KR20050014394A - System and Method for Status Management of Wireless Certificate for Wireless Internet and Method for Status Verification of Wireless Certificate Using The Same - Google Patents

Abstract

PURPOSE: A system and a method for managing a wireless certificate status for the wireless Internet in real-time, and the method for verifying the wireless certificate status using the same are provided to transmit certificate status information to a requesting client terminal by integrally managing wireless certificate status information and CA(Certification Authority) certificate status information. CONSTITUTION: A real-time wireless certificate status information providing server(500) receives a private key needed for electronically signing to a wireless certificate status information inquiry result and a real-time wireless certificate status information providing certificate, which is a public key certificate matched with the private key, from the highest CA server(100). The server stores status information of the CA certificate received from the highest CA server and the wireless certificate status information received from the CA server(200), generates the final status information from the received information, and transmits it to the client terminal(300) requesting the wireless certificate status information.

Description

System and Method for Status Management of Wireless Certificate for Wireless Internet and Method for Status Verification of Wireless Certificate Using The Same}

The present invention relates to a certificate status management system and method used for online e-commerce, and more particularly, to register in real time the status information of the wireless certificate used in the wireless Internet and to use the wireless certificate status information and certificate authority certificate The present invention relates to a wireless certificate status management system and method for wireless internet that can simultaneously check status information, and a certificate verification method using the same.

In the information age, the core element of competitiveness is to make sure that information can be efficiently managed and used by individuals as well as companies. As the Internet provides a powerful network infrastructure and information infrastructure, the importance of information is increasing. Due to the open nature of the Internet, security is naturally emphasized. In particular, as mobile communication terminals become more common, researches on security technologies related to wireless Internet have been actively conducted.

The commonly used concept of security protects all information assets, including hardware and software systems communications, computing facilities, as well as systems and data from external intruders to perform their original functions and prevent their contents from being altered. Means all activities to protect against. Thus, illegal actions to be protected include data eavesdropping, data tampering, and the transmission of false messages. This requires that information security goals such as confidentiality, integrity, authentication and availability be met.

Here, confidentiality means that information is not disclosed or leaked to unauthorized persons, and integrity means that altering (deleting, adding, or rearranging) information is made possible only by authorized persons. In addition, authentication means that only users with information access rights can use the information and services, and availability means supporting the users with the most efficient use of information. In addition, wireless Internet security is not just limited to stationary systems or limited data, but also allows data to be used from any mobile device anywhere, at any time.

Wireless Public Key Infrastructure (WPKI), one of the representative wireless Internet security technologies, is a modification of the PKI to fit the wireless Internet environment. The wireless Internet has a lower data transmission speed and lower computing power than a wired Internet. The WPKI differs from the PKI to suit this particular environment.

In general, the biggest computational task of a terminal in authentication using a PKI is to verify the certificate of the other party. You should check that the certificate you received is signed by a trusted certificate authority, that the signature of the certificate authority that signed the certificate is correct, that the intended use of the certificate is appropriate for the current task, and that the certificate is valid. The most problematic part is verifying the validity period of the certificate. Although all the information contained in the certificate is valid, the certificate beyond the certification period is not valid.

Therefore, you should periodically update the Certificate Revocation List (CRL) to verify the validity of the certificate. The CRL contains a list of revoked certificates that have not expired but are valid only between the time of issue and the time of next occurrence. These settings were introduced to download and use CRLs not only online but also offline, so that certificates revoked during the validity period can only be validated as valid certificates.

In other words, the certificate verification method using the CRL is to post a list of certificates invalidated at a certain time interval to the directory server to determine the validity of the certificate by comparing the revocation list whenever the certificate verification is required. However, this method is difficult to determine the current status immediately because the revocation list is published at regular intervals, and the size of the revocation list is gradually increased, which is inadequate for the wireless Internet environment because it accompanies the on-line load caused by the increase in traffic. .

The Internet Engineering Task Force (IETF) has proposed an Online Certificate Status Protocol (OCSP) that enables immediate verification of certificates online. In this way, the certificate status information of a certification authority is disclosed to a directory server in the form of ARL (Authority Revocation List), which is a revocation list of certification authority certificates. This method checks the validity and revocation status of the certificate by the OCSP server that can inquire the status of the certificate. The client should use the certificate after receiving information from the server that the certificate is valid and has not been revoked.

On the wireless Internet, the owner of a wireless certificate, which is a trading party, sends a wireless certificate to the wireless terminal to prove its identity, and the wireless terminal obtains the certificate revocation list of certificate authorities to check the certificate status of the wireless certificate issuer and then validates it. If valid, the real-time wireless certificate status information is queried, and if the result is valid, the transaction is continued. In this case, the wireless terminal must generate two separate transactions to verify the validity of the wireless certificate holder's wireless certificate together with the validity of the certificate authority that issued the wireless certificate during the actual transaction. When applying such a configuration to a commercial service, it is quite difficult.

In addition, in order to directly obtain the certificate authority certificate revocation list from the wireless terminal, it must be interworked with a directory server. For this purpose, a Lightweight Directory Access Protocol (LDAP) client module must be implemented in the wireless terminal. LDAP is a software protocol for accessing a directory-related database that allows the location of resources such as files and devices on a network. The size of the library required to implement the LDAP client module is about 1.7 Mbytes. Considering that the size of the related library of the program loaded on the wireless terminal is approximately 1.9 Kbytes, the LDAP can be obtained directly from the wireless terminal. Applying client modules is a very difficult situation.

In addition, there is no proposed or applied method for a method of simultaneously checking the validity of the wireless certificate and the certificate status information of the certification authority that issued the wireless certificate.

Referring to FIGS. 1 and 2, the wireless certificate issuing process and the process of verifying the issued wireless certificate when applying the actual service, which enables to perform e-commerce, financial transactions, and the like through the wireless Internet will be described as follows.

1 is a diagram illustrating a general wireless certificate issue process.

As shown in the figure, the PKI security service system requests for issuance / revocation / reissue of a certificate, and downloads a counterpart certificate and a certificate revocation list at the time of service processing, and processes a client terminal 10 and a client terminal 10 to process security services in a terminal environment. Registrar (20) for commerce and financial transactions, certificate issuance / revocation / reissue of subscriber's certificate, server (30) and certificate authority for posting / deleting certificates and certificate revocation list It includes a directory server 40 for managing the files so that service subscribers can refer to the certificate revocation list.

The user of the client terminal 10 visits the registration authority 20 directly, requests for issuance of a certificate, and receives an ID and a password (S105). The registrar server 20 stores the subscriber information desired to issue the certificate (S102) and transmits the subscriber information to the certification authority server 30 (S103), and requests the corresponding subscriber to issue a certificate. Meanwhile, the client terminal 10 requesting the certificate issuance generates a digital signature key pair and a certificate issuing request format (S104) and transmits the request to the registrar server 20 according to the request of the registrar server 20.

The registrar server 20 transmits the certificate issuing request format received from the client terminal 10 to the certification authority server 30, and the certification authority server 30 receives the subscriber information and certificate transmitted from the registrar server 20. The certificate is generated according to the issue request format (S107), and the certificate is registered in the directory server 40 and then transmitted to the client terminal 10.

In the above, the registrar server 20 plays a role of mediating data transmission between the certification authority server 30 and the client terminal 10. When the registrar server 20 does not exist, the client terminal 10 authenticates. Send and receive data directly with the institution server 30 to receive a certificate.

2 is a diagram illustrating a general wireless certificate status information verification method. In this case, the client terminal means a client to the certification authority, and a server-client relationship may be established between the client terminals according to the service provision state.

In FIG. 2, client terminal A 300 may be a customer during a financial transaction through a wireless Internet service user, for example, wireless internet, and client terminal B 400 may be a bank. When the user of the wireless certificate having the client terminal A 300 uses a commerce or a financial transaction, the client B 400, which is an internet shopping mall or a financial institution, which is a trading party, sends the wireless certificate owned by the client terminal A 300 to the client terminal A 300. The client of the client terminal A (300) must present the certificate status of the certificate authority that issued the wireless certificate together with the validity of the wireless certificate received from the client terminal B (400) to verify the identity of the client terminal B (400). You should check.

To this end, each of the plurality of certification authority server 200 is issued a certification authority certificate from the highest certification authority server 100 (S201), the client terminal B (400) before providing a wireless Internet service to the certification authority server 200 Must be issued a wireless certificate through (S202). Here, the certificate authority certificate and the wireless certificate are both posted on the directory server and the like, and the revocation list is periodically managed.

If the client terminal B 400 transmits a wireless certificate to the client terminal A 300 to prove its identity (S203), the client terminal A 300 is a top certificate authority to query the certificate status of the wireless certificate issuer. Obtaining the certificate authority certificate revocation list from the server 100 (S204) and checking the validity of the certificate authority certificate (S205),

When the status and validity period of the certification authority certificate are valid as a result of checking in step S205, the client terminal A 300 receives the status information of the wireless certificate from the certification authority server 200 to inquire the status of the wireless certificate (S206). After checking whether the radio certificate is valid (S207), if the radio certificate is valid, the transaction with the client terminal B400 is continued.

As described above, in order to verify the wireless certificate of the wireless certificate owner, two transactions required for receiving the certificate revocation list of the certification authority and receiving the wireless certificate status information must be generated, which is not suitable for the limited wireless Internet environment. In addition, the client terminal should be equipped with an LDAP client module in order to interwork with the directory server to obtain a certificate revocation list, there is a problem that it is difficult to mount a large LDAP client module in consideration of the performance and capacity of the wireless terminal.

The present invention has been made to solve the above-mentioned disadvantages and problems, and provides a certificate status management system and method that can be integrated to the wireless certificate status information and certificate authority certificate status information to be transmitted to the client terminal requesting the certificate status information. There is a technical challenge.

In addition, the present invention has another technical problem to provide a wireless certificate status verification method that can confirm the certificate validity of the wireless certificate holder in one transaction.

1 is a view for explaining a general wireless certificate issuing process,

2 is a view for explaining a general wireless certificate status information verification method,

3 is a block diagram of a wireless certificate status information management system according to the present invention;

4 is a detailed configuration diagram of the highest-level certification authority server shown in FIG. 3;

5 is a detailed configuration diagram of the certification authority server shown in FIG. 3;

6 is a detailed configuration diagram of a real-time wireless certificate status information providing server shown in FIG. 3;

7 is a detailed configuration diagram of the client terminal A shown in FIG. 3;

8 is a flowchart for explaining a wireless certificate state management method according to the present invention;

9 is a flowchart for explaining a wireless certificate verification method using the wireless certificate state management system according to the present invention;

10 is a view for explaining a certificate profile standard,

11 is a diagram for explaining a profile standard of a certificate revocation list.

<Description of the symbols for the main parts of the drawings>

10: client terminal 20: registrar server

30: certification authority server 40: directory server

100: highest certification authority server 200: certification authority server

300: client terminal A 400: client terminal B

310: control unit 320: I / O interface

330: R / F communication module 340: Request means of the wireless certificate status information

350: wireless certificate status information checking means

360: wireless certificate status information verification policy management means

370: digital signature verification means 380: certificate information storage means

500: Real-time wireless certificate status information providing server

600: base station 700: mobile communication network

800: Internet 1100: Authentication device

1110: certification authority certificate management means

1120: certificate management means for the device for providing wireless certificate status information

1130: certificate generation means for the device for providing wireless certificate status information

1140: certificate transmission means for the wireless certificate status information providing device

1150: Digital signature and encryption / decryption means A

1200: Certificate revocation list management device

1210: Certificate authority certificate revocation list generation policy management means

1220: means for creating a revocation list of certification authorities

1230: Certificate revocation list registration means

1240: Certificate revocation list transfer means

1250: Digital signature and encryption / decryption means B

1300: directory server device 2100: wireless authentication device

2110: wireless certificate management means

2120: Generation and registration means of revocation list of wireless certificates

2130: means for transmitting the revocation information of the wireless certificate

2140: Digital signature and encryption / decryption means

2200: wireless certificate status information monitoring device

2210: wireless certificate status information receiving means

2220: wireless certificate status information storage means

2230: wireless certificate status information transmission policy management means

2240: wireless certificate status information transmission means

2300: database 2400: directory server device

5100: Wireless certificate status information management device

5110: wireless certificate status information receiving means

5120: wireless certificate status information storage means

5130: Certificate revocation list verification means

5140: certification authority certificate status information storage means

5150: Digital signature and encryption / decryption means

5200: Wireless certificate status information providing device

5210: wireless certificate status information request receiving means

5220: wireless certificate status information query means

5230: Final status information determination and expiration date control means

5240: means for transmitting wireless certificate status information

5300: Database 5310: Status Information Database

5320: ARL Database

The present invention provides a certification authority server for issuing and managing a wireless certificate to a first client terminal, a second client terminal for providing a wireless Internet service to a first client terminal, a first client terminal, or a second client terminal, and the certification authority server. A wireless certificate state management system including a top certification authority server for issuing and managing a certification authority certificate for permitting to issue the wireless certificate, which is required to digitally sign a wireless certificate status information query result from the top certification authority server. It receives and manages a certificate for providing real-time wireless certificate status information, which is a private key and its corresponding public key certificate, receives the status information of the certification authority certificate from the highest-level certification authority server, and receives the wireless certificate status information from the certification authority server. Receive and store, Certification Authority certificate status information, and the wireless status information for a certificate includes a real-time wireless certificate status information providing server for generating the final status information transmitted to the client terminal that requested the certificate, the wireless state information from more.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, a client terminal means a client to a certification authority, and a server-client relationship may be reestablished with each other according to a service provision state between client terminals. In the present embodiment, the client terminal A refers to all possible portable communication devices capable of connecting to a mobile communication network in a wireless environment such as a cellular phone, a PCS, a PDA, a laptop capable of wireless communication, and the client terminal B provides a wireless Internet to the client terminal A user. By means of the service provider device for providing electronic commerce, financial transactions, and the like.

3 is a block diagram of a wireless certificate status information management system according to the present invention.

As shown, the client terminal A 300 is connected to the mobile communication network 700 through the base station 600, and the client terminal B 400 is a client terminal connected to the mobile communication network 700 through the Internet 800. A 300 provides a variety of wireless Internet services, such as electronic commerce, financial transactions. The certification authority server 200 issues and manages a wireless certificate to the client terminal A or B (300, 400), and the top certification authority server 100 has a certification authority server 200 of the client terminal A or B (300, 400). ) Issues and manages certification authority certificates to authorize

Here, the certification authority certificate and the wireless certificate have a profile standard as shown in FIG. FIG. 10 is a diagram for describing a certificate profile standard, and is composed of a basic field and an extended field.

The basic fields include certificate version, serial number, signature algorithm, issuer, expiration date, owner, owner public key information, issuer unique identifier, owner unique identifier, and extended fields are issuer public key identifier, owner public key identifier, and key usage. Purpose, owner secret key validity period, certificate policy, certificate policy mapping, owner alternative name, issuer alternative name, default restriction, name restriction, policy restriction, purpose of extension key usage, CRL distribution point, domain information, issuer information access, delegate Include.

In addition, the wireless certificate status management system of the present invention further includes a real time wireless certificate status information providing server 500, wherein the real time wireless certificate status information providing server 500 is a certificate status of a wireless certificate holder and a certificate status of a certificate authority. Manage and provide to the client terminal A (300) in real time. Then, the private key required for digital signature on the wireless certificate status information search result from the highest certification authority server 100 and a public key certificate corresponding thereto, that is, a certificate for providing real time wireless certificate status information is issued and managed. In order to indicate that the certificate for providing real-time wireless certificate status information, it is preferable to store a value indicating this in the extended key use purpose field of the certificate extended field.

In addition, the certification authority server 200 applied to the present invention provides the wireless certificate status information providing server 500 when the wireless certificate is revoked or suspended, and the top certification authority server 100 provides real-time wireless certificate status information. In order to delegate the authority for providing the wireless certificate status information to the providing server 500, it issues and manages the certificate for providing the wireless certificate status information. When the certification authority certificate is revoked, the highest certification authority server 100 generates a certification authority certificate revocation list and registers it in the directory server, and then transmits the result to the real-time wireless certificate status information providing server 500. If the status of the certificate for providing the wireless certificate status information is changed, the client terminal A and B (300, 400) is notified. Here, the profile specifications of the certificate authority certificate and the wireless certificate revocation list are shown in FIG. 11.

FIG. 11 is a diagram for describing a profile specification of a certificate revocation list, and may be largely divided into a basic field and an extended field. The basic fields include the version of the certificate revocation list, the signature algorithm identifier used to sign the certificate revocation list, the issuer for identification of the certificate authority that signs the certificate revocation list, the current renewal information indicating the issue date of the current certificate revocation list, The next renewal information indicating the issue date of the next revocation certificate, the revocation certificate for displaying the revocation certificate list, the issuer signature including the digital signature for the revocation list of certificates, and the like, where the revocation certificate field includes the serial number, It includes a certificate revocation date and a certificate revocation list entry extension field.

The extension field also includes the issuer key identifier, issuer alternative name, certificate revocation list number, delta CRL indicator, and issue distribution point, and the certificate revocation list entry field contains the reason code, stop instruction code, invalid date, and certificate issuer. It may include.

The client terminal A or B (300, 400) is connected to the real-time wireless certificate status information providing server 500 and simultaneously receives the certification authority certificate status information and the wireless certificate status information to determine whether or not validity.

FIG. 4 is a detailed configuration diagram of the highest certification authority server shown in FIG. 3.

As shown, the top certification authority server 100 includes an authentication device 1100, a certificate revocation list management device 1200 and a directory server device 1300.

In more detail, the authentication device 1100 issues and manages a certification authority certificate that allows the certification authority server 200 to issue a certificate to the client terminal A or B (300, 400), and the certification authority certificate. When the revocation of the certificate authority certificate revocation list management device 1200, the certificate authority means for managing the certificate 1110, the real-time wireless certificate status information providing server 500 for delegating authority for providing the wireless certificate status information Certificate management means 1120 for providing wireless certificate status information for issuing / revoking and managing certificates, and for providing wireless certificate status information for generating a certificate for providing wireless certificate status information in a digitally signed form for transmission to a client terminal. Certificate generation means 1230, the non-signature for transmitting a digital certificate for providing wireless certificate status information to the client terminal Certificate sending means for providing certificate status information 1240, and includes an electronic signature and encryption / decryption unit A (1250).

In addition, the certificate revocation list management device 1200, the certificate revocation list generation policy management means 1210, the certificate revocation list from the certification authority certificate management means 1110, which provides a validity criteria such as the certificate validity period for the certification authority certificate. Certificate authority revocation list generation means 1220 for generating a certification authority certificate revocation list based on this list, and registering a certification authority certificate revocation list for registering the generated certification authority certificate revocation list in the directory server device 1300 Means 1230, a certification authority certificate revocation list transmission means 1240 for notifying the certification authority certificate revocation list to the real-time wireless certificate status information providing server 500, and an electronic signature and encryption / decryption means B 1250. .

As such, the highest certification authority server 100 issues and manages a certification authority certificate and a certificate for providing real-time wireless certificate status information, and registers the certification authority certificate revocation list in the directory server device when the status of the certification authority certificate is changed, It performs a digital signature on the certificate authority certificate revocation list and transmits to the real-time wireless certificate status information providing server 500.

FIG. 5 is a detailed configuration diagram of the certification authority server shown in FIG. 3.

The certification authority server 200 includes a wireless authentication device 2100, a wireless certificate status information monitoring device 2200, a database 2300, and a directory server device 2400.

The wireless authentication device 2100 issues wireless certificate management means 2110 for issuing, managing, revoking, and reissuing a wireless certificate to a client terminal that has requested a certificate issuance, and when the issued wireless certificate is revoked or suspended, the wireless certificate revocation list. Generating and registering the wireless certificate revocation list for registering the directory server device 2400 and the registration means 2120, the wireless certificate status to notify the real-time wireless certificate status information providing server 500 when the status of the wireless certificate is changed. Wireless certificate revocation information transmitting means 2130, digital signature and encryption / decryption means 2140 for transmitting to the information monitoring device 2200.

In addition, the wireless certificate status information monitoring device 2200 is a wireless certificate status information receiving means 2210 for receiving the wireless certificate information whose state is changed from the wireless certificate revocation information transmitting means 2130, for storing it in the database 2300 Wireless certificate status information storage means 2220, wireless certificate status information transmission policy management means 2230 for providing a transmission criteria for the wireless certificate revocation list, real-time wireless certificate status information providing server 500 of the changed status of the wireless certificate Wireless certificate status information transmitting means 2240 for transmitting to the wireless certificate status information transmitting means 2240, the wireless certificate status information transmitting policy management means when the transmission to the real-time wireless certificate status information providing server 500 fails The wireless certificate status information is retransmitted according to the number of retries and the retry period indicated by the transmission policy of 2230. The.

As such, the certification authority server 200 issues and manages the wireless certificate to the client terminal B 400 requesting the certificate, and registers the wireless certificate revocation list in the directory server device and stores it in the database when the state of the wireless certificate is changed. It performs a digital signature on the wireless certificate revocation list and serves to transmit to the real-time wireless certificate status information providing server 500.

FIG. 6 is a detailed configuration diagram of a real-time wireless certificate status information providing server shown in FIG. 3.

The real-time wireless certificate status information providing server 500 includes a wireless certificate status information management device 5100, a wireless certificate status information providing device 5200, and a database 5300, and the database includes status information DB 5310 and ARL ( Authority Revocation List) DB 5320 is included.

The wireless certificate status information management apparatus 5100 receives means 5210 and wireless certificate status information receiving means 5110 from the wireless certificate status information transmitting means 2240 of the certification authority server 200. Certificate authority certificate received from the wireless certificate status information storage means 5120, the certificate authority certificate revocation list transmission means 1240 of the highest certification authority server 100 for storing one wireless certificate status information in the status information DB 5310. Certificate body revocation list verification means (5130) and certification authority certificate revocation list verification means (5130) for receiving the revocation list and verifying the digital signature of the highest certification authority. Storing certificate status information in ARL DB 5320 and storing hash value for it to prevent forgery Means 5140, digital signature and encryption / decryption means 5150.

The wireless certificate status information providing apparatus 5200 is a receiving unit 5210 which receives a request for the wireless certificate status information from the client terminal, and the status information of the corresponding wireless certificate, that is, the status information of the certification authority certificate and the wireless certificate according to the request of the client terminal. Deriving the final status information (valid, invalid, etc.) to be transmitted to the client terminal based on the wireless certificate status information inquiry means 5220, which inquires the status information from the database 5300, and the certificate status information inquired from the database 5300. The final status information which is digitally signed, and the final status information for managing the validity period for the final status information and the validity period management means 5230, the final status information determination and the validity period management means 5230, and the final status information derived from the certificate status information. The wireless certificate status information transmitting means 5240 for transmitting to the requesting client terminal. Here, the case where the final state information is other indicates that it is not possible to determine whether the corresponding wireless certificate is valid or not. In this case, the client terminal requesting the wireless certificate status information determines whether the certificate is valid.

As such, the real-time wireless certificate status information providing server 500 of the present invention receives the status information of the certification authority certificate from the highest certification authority server 100, and receives the wireless certificate status information from the certification authority server 200, respectively. Stored in the database, and if there is a request for the wireless certificate status information of the client terminal A (300), the corresponding wireless certificate status information and the certificate authority certificate status information that issued the wireless certificate are inquired, and final status information is generated from the client terminal A. Send to 300.

FIG. 7 is a detailed configuration diagram of the client terminal A shown in FIG. 3.

The client terminal A 300 is a portable wireless terminal, and in addition to the control unit 310, the I / O interface 320, and the R / F communication module 330, which are basic components of a general wireless terminal, the wireless certificate status information requesting means. 340, the wireless certificate status information verification means 350, the wireless certificate status information verification policy management means 360, the digital signature verification means 370 and the certificate information storage means 380 is further provided.

The wireless certificate status information requesting means 340 requests the wireless certificate status information and the certification authority certificate status information to the real time wireless certificate status information providing server 500, and the wireless certificate status information checking means 350 is the real time wireless certificate status information. The wireless certificate status information and the certification authority certificate status information received from the providing server 500 are analyzed to check whether they are valid. In addition, the wireless certificate status verification policy management means 360 provides a criterion for determining the certificate status information as valid.

The digital signature verification means 370 verifies the issuer's digital signature when the certificate is found to be valid, and the certificate information storage means 380 stores the digital signature verified certificate in a storage device (not shown).

Client terminal A (300) applied to the present invention is a real-time wireless certificate status information providing server when authentication is required for the client terminal B (400) while performing electronic commerce, financial transactions, etc. through the client terminal B (400) Request the wireless certificate status information of the client terminal B (400), and the final status information combining the status information of the wireless certificate and the certificate authority certificate issued by the real-time wireless certificate status information providing server (500) Inform the user to receive and continue the transaction if the certificate is valid and to abort the transaction if it is invalid.

On the other hand, if the certificate status information received from the real-time wireless certificate status information providing server 500 does not appear to be valid or invalid and is shown as 'other', the wireless certificate status validation policy management means 360 processes the corresponding wireless certificate as valid. Decide whether or not to treat it as invalid.

8 is a flowchart illustrating a method for managing a wireless certificate status according to the present invention. The certificate status information for transmitting the certificate authority certificate status information and the wireless certificate status information to the real-time wireless certificate status information providing server is transmitted to the client terminal. Shows the process of creation.

First, the certification authority certificate revocation list generation means 1220 and the certification authority certificate revocation list registration means 1230 of the top-level certification authority server 100 generate the changed certification authority certificate information, that is, the certification authority certificate revocation list, and the directory. It registers with the server device 1300 (S301). In addition, the certification authority certificate revocation list transmission means 1240 transmits the certification authority certificate revocation list to the real-time wireless certificate status information providing server 500 (S302).

Meanwhile, the wireless certificate revocation list generation and registration means 2120 of the certification authority server 200 collects the revoked wireless certificate status information in real time and registers it in the directory server device 2400 (S303). Thereafter, the wireless certificate status information transmitting means 2240 of the certification authority server 200 transmits the wireless certificate status information to the real-time wireless certificate status information providing server 500 (S304).

Certification authority certificate status information storage means 5140 of the real-time wireless certificate status information providing server 500 that receives the certification authority certificate status information and the wireless certificate status information from the highest certification authority server 100 and the certification authority server 200, and The wireless certificate status information storing unit 5120 stores the certification authority certificate status information and the wireless certificate status information in a database, respectively (S305).

Thereafter, the final status information determination and validity period management means 5230 of the real-time wireless certificate status information providing server 500 combines the status information of the certification authority certificate and the status information of the wireless certificate to determine the final status information (valid, invalid, etc.). ), And sets a valid period for the final status information (S306).

In this way, the real-time wireless certificate status information providing server 500 is to hold the wireless certificate issued for each client terminal B, the status information of the certificate authority certificate that issued it, the final status information generated therefrom, The status information is transmitted to the client terminal A when the client terminal A requests. In addition, whenever the status of the wireless certificate and the certification authority certificate is changed, it is reported from the highest certification authority server 100 and the certification authority server 200, and the final status information is updated, so the status information of the wireless certificate and the certification authority certificate is always It can be updated with the latest information.

9 is a flowchart illustrating a wireless certificate verification method using the wireless certificate state management system according to the present invention.

When the user accesses the client terminal B 400 through the wireless Internet by using the client terminal A 300 and conducts commerce (S401, S402), the client terminal A (in general) needs to input information for payment substantially. 300 requests to present a wireless certificate for the verification of the transaction party server, that is, the client terminal B 400 (S403), and the client terminal B 400, which is the transaction party server, is itself a client terminal A (300). Transmit the wireless certificate of (S404). This procedure may be achieved through a method such as SSL (Transport Socket Security) or TLS (Transport Layer Security) used to reliably transmit and receive data. SSL and TLS are protocols for general communication authentication and encryption over TCP / IP networks. To this end, the client terminal B (400) has to finish the registration of the highest level certification authority as a trusted certification authority in advance.

In order to verify the wireless certificate presented by the client terminal B 400, the client terminal A 300 uses the information of the client terminal B 400 specified in the wireless certificate to know the physical server information through the network connection with the actual server. (IP, DNS) checks whether the match and attempts to access the real-time wireless certificate status information providing server 500 and requests the status information (S405).

The real-time wireless certificate status information providing server 500 determines the final status information by inquiring the status information of the certification authority certificate from the database and combining the status information values of the wireless certificate that is requested to provide the status information, and the result value (valid or invalid). , Etc.) are generated and digitally signed (S406) and transmitted to the client terminal A 300 (S407). In this case, when failing to transmit the final status information to the client terminal A (300), it is preferable to retransmit the final status information according to the specified number of retransmissions and retransmission period.

Client terminal A (300) analyzes the result value received from the real-time wireless certificate status information providing server 500 (S408), and if it is confirmed that valid, verifies the electronic signature of the issuer (S409). If the validity check and the digital signature verification result is valid, the transaction can be continued (S410), and if the certificate is not valid, the user can be instructed to stop the transaction (S411).

If, as a result of the analysis of step S408, the final status information is found to be 'other' value which is not valid or invalid, the wireless certificate status information checking means 350 of the wireless certificate status information checking means 350 of the client terminal A 300 ( The method determines how to process the information with reference to information (360). In practice, these policies may vary depending on the service characteristics.

In particular, the wireless certificate status information management device 5100 of the real-time wireless certificate status information providing server 500 stores the status information of the certification authority certificate in the database 5320 according to a regular renewal cycle of the certification authority certificate revocation list. Accordingly, all the wireless certificates issued by the revoked certification authority can be inquired and their status can be invalidated. This can improve the processing speed of the wireless terminal by the time required to retrieve the certification authority certificate from the database.

As such, those skilled in the art will appreciate that the present invention can be implemented in other specific forms without changing the technical spirit or essential features thereof. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

As described above, according to the present invention, the wireless terminal status information and the certification authority certificate status information are simultaneously managed, and the wireless certificate status information and the certification authority certificate status information are inquired at the request of the client terminal, and the final status information therefrom. By generating and providing to the client terminal, it is possible to verify the validity of the wireless certificate of the transaction target server in one transaction only.

Claims (30)

A first client terminal capable of accessing a mobile communication network through a base station, a second client terminal providing a wireless Internet service to a first client terminal connected to the mobile communication network through the Internet, and the first client terminal or a second client terminal. A wireless certificate status management system including a certification authority server for issuing and managing a wireless certificate, and a top certification authority server for issuing and managing a certification authority certificate for allowing the certification authority server to issue the wireless certificate. Obtain and manage a real-time wireless certificate status information providing certificate, which is a private key and a public key certificate corresponding to the digital signature, from the highest-level certification authority server, and manages it from the highest-level certification authority server. A client that receives the status information of the certification authority certificate, receives and stores the wireless certificate status information from the certification authority server, generates final status information from the certification authority certificate status information and the wireless certificate status information, and requests the wireless certificate status information. Also provided with a real-time wireless certificate status information providing server for transmitting to the terminal, The certification authority server provides the real-time wireless certificate status information providing server when the state of the wireless certificate is changed, The highest certification authority server issues and manages a certificate for providing wireless certificate status information to delegate the authority for providing wireless certificate status information to the real-time wireless certificate status information providing server, and when the certification authority certificate is revoked, the certification authority. Create a certificate revocation list and transmit to the real-time wireless certificate status information providing server, The first client terminal or the second client terminal is connected to the real-time wireless certificate status information providing server and receives the final status information to determine the validity of the wireless certificate, characterized in that the wireless certificate. The method of claim 1, The highest certification authority server may include: an authentication device for issuing and managing the certification authority certificate and issuing and managing the certificate for providing the wireless certificate status information; A certificate revocation list management device for generating and storing a certification revocation certificate revocation list when the status of the certification authority certificate is changed, and transmitting the revocation list of certification authority certificates to the real-time wireless certificate status information providing server; And A directory server device for registering the certificate revocation list; Wireless certificate status management system comprising a. The method of claim 2, The authentication apparatus issues and manages a certification authority certificate that allows the certification authority server to issue a certificate to a first client terminal or a second client terminal, and if the certification authority certificate is revoked, the certification authority certificate revocation list. Certificate authority certificate management means for transmitting to the management device; Certificate management means for providing wireless certificate status information for issuing / revoking and managing a certificate for delegating authority for providing wireless certificate status information to the real-time wireless certificate status information providing server; Wireless certificate status information providing certificate generating means for generating the wireless certificate status information providing certificate in an electronically signed form for transmission to a client terminal; Wireless certificate status information providing certificate transmitting means for transmitting the electronically signed wireless certificate status information providing certificate to a client terminal; And Electronic signature and encryption / decryption means for digitally signing and encrypting the certificate for providing the wireless certificate status information; Wireless certificate status management system further comprising. The method of claim 2, The certificate revocation list management apparatus includes: a certification authority certificate revocation list generation policy management means for providing a validity criterion including a certificate validity period for the certification authority certificate; Certification authority certificate revocation list generation means for generating a certification authority certificate revocation list based on the certificate revocation record received from the authentication device; Certification authority certificate revocation list registration means for registering the generated certification authority certificate revocation list to a directory server device; Certificate authority certificate revocation list transmission means for notifying the certification authority certificate revocation list to the real-time wireless certificate status information providing server; And Electronic signature and encryption / decryption means for performing and encrypting the digital signature on the certificate authority certificate revocation list; Wireless certificate status management system further comprising. The method of claim 1, The certification authority server may include: a wireless authentication device for generating and issuing the wireless certificate and generating the wireless certificate revocation list when the state of the wireless certificate is changed; A directory server device for registering a wireless certificate revocation list generated by the wireless authentication device; A wireless certificate status information monitoring apparatus for receiving a wireless certificate revocation list from the wireless authentication apparatus, storing wireless certificate status information, and transmitting the wireless certificate status information to the real-time wireless certificate status information providing server; And A database for storing the wireless certificate status information; Wireless certificate status management system comprising a. The method of claim 5, wherein The wireless authentication apparatus includes: wireless certificate management means for issuing a wireless certificate to a client terminal requesting the issuance of a wireless certificate, and managing, revoking, and reissuing the wireless certificate; Means for generating and registering a wireless certificate revocation list for generating a wireless certificate revocation list and registering it in the directory server device when the issued wireless certificate is revoked or suspended; Wireless certificate revocation information transmitting means for transmitting to the wireless certificate status information monitoring apparatus to notify the real-time wireless certificate status information providing server when the status of the wireless certificate is changed; And Electronic signature and encryption / decryption means for performing and encrypting the electronic signature on the wireless certificate status information; Wireless certificate status management system further comprising. The method of claim 5, wherein The wireless certificate status information monitoring apparatus includes: wireless certificate status information receiving means for receiving wireless certificate information whose status is changed from the wireless authentication apparatus; Wireless certificate status information storage means for storing the wireless certificate status information in the database; Wireless certificate status information transmission policy management means for providing a transmission criterion for the wireless certificate revocation list; And Wireless certificate status information transmitting means for transmitting the wireless certificate status information to the real-time wireless certificate status information providing server; Wireless certificate state management system further comprising. The method of claim 7, wherein The wireless certificate status information transmission policy management means provides a retry frequency and a retry period for retransmitting the wireless certificate when the wireless certificate status information transmission fails to the real-time wireless certificate status information providing server. Wireless certificate state management system. The method of claim 1, The real-time wireless certificate status information providing server receives wireless certificate status information from the certification authority server, receives certification authority certificate status information from the highest-level certification authority server, and receives the received wireless certificate status information and certification authority certificate. A wireless certificate status information management device for performing digital signature on the status information and encrypting the status information; A database for storing digital certificate and encrypted wireless certificate status information and certification authority certificate status information by the wireless certificate status information management apparatus; And At the request of the client terminal, the database is queried to query the wireless certificate status information and the certification authority certificate status information, and the final status information is generated by combining the wireless certificate status information and the certification authority certificate status information to the client terminal. An apparatus for providing wireless certificate status information for transmission; Wireless certificate state management system comprising a. The method of claim 9, The apparatus for managing wireless certificate status information includes: wireless certificate status information receiving means for receiving wireless certificate status information from the certification authority server; Wireless certificate status information storing means for storing the wireless certificate status information received by the wireless certificate status information receiving means in the database; Certification authority certificate revocation list verification means for receiving the certification authority certificate revocation list received from the top certification authority server and verifying the digital signature of the highest certification authority; A certification authority certificate status information storing means for storing certification authority certificate status information together with the certification authority certificate revocation list in the database when the verification of the certification authority certificate revocation list verification means is successful; And Electronic signature and encryption / decryption means for performing digital signature and encryption on the certification authority certificate status information and the wireless certificate status information; Wireless certificate status management system further comprising. The method of claim 10, And the certification authority certificate revocation list verification means stores the certification authority certificate status information and a hash value used for encryption when storing the certification authority certificate revocation list in the database. The method of claim 9, The apparatus for providing wireless certificate status information includes: wireless certificate status information request receiving means for receiving a wireless certificate status information request from the client terminal; Wireless certificate status information inquiry means for inquiring from the database of status information of a corresponding wireless certificate and status information of a certification authority certificate according to a request of the client terminal; Final status information determination and validity period management means for deriving and electronically signing final status information to be transmitted to the client terminal based on the certificate status information inquired from the database, and managing validity period for the final status information; And Wireless certificate status information transmitting means for transmitting the final status information derived from said final status information determination and validity period management means to said client terminal; Wireless certificate state management system further comprising. The method of claim 12, And the final status information is valid, invalid, or any other. The method of claim 9, The database includes a state information database for storing the wireless certificate state information; And An ARL (Authority Revocation List) database for storing the certification authority certificate revocation list and the certification authority certificate status information; Wireless certificate state management system comprising a. The method of claim 1, The client terminal requesting the wireless certificate status information includes a control unit, an I / O interface, and an RF communication module. Wireless certificate status information requesting means for requesting wireless certificate status information and certification authority certificate status information to the real-time wireless certificate status information providing server; Wireless certificate status information checking means for analyzing the wireless certificate status information and the certification authority certificate status information received from the real-time wireless certificate status information providing server and confirming the validity; Wireless certificate status verification policy management means for providing a criterion for determining the certificate status information as valid; Electronic signature verification means for verifying an electronic signature of an issuer when the wireless certificate is found to be valid; And Certificate information storage means for storing the digital signature verified certificate in a storage device; Wireless certificate state management system further comprising. Issuing and managing certification authority certificates and certificates for providing real-time wireless certificate status information, and if the status of certification authority certificates is changed, register the certification authority certificate revocation list on the directory server device, and perform digital signature on the certification authority certificate revocation list. A top certificate authority server for transmitting; Issuing and managing a wireless certificate to the client terminal that requested the wireless certificate, and when the status of the wireless certificate is changed, the wireless certificate revocation list is registered in the directory server device and stored in the database. Institutional server; And receiving and managing a certificate for providing real-time wireless certificate status information from the highest certification authority server, receiving status information of a certification authority certificate from the highest certification authority server, and receiving and storing wireless certificate status information from the certification authority server. A wireless certificate status management method in a wireless certificate status management system having a real-time wireless certificate status information providing server, Generating and storing the changed certification authority certificate information and the certification authority certificate revocation list in the top certification authority server; Transmitting, by the highest certification authority server, the certification authority certificate revocation list to the real-time wireless certificate status information providing server; Collecting and storing wireless certificate status information revoked by the certification authority server in real time; Transmitting, by the certification authority server, the wireless certificate status information to the real-time wireless certificate status information providing server; In the real-time wireless certificate status information providing server, receiving the certification authority certificate status information and the wireless certificate status information from the highest level certification authority server and the certification authority server and storing the certification authority certificate status information and the wireless certificate status information in a database, respectively. step; And Determining final status information by combining status information of the certification authority certificate and status information of the wireless certificate; Wireless certificate status management method comprising a. The method of claim 16, In the step of transmitting the wireless certificate status information to the real-time wireless certificate status information providing server by the certification authority server, when the transmission of the wireless certificate status information fails, the wireless certificate status information is retransmitted according to a specified number of retransmissions and a retransmission period. Wireless certificate status management method characterized in that. The method of claim 16, The final status information determined by the real-time wireless certificate status information providing server is any one of valid, invalid, and other wireless certificate status management method. The method of claim 16, And determining the validity period for the final status information after determining the final status information in the real-time wireless certificate status information providing server. Issuing and managing certification authority certificates and certificates for providing real-time wireless certificate status information, and if the status of certification authority certificates is changed, register the certification authority certificate revocation list on the directory server device, and perform digital signature on the certification authority certificate revocation list. A top certificate authority server for transmitting; Issuing and managing a wireless certificate to the client terminal that requested the wireless certificate, and when the status of the wireless certificate is changed, the wireless certificate revocation list is registered in the directory server device and stored in the database. Institutional server; And receiving and managing a certificate for providing real-time wireless certificate status information from the highest certification authority server, receiving status information of a certification authority certificate from the highest certification authority server, and receiving and storing wireless certificate status information from the certification authority server. As a wireless certificate status verification method using a wireless certificate status management system having a real-time wireless certificate status information providing server for generating the final status information based on this, Connecting a first client terminal to a second client terminal that has received a wireless certificate from the certification authority certificate to use a wireless Internet service, and requesting a wireless certificate from the second client terminal; Transmitting, by the second client terminal, its wireless certificate to the first client terminal; Using the second client terminal information specified in the wireless certificate received from the second client terminal, the first client terminal checks whether the physical server information known through the network connection with the actual server is matched and the real time wireless certificate status information. Requesting status information of the wireless certificate by accessing a provision server; Querying, by the real-time wireless certificate status information providing server, the status information of the certification authority certificate and the wireless certificate status information, and determining final status information based on the status information; Transmitting, by the real-time wireless certificate status information providing server, to the first client terminal after performing an electronic signature on the final status information; Verifying, by the first client terminal, the final status information, when the wireless certificate is valid, the digital signature of the wireless certificate issuer; And Continuing the transaction with the second client terminal if the validity confirmation and the digital signature verification result of the final state information are valid; Wireless certificate status verification method comprising a. The method of claim 20, And transmitting the wireless certificate from the second client terminal to the first client terminal using Secure Socket Layer (SSL) or Transport Layer Security (TLS). The method of claim 20, The final status information is valid, invalid, any one of the other wireless certificate status verification method, characterized in that. The method of claim 20, And retransmitting according to a specified number of retransmissions and retransmission periods when the real-time wireless certificate status information providing server fails to transmit the final status information to the first client terminal. The method of claim 20, And notifying the first client terminal user to suspend a transaction with the second client terminal if the wireless certificate is not valid as a result of the analysis of the final state information. The method of claim 20, And when the state of the wireless certificate cannot be determined to be valid or invalid as a result of the analysis of the final state information, determining the validity of the wireless certificate by the first client terminal itself. A first client terminal capable of accessing a mobile communication network through a base station and a second client terminal providing wireless Internet service to a first client terminal connected to the mobile communication network via the Internet, and are connected through the Internet, and the first client terminal Or issuing and managing a wireless certificate to a second client terminal and connected to an authentication authority server for storing state information of the wireless certificate when the state of the wireless certificate is changed, and permitting the certification authority server to issue the wireless certificate. Issuing and managing the certification authority certificate for the certificate, and when the certification authority certificate is revoked, is connected to the highest-level certification authority server that generates and stores the certification authority certificate revocation list, Obtain and manage a real-time wireless certificate status information providing certificate, which is a private key and a public key certificate corresponding to the digital signature, from the highest-level certification authority server, and manages it from the highest-level certification authority server. Receives the status information of the certification authority certificate, receives and stores the wireless certificate status information from the certification authority server, generates final status information from the certification authority certificate status information and wireless certificate status information, so that the client terminal receives the wireless certificate. Real-time wireless certificate status information providing system, characterized in that for transmitting the final status information to the client terminal when requesting the status information. The method of claim 26, The real-time wireless certificate status information providing system receives wireless certificate status information from the certification authority server, receives certification authority certificate status information from the highest certification authority server, and receives the received wireless certificate status information and certification authority certificate. A wireless certificate status information management device for performing digital signature on the status information and encrypting the status information; A database for storing digital certificate and encrypted wireless certificate status information and certification authority certificate status information by the wireless certificate status information management apparatus; And At the request of the client terminal, the database is queried to query the wireless certificate status information and the certification authority certificate status information, and the final status information is generated by combining the wireless certificate status information and the certification authority certificate status information to the client terminal. An apparatus for providing wireless certificate status information for transmission; Real time wireless certificate status information providing system comprising a. The method of claim 27, The apparatus for managing wireless certificate status information includes: wireless certificate status information receiving means for receiving wireless certificate status information from the certification authority server; Wireless certificate status information storing means for storing the wireless certificate status information received by the wireless certificate status information receiving means in the database; Certification authority certificate revocation list verification means for receiving the certification authority certificate revocation list received from the top certification authority server and verifying the digital signature of the highest certification authority; A certification authority certificate status information storing means for storing certification authority certificate status information together with the certification authority certificate revocation list in the database when the verification of the certification authority certificate revocation list verification means is successful; And Electronic signature and encryption / decryption means for performing digital signature and encryption on the certification authority certificate status information and the wireless certificate status information; Real time wireless certificate status information providing system further comprises. The method of claim 27, The apparatus for providing wireless certificate status information includes: wireless certificate status information request receiving means for receiving a wireless certificate status information request from the client terminal; Wireless certificate status information inquiry means for inquiring from the database of status information of a corresponding wireless certificate and status information of a certification authority certificate according to a request of the client terminal; Final status information determination and validity period management means for deriving and electronically signing final status information to be transmitted to the client terminal based on the certificate status information inquired from the database, and managing validity period for the final status information; And Wireless certificate status information transmitting means for transmitting the final status information derived from said final status information determination and validity period management means to said client terminal; Real time wireless certificate status information providing system further comprising. The method of claim 26, The final status information is valid, invalid, any of the real-time wireless certificate status information providing system, characterized in that any one.