills out the public key certificate application form and sends it to the certification authority system, the certification authority system opens the electronic envelope with the private key for the certification authority's cryptographic private key and obtains the session key. (S305) Substitute this session key into the cipher text to obtain the original message (S306).

Next, the integrity of the original message is checked using the signature value of the digital signature. This is true in all cases of sending and receiving messages between user systems and certificate authority systems.

The integrity check of the message text is performed by performing a hash function on the decrypted message text (S307) to obtain a hash value (D), and performing the inverse hash function on the digital signature value (B) received from the user system. The comparison is made with the hash value B '(S308, S309).

If the original text of the message is defective (B '≠ D), an error message is sent to the user's system (S311), and if the integrity of the original text of the message is verified (B' = D), the certification authority issues a request for the public key certificate application sent by the user. After placing the public key certificate request request queue set in the certification authority system, the queue numbers are assigned in descending order (S310).

Thereafter, the certification authority system performs the public key certificate request requirement of the user of the public key certificate request request queue in descending order of the assigned queue number.

4 is a flowchart illustrating a process of generating a public key certificate for a user of a certification authority system using the public key certificate generation module of the present invention, and illustrates a request for a user's public key certificate request stored in a public key certificate application request queue of a certification authority. Process in descending order to generate a public key certificate for the user.

In detail, the certification authority first reads the user application request information from the queue into the system memory according to the sequence number (descending order) of the user's public key certificate application request queue received in the system, and then forms an independent form in the certification authority system. The digital signature subprogram is driven inside the system to separately perform the digital signature work with the program (S410, S420).

The digital signature sub-program S430 generates a public key certificate by performing the digital signature on the user application request information read into the certification authority system as follows.

First, the digital signature sub-program stores the user public key certificate application message (S431), and then changes the user application request information to the information structure for the public key certificate form (S432). Then, the user's public key certificate is generated by attaching a signed value signed with the signing private key of the certification authority to the end of the public key certificate information structure for the changed information structure (S433).

5 is a flowchart illustrating a process of controlling switching from public key certificate generation to public key certificate management in the certification authority system according to the present invention.

The public key certificate of the user generated as shown in FIG. 4 is transmitted to the public key certificate management module inside the certification authority system operated in parallel with the public key certificate generation module to perform subsequent operations such as transmitting to the user.

Specifically, when the public key certificate generation is completed for one public key certificate application request, the certification authority system terminates the operation of the public key certificate generation module by the digital signature subprogram termination command, and at the time of accepting the user public key certificate application, Outputs the operation log and public key certificate generated until the end of the public key certificate generation module operation (S501).

Next, the control is changed from the public key certificate generation module to the public key certificate management module by transmitting the job log and the public key certificate output of the end of the public key certificate generation module job to the public key certificate management module (S502). The public key certificate application work output is processed in the public key certificate management module

If the public key certificate management module is notified of the normal processing of the reception result, the queue of the public key certificate generation module is checked to sequentially process the user request remaining in the queue (S503).

6 is a flowchart illustrating a public key certificate generation job record management process of a certification authority user by the public key certificate generation job log management module of the present invention, wherein public key certificate application request management, public key certificate generation, and public key certificate management are performed. And are processed in parallel.

The public key certificate generation task record information defines the following details so that it can be recorded, maintained, and retrieved.

1.Initialization-related information of the certification authority system, the initial start date and time of the public key certificate generation module and the program name (public key certificate generation module, public key certificate application queue management module, public key certificate queue name / queue processing) Capacity (usually defined as 50 queues and can be adjusted according to the environment of the system), digital signature subprogram management module (public key certificate generation master program) and digital signature subprogram module (public key certificate generation slave program))

2. As the user request management information, the date and time of receiving / requesting a user public key certificate request / renewal certificate of the certification authority, the sender information (host address of the sending system, sender name), the number of issuing queue waiting numbers of the certification authority, and the number of requests waiting in the queue. , The number of requests processed in the queue

3. As the digital signature work information, the date and time of execution for each digital signature subprogram, the time required to perform it (seconds), and the result (success, failure due to a certification authority program failure, failure due to a system failure), and total execution of the digital signature subprogram by date Number

4. Termination-related information, when the certificate authority system shuts down, when the public key certificate generation module ends and the program termination results (normal termination, abnormal termination).

According to the certification authority management policy, a copy (A) of the record information at the time of the digital signature is generated for the entire public key certificate generation job record information at regular intervals for the secure management of the public key certificate generation job record. The digital signature value B is obtained by signing with the signature private key (S601 to S603).

The signature value is stored by the certification authority administrator inside and outside the certification authority system.

When the signature value is stored in the system, the record information is encrypted with a certification authority administrator password to obtain a copy of the encrypted record information and the digital signature value (S604), and the digital signature execution time information (D) is included therein and disclosed. It manages as a key certificate generation job information table (S605).

Meanwhile, even when the signature value is stored outside the system, the administrator works in the same manner as when storing the signature value inside the system, but stores the external storage medium.

As described above, the present invention has an effect that the certification authority system can generate a public key certificate while maintaining the optimal performance for the user's public key certificate application. You can get a quick response.

The technical spirit of the present invention has been described above with reference to the accompanying drawings, but this is by way of example only and not intended to limit the present invention. In addition, it is obvious that any person skilled in the art can make various modifications and imitations without departing from the scope of the technical idea of the present invention.

Claims (3)

A method for generating a public key certificate for a user of a certification authority system, A public key certificate application request management process of receiving and managing a public key certificate application request applied by users while performing an initialization process of a public key certificate issuing function at the time when the certification authority system is first started; Generating a public key certificate by digitally signing a request for a public key certificate request in a public key certificate request request queue with a private key for signature by a certification authority and attaching the resultant value and the digital signature value to the user's public key certificate request information; Switching control for managing the public key certificate after the public key certificate generation for the user's public key certificate application is completed; And It includes the process of managing log information that holds the work record information (eg, initialization work, user request received, user public key certificate generation, control change, termination, etc.) performed by the certification authority system. Public key certificate generation method for a user of the certification authority system, characterized in that consisting of. The method of claim 1, The public key certificate application request management process Acquiring a session key by opening an electronic envelope with a cryptographic private key of a certification authority with respect to the public key certificate application information sent by a user, and substituting the session key into a cipher text to obtain an original message; The hash value (D) is obtained by performing a hash function on the decrypted message text, and compared with the hash value (B ') obtained by performing the inverse hash function on the digital signature value (B) received from the user system. Verifying integrity; And If the original text of the message is defective (B '≠ D), an error message is sent to the user's system, and if the integrity of the original text is verified (B' = D), the public set the user's public key certificate request request inside the certification authority system. And placing the queue numbers in descending order after placing them in the key certificate request request queue. A computer-readable recording medium having recorded thereon a program for generating a public key certificate for a user in a certification authority system, When the certification authority system is started for the first time and the public key certificate issuing function is initialized, the public key certificate request sent by the user is received when the integrity of the original text is received by the user. Placing a request in a public key certificate request request queue and assigning a queue number to manage the request; Generating a public key certificate by digitally signing a request for a public key certificate request in a public key certificate request request queue with a private key for signature by a certification authority and attaching the resultant value and the digital signature value to the user's public key certificate request information; Switching control for managing the public key certificate after the public key certificate generation for the user's public key certificate application is completed; And It includes the process of managing log information that holds the work record information (eg, initialization work, user request received, user public key certificate generation, control change, termination, etc.) performed by the certification authority system. A computer-readable recording medium having recorded an executable program composed of a computer.