KR20040001814A - Method of Time Stamp Service Using Agency - Google Patents

Abstract

PURPOSE: A time stamp service method using an agent is provided to be capable of verifying the time stamp token stored by the agent though the digital signature public key of a TSA(Time Stamping Authority) is expired. CONSTITUTION: Valid date request is supplied from a client(601). After extracting a messageImprint value out of the received valid date request(603), whether an aiming node exists, or not, is decided by scanning the node stored with the same value as the messageImprint value at a request queue tree(605 - 607). When the aiming node exists, the agent verifies a time stamp response messaged(609). A valid date reply is generated after deciding whether the verification result is efficient, or not.(611 - 613). Then, the valid date reply is transmitted to the client(615).

Description

Method of Time Stamp Service Using Agent {Method of Time Stamp Service Using Agency}

The present invention relates to a timestamp service method using an agent and a computer-readable recording medium that records a program for realizing the method. An agent for providing a timestamp service between a client and a timestamp authority (TSA) The present invention relates to a method for verifying a timestamp token held by a client even when an electronic signature public key of a timestamp certification authority has expired using the agent.

A time-stamp service is a service for objectively proving that a document created by a client exists at any point in time.

Currently, the timestamp service is studied by the ISO / IEC / International Electrotechnical Commission (JTC1) Joint Technical Committee 1 (JTC1) SC 27 (Subcommittee 27) and the IETF (International Engineering Task Force) timestamp service divisions, respectively. Documents relating to time stamps under study by the IETF are being proposed as standards in August 2001.

In addition, the analysis of the standardization trends of the two organizations shows that most of the proposals proposed by the IETF are accepted by the ISO, which indicates that the timestamp service was discussed at the IETF first, and that the timestamp service implementation products may arise in the future. This is due to the consideration of interoperability.

A brief description of the time stamp services under study by ISO / IEC JTC1 SC27 and IETF is as follows:

First, a client generating a document requests a time stamping service directly to a time stamping service agent (TSA) (that is, generates and delivers a TimeStampReq message), and the TSA receives it as a timestamp response message (hereinafter referred to as a TimeStampResp message). And then send it back to the client.When a validation request for a timestamp token occurs, a request is made to the TSA or another Trust-Third Party (TTP) (ie, a ValidateRequest message). Describes a set of protocols that receive the results of the validation request (that is, create and deliver a ValidateReply message).

However, this conventional timestamp service technology has a problem in that when the TSA's digital signature public key included in the timestamp token stored by the client expires, the timestamp token stored by the client cannot be verified. .

In other words, even if an attempt is made to objectively prove that a document created by a client exists at any point in time through the timestamp service, if the digital signature public key of the TSA providing the timestamp service expires, the timestamp data for the client is stored in the TSA. There is a problem that the timestamp token stored by the client becomes useless because it cannot be verified by.

Therefore, when the time stamp service is applied to e-commerce such as B2B (Business to Business) or B2C (Business to Customer), the ripple effect due to the above-mentioned problems is expected to be greater.

The present invention has been proposed to solve the above problems, and manages the history of each document requesting a timestamp service and through the cryptographic process for it, the TSA's certificate for digital signature included in the timestamp token Has an agent that can verify this even if it has expired, and when the agent requests a timestamp service, the agent receives it and acts / requests a timestamp service from the TSA (Time Stamping Authority), and receives a timestamp token from the TSA. By distributing this to the client, a timestamp service method using an agent for verifying the timestamp token stored by the client even when the TSA digital signature public key expires and a program for realizing the method Computer-readable recorder The purpose is to provide a sieve.

1 is a configuration diagram of an embodiment of a time stamp service system to which the present invention is applied.

2 is a detailed flowchart illustrating an embodiment of a process for requesting a time stamp service from a client to an agent according to the present invention;

3 is a diagram illustrating an embodiment of a structure of a time stamp request message for a point in time checking service according to the present invention;

4 is a detailed flowchart illustrating an embodiment of a process of processing a time stamp service request of a client in an agent for a time checking agent service according to the present invention;

FIG. 5 is a detailed flowchart illustrating an embodiment of a process of responding to a time stamp request in an agent module and a client module for a viewpoint checking agency service according to the present invention; FIG.

6 is a detailed flowchart illustrating an embodiment of a timestamp verification and verification response process in an agent for a time point verification agent service according to the present invention.

FIG. 7 is a diagram illustrating a structure of a request_queue tree for managing a request of a client in an agent for a point in time agent service according to the present invention; FIG.

8 is a diagram illustrating an example of a structure of a timestamp verification request message of a client for a point in time checking service according to the present invention;

* Explanation of symbols for the main parts of the drawings

11a ~ 11d: client

12: agent

13: Timestamp Certification Authority (TSA: TimeStamp Autority)

In order to achieve the above object, the present invention provides a time stamp service method, comprising: a first step of defining an agent for representing a time stamp service between a client and a time stamp authority (TSA); The agent extracts a message imprint information value from a time stamp request message received from the client, calculates a single hash value for the imprint message information value using a hash function, and authenticates the time stamp on behalf of the client. Requesting a timestamp service from an organization; Receiving, by the agent, a timestamp token for a timestamp request message from the timestamp authority, and transmitting the timestamp token to the client on behalf of the timestamp authority; And requesting, by the client, the timestamp verification from the agent, and receiving a verification response message according to the timestamp verification request from the agent.

The present invention also provides a timestamp service system having a large-capacity processor for extracting a value of a message imprint information from a timestamp request message received from the client, and generating a hash function for a timestamp service. A first function of calculating a single hash value for the imprint message information value to request a timestamp service from the timestamp authority on behalf of the client; A second function of the agent receiving a timestamp token for a timestamp request message from the timestamp certification authority and transmitting the timestamp token to the client on behalf of the timestamp certification authority; And requesting, by the client, the timestamp verification from the agent, and providing a computer-readable recording medium recording a program for realizing a third function of receiving a verification response message according to the timestamp verification request from the agent. .

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an embodiment of a time stamp service system to which the present invention is applied.

As shown in FIG. 1, a time stamp service system to which the present invention using an agent according to the present invention is applied includes a client 11a to 11d and a client 11a to 11d requesting a time stamp service from an agent 12. An agent 12 requesting a timestamp service to a timestamp authority (TSA) 13 on behalf of clients 11a-11d that have collected a timestamp request message from the client, and a response to the timestamp request; It consists of a time stamped certification authority (TSA) 13 which generates a message and sends it to the agent 12.

Point-checking agent service using agent 12 is not the client who created the document requesting time stamping service directly from TSA, but when agent requests time stamping service, the agent receives it and acts / requests time stamping service from TSA. It receives the timestamp token from the TSA and distributes it back to the client. At this time, the agent includes a device that manages the history of each document that the clients request the time stamping service and through the cryptographic process to verify even if the TSA's digital signature certificate included in the time stamp token expires do.

The timestamp service using the agent proposed in the present invention is performed according to the following six procedures.

1) The client's timestamp request procedure.

2) Agent's timestamp request procedure.

3) The agent's timestamp response procedure.

4) Procedures for managing time stamp requests from agents.

5) Client's timestamp verification request procedure.

6) Agent Timestamp Verification / Timestamp Verification Response Procedure.

Hereinafter, each procedure will be described in detail with reference to the accompanying drawings.

2 is a detailed flowchart illustrating a process for requesting a time stamp service from a client to an agent for a time stamp service according to the present invention.

First, a document is created (i.e., generated C1) (201) to generate a timestamp request message (TimeStampRep) (203), and then the timestamp request message is transmitted to the agent (205).

In this case, the client requests a timestamp service from the agent using the timestamp request message (TimeStampReq) structure that is generally used. The difference from the conventional timestamp service protocol is that the timestamp service request is not a TSA. To the agent.

3 is an exemplary diagram illustrating a structure of a time stamp request message for a time stamp service according to the present invention.

As shown in FIG. 3, the timestamp request message structure according to the present invention includes version information 31, imprint message information 32 containing a hash value for the document C1, and request policy information 33 ), Temporary information 34, request authentication information 35, and extension information 36.

4 is a detailed flowchart illustrating a process of processing a time stamp service request of a client in an agent for a time stamp service according to the present invention.

First, a time stamp request message of a client is collected based on a certain period or a predetermined number of requests (401).

Thereafter, if the predetermined condition is satisfied (403), a process for requesting a time stamp service from the TSA is performed using the cryptographic device according to the following procedure.

Here, the cryptographic device means that H (Cx) values included in the timestamp request message (TimeStampReq) sent by the client as shown in FIG. 2 are extracted, and a hash value for them is calculated. The hash value (hereinafter referred to as HVagent_current) is used as a value of an imprint message (MessagelmPrint) in a timestamp request message (TimeStampReq) structure to be generated by an agent.

At this time, when the agent has previously requested a time stamp service from the TSA, the previously generated hash value (HVagent_before) is also used as an input value of the hash function.

That is, if a predetermined condition is satisfied (403), an imprint message value (MessagelmPrint) H (Cx) (here, x = 1, 2, ... n) is extracted from the timestamp request message collected from the client (405). If a node value is stored in the Request_queue tree (i.e., the TSA has previously requested a timestamp service) (407), n H (Cx) (where x = 1,2). ..n) Calculate the agent current hash value (HVagent_current) by returning the hash function using the agent transfer hash value (HVagent_before) stored in the input value and the node value (409), and if not stored in the node (i.e. , The agent's current hash value by returning a hash function with n H (Cx) (where x = 1,2 ... n) as inputs Compute (HVagent_current) (411).

Next, the agent current hash value (HVagent_current) calculated according to each case above is stored in the node of the request queue (413), and the TSA is calculated using the agent current hash value (HVagent_current) calculated in the above process. Generate a timestamp request message to request (415).

The time stamp request message generated in step 415 is forwarded to the TSA (417).

Here, the structure of the time stamp request message used is the same as in FIG.

5 is a detailed flowchart illustrating a process of responding to a time stamp request in an agent module and a client module for a time stamp service according to the present invention.

This response process consists of three main steps:

That is, the TSA receives the timestamp response message generated by the TSA in response to the agent's timestamp request message from the TSA, performs verification, and the request history between clients managed by the agent through the cryptographic device. The process of creating an additional information request queue (Request_queue) to deliver a time stamp response message to the client based on the information, and combining the time stamp response message and the request queue (Request_queue) as a response message to the client requesting the time stamp service. It consists of a process of delivery.

Referring to the three processes described above in detail with reference to the drawings as follows.

First, the agent module receives a time stamp response message (TimeStampResp) from the TSA (501), and extracts an input value constituting the agent current hash value (HVagent_current) from the request queue (Request_queue) tree (503).

Next, the request value H (Cx) (here, x = 1,2 ... n) of the client x to send a response message among the input values obtained in step 503 is removed (505). In step 507, an additional information request queue (Request_queue) is generated to be sent to the client x (x = 1, 2 ... n) using the final input value obtained in step 505.

Subsequently, when the additional information request queue (Request_queue) and the time stamp response message (TimeStampResp) are transmitted to the client x (x = 1, 2 ... n) (509), the client module is in the additional information request queue (Request_queue). After extracting the values, combine the H (Cx) values (where x = 1,2 ... n) stored by the client to calculate the agent temporary hash value (HVagent_Temp) (511), and the time received from the TSA. The imprint message value MessagelmPrint included in the stamp response message is extracted (513).

Then, it is checked whether the imprint message value (MessageImPrint) and the agent temporary hash value (HVagent_Temp) are the same, and recognizes the result as a legitimate time stamp result only when the same is the same (515).

6 is a flow chart illustrating a timestamp verification and verification response process in an agent for a timestamp service according to the present invention, and a timestamp response message that an agent manages internally in preparation for expiration of a certificate validity period of a TSA. It shows how to use the request_queue tree to verify the timestamp data sent by the client and send the response message accordingly.

When the client sends a timestamp verification request message to the agent, the agent receives the timestamp verification request message and performs verification.How the client requests the agent to verify the timestamp (viewpoint verification) is an existing validation request message (ValidateRequest). Use the structure as it is.

First, a validation request message (ValidateReqeust) is received from the client (601).

Extract the imprint message value (MessageImPrint) from the received message (603), and search for a node that stores the same value as the imprint message value (MessageImPrint) in the request_queue tree (605), whether the node exists It is determined (607).

As a result of the determination, if there is a node, a time stamp response message (TimeStampResp) managed internally by the agent is verified (609), and a message (valid or invalid) corresponding to the validity of the verification result (611) is verified. ValidateReply is generated (613), and the validation response message (ValidateReply) is transmitted to the client (615).

As a result of decision 607, if there is no node, a verification response message ValidationReply is generated (617) that the verification result is invalid and transmitted to the client (615).

FIG. 7 is an exemplary diagram illustrating a structure of a request_queue tree for request management of a client in an agent for a time stamp service according to the present invention.

Each of the hash values H (C1) 71a and H (C2) 71b of the client 1 (11a) and the client 2 (11b) constitutes a request queue node 1 (72), and the node 1 ( 72 and the hash value H (C3) 71c of client 3 (11c) are configured as node 2 (73). In the same way, the hash values H (C4) ... H (Cn) (71d ... 71n) of the remaining clients 11d ... 11n are also combined with the previous node value, so that each request queue ( Request_queue) nodes 74 ... 75.

In other words, the nodes of the request_queue tree fill each node value with a hash function. Therefore, due to the nature of the hash function, which is a one-way function, order modulation between time stamp request data received from clients is impossible, and since the values stored / managed by the agent are hash values, they are physically large. The advantage is that no storage space is required.

8 is a diagram illustrating a structure of a timestamp verification request message of a client for a timestamp service according to the present invention.

As shown in FIG. 8, the structure of the timestamp verification request message of the client according to the present invention includes version information 81, timestamp token information 82, and request ID information. It consists of 83.

Here, the time data uses data (ie, time stamp response message and request_queue) information sent in the time stamp response message generated / delivered by the agent.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention can always verify the timestamp token stored by the client, even if the TSA's digital signature public key included in the timestamp token stored by the client expires. As such, official documents issued by government / public institutions (e.g., resident registration copies, tax invoices, etc.) generally have a three-year legal validity at the time of issue, whereas the TSA's certificate is valid for one year, After the validity period of the certificate has an effect that can objectively prove the time of creation of the document.

In addition, in the present invention, since the agent handles n client requests on behalf of one at a time, in terms of TSA, all the clients directly access the TSA because the number of service requests can be reduced by 'client requests n-1'. The bottleneck caused by requesting the timestamp service can be reduced, and the client side can receive a relatively quick response.

Claims (8)

In the timestamp service method, A first step of defining an agent for acting for a time stamp service between the client and a time stamp authority (TSA); The agent extracts a message imprint information value from a time stamp request message received from the client, calculates a single hash value for the imprint message information value using a hash function, and authenticates the time stamp on behalf of the client. Requesting a timestamp service from an organization; Receiving, by the agent, a timestamp token for a timestamp request message from the timestamp authority, and transmitting the timestamp token to the client on behalf of the timestamp authority; And A fourth step in which the client requests the agent for time stamp verification and receives a verification response message according to the time stamp verification request from the agent; Timestamp service method using an agent comprising a. The method of claim 1, The second step, And storing the hash value in a request queue node of the agent having a tree structure so that the agent manages a request history of the client. The method of claim 1, The third step, A fifth step of receiving, by the agent, a timestamp response message generated by the timestamp authentication authority in response to a timestamp request message, and performing verification of the timestamp response message; A sixth step of generating a request queue based on the history information of the client to deliver a timestamp response message to the client; And A seventh step of combining a timestamp response message and the request queue and delivering the timestamp response message to a client requesting a timestamp service; Timestamp service method using an agent comprising a. The method of claim 3. The sixth step, In order for the agent to verify the timestamp response message previously distributed to the clients if the TSA's certificate for digital signature has expired, request the timestamp service from the TSA for the final message and return the response message. Timestamp service method using an agent, characterized in that for managing. The method of claim 1, The verification response message, Timestamp service method using an agent, characterized by using the message structure used in the standard document. The method according to any one of claims 1 to 5, The fourth step, Time using the agent, characterized in that verification of the timestamp response data sent by the client using the request queue tree created / managed using a hash function and the timestamp response data managed internally by the agent Stamp service method. The method according to any one of claims 1 to 5, The fourth step, And the agent can perform the timestamp verification response of the client by using the request queue tree and internal timestamp response data even when the TSA certificate has expired. In the time stamp service system having a large capacity processor for the time stamp service, The agent extracts a messageImprint information value from the timestamp request message received from the client, calculates a single hash value for the imprint message information value by using a hash function, and transfers the information to the timestamp authentication authority on behalf of the client. A first function of requesting a timestamp service; A second function of the agent receiving a timestamp token for a timestamp request message from the timestamp certification authority and transmitting the timestamp token to the client on behalf of the timestamp certification authority; And A third function of requesting, by the client, the timestamp verification from the agent, and receiving a verification response message according to the timestamp verification request from the agent; A computer-readable recording medium having recorded thereon a program for realizing this.