KR20110122452A - Electronic signaturing verification server and electronic transaction method using the same - Google Patents

Abstract

PURPOSE: An electronic signature verification server and electronic transaction using the same are provided to prevent hacking according to the installation of pug-in by verifying an integrity electronic transaction detail and a confidentialness electronic transaction detail. CONSTITUTION: When a client requests transactions to an electronic transaction server, a TBS(To Be Signed) management unit(120) receives data which receives signature from the client or the electronic transaction server. A security channel creation unit(130) creates a security channel and transmits the TBS data to the client according to the reception of the TBS data. A verification unit(140) verifies the client according to the transmission of the TBS data which includes the electronic signature and transmits a verification result to the electronic transaction server. The security channel creation unit creates the security channel using an SSL/TLS(Secure Socket Layer/Transport Layer Security) protocol.

Description

Electronic Signature Verification Server and Electronic Transaction Method Using the Same

The present invention relates to an online service, and more particularly, to an electronic signature verification server for an online service such as an electronic financial transaction requiring transaction party authentication and non-repudiation of a transaction, and an electronic transaction method using the same.

Electronic transactions are provided in various fields such as electronic contracts and bidding, as well as electronic financial transactions, including electronic payment transactions represented by card payment, Internet banking or Home Trading Service (HTS). Such electronic transactions are carried out not only through wired communication networks but also through wireless communication networks, and are accompanied with various security processes for confirming forgery of transaction parties and contents of transactions during electronic transactions.

In general, non-repudiation of user authentication and transaction details is performed by an accredited certificate issued by an accredited certification authority.In the case of an electronic payment transaction, payment transactions below a specified amount may be performed through a private certificate or a registered password. have.

In the case of South Korea, the electronic payment transaction is made by digital signature and verification by Internet secure payment (ISP) or assured click method.

In the ISP method, as the client requests a transaction to the content provider server, the content provider server transmits the transaction request information to the authenticator server through the payment gateway (PG) to request user authentication and verification. Accordingly, the authentication server server transmits and receives an electronic signature value with the client to perform authentication and verification. When the verification is completed, the authentication company requests payment approval to the card company. When the payment is approved by the card company, the electronic payment process is completed.

To this end, the client is equipped with a browser plug-in such as a PG client, a private authentication client, or a public authentication client. In addition, the PG client links a private or authorized authentication client page with the PG client to authenticate the user.

In the secure click method, authentication and verification are performed on the card company server without a separate authentication company server. That is, as the client requests a transaction to the content provider server, the content provider server transmits the transaction request information to the card company server through the payment gateway to request user authentication and verification. The card company server transmits and receives an electronic signature value with the client to perform authentication and verification. When verification is completed, the payment process is completed by completing the electronic payment process.

In the secure click method, the PG client plug-in should be installed in the client, and the user authentication is performed by linking the authentication page of the card company server in the PG client.

In both the ISP method and the secure click method, if the payment amount exceeds the specified amount, the certificate server or the card company server requests the electronic signature using the certificate as a client, and the certificate of the client is verified by the certificate server.

On the other hand, South Korea mandates the use of accredited certificates for electronic banking transactions such as Internet banking services or HTS. That is, as a client who wants to use the electronic financial transaction service requests a transaction to a bank or securities company, the bank or securities company server transmits data to be signed (TBS) to the client.

The client has a certified client installed as a browser plug-in. The client receiving the TBS executes the accredited certification client, signs the TBS using the accredited certificate, and transmits the digitally signed data to the server of the bank or securities firm. The bank or securities company server is installed with a certification module, and requests verification of the certificate to the server of the certification body. Therefore, when it is confirmed that the user is a legitimate user, the electronic financial transaction can be made.

In the case of electronic contracts or bids, users are authenticated and certified certificates in a similar way to electronic financial transactions. In other words, the client is installed in the form of a browser authentication plug-in to the client, the digital signature is to be made using this.

As such, in the current electronic transaction, at least one of a PG client, a private authentication client, and an authorized authentication client should be installed in the form of a browser plug-in in order to perform user authentication and verification.

However, since these browser plug-ins only operate in designated browsers, a separate program must be created for each browser, which is disadvantageous as well as inefficient.

Moreover, most browser plug-ins installed with plug-in technologies such as ActiveX can access computer files or the Windows system registry, which can be exploited for hacking purposes, and when a browser plug-in is installed with a virus or spyware. Of course, there are problems such as unwanted programs are automatically installed.

Mobile communication terminals supporting wireless data communication, which is represented by 3rd generation wireless communication technology, are spreading, and when a financial transaction is to be made through these mobile communication terminals, a plug-in for each browser or a specially developed program must be installed separately. .

Therefore, there is an urgent need for a method for securely performing authentication and electronic signature in electronic transactions without using a browser plug-in.

The present invention provides a digital signature verification server for performing user authentication through browser authentication and verification in electronic transactions, and an electronic transaction method using the same.

Another technical problem of the present invention is to provide an electronic signature verification server capable of performing an electronic signature without installing a separate browser plug-in and an electronic transaction method using the same.

An electronic signature verification server according to an embodiment of the present invention for achieving the above technical problem is an electronic signature verification server connected to an electronic transaction server and a client through a communication network, the client requests a transaction to the electronic transaction server Accordingly, the TBS management unit for receiving the To Be Signed (TBS) data from the electronic transaction server or the client; A security channel generator for transmitting the TBS data to the client and generating a secure channel as the TBS data is received; And a verification unit for verifying the client and transmitting the verification result to the electronic transaction server as the electronically signed TBS data is transmitted from the client.

Meanwhile, the electronic transaction method according to an embodiment of the present invention is an electronic transaction method using an electronic signature verification server connected to an electronic transaction server and a client through a communication network, and as the client requests a transaction to the electronic transaction server, Receiving, by the electronic signature verification server, To Be Signed (TBS) data from the electronic transaction server or the client; The digital signature verification server transmitting the TBS data to the client and creating a secure channel; And verifying the client by the digital signature verification server as the electronically signed TBS data is transmitted from the client. The electronic transaction is completed according to the verification result.

In the present invention, electronic signatures and verifications are made securely through a browser authentication method during electronic transactions. In other words, the integrity, confidentiality, and nonrepudiation of electronic transaction details can be achieved using a certificate embedded in a browser without installing a certificate support plug-in on the client.

Accordingly, problems such as hacking due to browser plug-in installation, distribution of viruses or spyware, automatic installation of unnecessary programs, and the like can be solved.

1 is a view for explaining the connection relationship between the digital signature verification server and the communication network according to the present invention;
2 is a block diagram of an electronic signature verification server according to an embodiment of the present invention;
3 is a view for explaining a concept of transmission and reception of TBS data and digital signature data according to the present invention;
4 is a flowchart illustrating an electronic transaction method according to an embodiment of the present invention;
5 is a flowchart for explaining a process of creating a secure channel shown in FIG. 4;
6 is a flowchart illustrating an example of an electronic transaction method according to the present invention;
7 is a flowchart for explaining another example of the electronic transaction method according to the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a view for explaining a connection relationship between a digital signature verification server and a communication network according to the present invention.

The electronic signature verification server 10 according to the present invention is connected to the electronic transaction server 30 through the communication network 20 and to the client 40. The electronic transaction server 30 may include, for example, a content provider server (CP server) 301 such as a shopping mall, an electronic financial server 303 such as a bank, a card company, a securities company, or an electronic contract / bid server 305. have. In addition, the client includes a personal computer 401 or a smart phone 40 capable of wired and wireless Internet access.

When the client 40 requests a transaction to the electronic transaction server 30, the data to be signed (TBS) is transmitted to the electronic signature verification server 10. At this time, the data to be signed (TBS) may be received from the electronic transaction server 30 (in the case of electronic payment transaction) or from the client 40 (in the case of electronic financial transaction, electronic contract / bidding).

Accordingly, the digital signature verification server 10 generates a secure channel by accessing the client 40, and transmits the TBS to the client when the secure channel is generated. If there is data to be digitally signed, the client performs the digital signature by the encryption method, key exchange method, and signature method negotiated at the time of secure channel generation, and transmits the digital signature to the digital signature verification server 10, and the digital signature verification server 10. ) Verifies the digital signature by decoding the digitally signed data.

The electronic signature verification server 10 may be configured independently of the electronic transaction server 30, or may be configured in a module form on the electronic transaction server 30. In particular, since the electronic banking server 303 directly performs a transaction with the client 40, it may be advantageous to install the electronic signature verification server 10 in a module form.

In addition, the digital signature verification server 10 is connected to the certification authority server 50 through the value-added network (VAN), when the client 40 performs the digital signature using the certificate, verify the corresponding certificate do. Digital signatures using accredited certificates may be used for electronic payment transactions, internet banking, HTS, electronic contract / bidding in excess of the specified amount.

2 is a block diagram of an electronic signature verification server according to an embodiment of the present invention.

As shown in FIG. 2, the digital signature verification server 10 provides a communication network interface that provides a protocol for receiving data and control signals with the electronic transaction server 30, the client 40, and the certification authority server 50. 110, a TBS management unit 120, a secure channel generation unit 130, and a verification unit 140.

The TBS manager 120 receives (TBS) data to be signed from the electronic transaction server 30 or the client 40. The received TBS data will be transmitted to the client 40 when the secure channel generation unit 130 generates the secure channel, and a detailed description thereof will be described later.

The secure channel generation unit 130 generates a secure channel with the client 40 using an SSL / TLS (Secure Socket Layer / Transport Layer Security) security protocol. That is, the client 40 and the digital signature verification server 10 negotiate an encryption scheme, a key exchange scheme, and a signature scheme to use after the handshake process. In addition, the TBS data received from the TBS management unit 120 is transmitted to the client 40 when creating a secure channel.

As the digitally signed data is transmitted from the client 140, the verification unit 140 decrypts the digitally signed data by an encryption method, a key exchange method, and a signature method negotiated when generating a secure channel, and verifies the electronic signature.

Web pages transmitted and received between the client 40 and the digital signature verification server 10 through the Internet are processed through the Hypertext Transfer Protocol (HTTP) protocol or the Hypertext Transfer Protocol Secure (HTTPS) protocol. HTTP can be thought of simply as a text exchange for web pages, and HTTPS differs from HTTP in that it encrypts and transmits the communication.

When the client 40 wants to connect to a particular server, the client 40 must be able to trust that server and that server must also be able to trust the client 40. Furthermore, if the information transmitted and received between the client 40 and the server is encrypted so as not to leak, more reliable service can be provided.

The protocol designed for this is the Secure Socket Layer / Transport Layer Security (SSL / TLS) security protocol. In the SSL / TLS security protocol, at least the first authentication between the client 40 and the server provides mutual authentication. Additionally, the SSL / TLS security protocol may also provide a method in which information transmitted and received after the secure channel is encrypted is transmitted.

The handshake process using the SSL / TLS security protocol can be performed at the session layer of the OSI 7 layer model. If the secure channel is created and the subsequent data is transmitted and received through the secure channel, the client (after the handshake is completed) All information transmitted and received between the server 40 and the server is transmitted in a secure communication method determined during the handshake process.

With this in mind, the present invention designates that during the handshake process between the client 40 and the digital signature verification server 10 using the SSL / TLS security protocol, the TBS data to be signed in the electronic transaction is also included in the secure communication. do. That is, when the digital signature verification server 10 informs the client 40 of the data to be signed in the handshake process, the client 40 electronically transmits the TBS data by the encryption method and the signature method determined during the handshake process. The signature is transmitted to the digital signature verification server 10.

To this end, the client 40 only performs an operation of connecting to the digital signature verification server 10 through the communication network 20, and does not require any change or additional program installation for the client 40. In other words, an electronic signature for electronic transactions can be made without installing a separate program such as a browser plug-in.

The TBS management unit 120 of the digital signature verification server 10 receives the TBS data to be signed from the electronic transaction server 30 or the client computer 40, and this process is performed in the application layer of the OSI 7 layer model. Can be.

3 is a view for explaining the concept of transmission and reception of TBS data and digital signature data according to the present invention.

The TBS data received at the application layer is transmitted to the session layer through the interlocking unit 160. In addition, the client 40 informs the client 40 of the TBS data to be signed during the handshake with the client 40, and verifies this when the electronically signed data to be signed is transmitted from the client 40.

Information other than the data to be signed may be processed in the application layer of the OSI 7 layer model 150. On the other hand, the data to be signed is received and verified through the session layer and then transmitted to the application layer through the interlocking unit 160.

The SSL / TLS security protocol does not need to install any plug-in, so it can be used in all operating systems or web browsers, and can be applied to data communication portable terminals such as smartphones. Moreover, the SSL / TLS security protocol uses the browser's own security certificate. Since the security certificate embedded in the browser is encrypted and stored on its own, it is advantageous for security because it cannot be decrypted even if it is leaked through hacking.

4 is a flowchart illustrating an electronic transaction method according to an embodiment of the present invention.

As the client 40 requests a transaction to the electronic transaction server 30, data to be signed (TBS) is transmitted from the electronic transaction server 30 or the client computer 40 to the digital signature verification server 10 (S10). ).

Accordingly, the digital signature verification server 10 is connected to the client computer to create a secure channel (S20), and accordingly the encryption method, key exchange method, signature method is determined, and the TBS data received in step S10 is the client 40 is sent.

Thereafter, when the TBS data digitally signed by the signature method negotiated when the secure channel is generated from the client 40 is transmitted (S30), the digital signature verification server 10 decrypts the digitally signed TBS data and verifies the digital signature. (S40).

The verification result is transmitted to the electronic transaction server 30 so that the electronic transaction can be completed (S50).

FIG. 5 is a flowchart illustrating a secure channel generation process shown in FIG. 4.

The client 40 first informs the digital signature verification server 10 of a security scheme that can be supported by the client 40, that is, a supported encryption scheme, a key exchange scheme, a signature scheme, and a compression scheme (ClientHello, S201).

In one embodiment of the present invention, the client 40 and the digital signature verification server 10 may use a key exchange algorithm, authentication algorithm, symmetric key algorithm, hash algorithm used in the SSL / TLS security protocol.

That is, the key exchange algorithm may be any one of RSA (Rivest-Shamir-Adleman), Diffie-Hellman, Elliptic Curve Diffie-Hellman (ECDH), Secure Remote Password (SRP), and Pre-Shared Key (PSK). The authentication algorithm may be one of RSA, Digital Signature Algorithm (DSA), and Elliptic Curve Digital Signature Algorithm (ECDSA). Symmetric key algorithms include RC4, Triple Data Encryption Standard (3DES), Advanced Encryption Standard (AES), Camellia, and HMAC-MD5 (The Keyed-Hash Message Authentication Code Message Digest 5) and HMAC-SHA (Hash Algorithm). The Keyed-Hash Message Authentication Code Secure Hash Algorithm (MD), Message Digest 5 (MD5), or Secure Hash Algorithm (SHA) can be used.

Accordingly, the digital signature verification server 10 determines and responds to one of the security methods supported by the client 40 (ServerHello, S202). At this time, the response message (ServerHello) of the digital signature verification server 10 includes a random value of the server side, in the present invention, a hash value of the data to be signed to the server-side random value information (TBS_H) ) And send it. Here, the TBS_H value may be included in the Extension field of the ServerHello message when the client 40 supports the TLS extension protocol.

In this way, when the security method is determined and the data to be signed is provided, the digital signature verification server 10 transmits the certificate of the server storing the encryption public key to the client 40 (Sever Certificate), and additionally, the client 40. A certificate may be requested (CertificateRequest) (S203).

According to the certificate request of the digital signature verification server 10, the client 40 selects one of the certificates held by the digital signature verification server 10 and transmits it to the digital signature verification server 10 (Client Certificate, S204). In one embodiment of the present invention, the certificate sent by the client 40 may be a security certificate embedded in the browser.

Subsequently, the client 40 transmits a reserved key to the digital signature verification server 10 for key exchange (ClientKeyExchange, S205), and transmits a signature value signed with the signature private key of the client 40 (CertificateVerify, S206). ). At this time, the value to be signed is a handshake message previously transmitted and received, so that the data to be signed (TBS) included in the ServerHello message is also signed.

The client 40 informs the digital signature verification server 10 that the security scheme negotiated in the handshake process will be applied from the next message transmission (ChangeCipherSpec, Finished; S207).

The digital signature verification server 10 receiving the signature value verifies the client 40 by decrypting the signature value using the public key included in the certificate received by the client 40 in step S204.

If the client 40 is found to be legitimate, the digital signature verification server 10 transmits the verification value of the client in response to step S207 (ChangeCipherSpec, Finished; S208).

Referring back to FIG. 4, after the secure channel generation process (S20), the client 40 receives a signature from the transaction content of the client 40 with reference to the data to be signed (TBS) transmitted from the digital signature verification server 10. After generating the data TBS, the electronic signature is transmitted to the digital signature verification server 10, and the digital signature verification server 10 receives the data (S30).

Accordingly, the digital signature verification server 10 generates the original data using the hash value TBS_H of the data to be signed included in the handshake message, decrypts the electronic signature data transmitted from the client 40, The signature is to be verified (S40).

In summary, the present invention informs the client in advance of the data to be signed during the electronic transaction during the handshake process for secure channel creation. Then, when the client digitally signs and transmits the data to be signed according to the security method determined during the handshake process, the client is verified by verifying the data. Therefore, it is possible to perform digital signature and verification of electronic transaction details without having to install a browser plug-in such as ActiveX to process a certificate such as a separate public certificate.

6 is a flowchart illustrating an example of an electronic transaction method according to the present invention, which illustrates an electronic payment transaction method.

For an electronic payment transaction, the user registers a card for use in the payment transaction through the client 40, obtains a private certificate (for ISP method) or registers a payment password (for relief click), etc. A pre-registration procedure may be performed (S101).

Thereafter, when the client 40 accesses an electronic transaction server 30 such as the content provider server 301 and requests a transaction (S103), the electronic transaction server 30 may be signed by the digital signature verification server 10 ( TBS) data, that is, transaction request information is transmitted (S105).

The TBS data is transmitted to the TBS management unit 120 of the digital signature verification server 10, and then, the digital signature verification server 10 works with the client 40 to perform the digital signature verification process (S20 to S40 of FIG. 4). To perform. That is, the digital signature verification server 10 and the client 40 create a secure channel to determine a security method (an encryption method, a key exchange method, a signature method, a compression method, and the like), while the client 40 stores the TBS data. Send a hash value. When receiving the digitally signed TBS data from the client 40, the original data is generated by using the hash value of the TBS data, and the electronic signature is decrypted by decoding the digitally signed TBS data transmitted from the client 40. will be. Since a series of processes for verifying the electronic signature have already been described with reference to FIGS. 4 and 5, a detailed description thereof will be omitted.

The electronic signature verification server 10 transmits the digital signature verification result to an electronic financial transaction server such as a card company server so that payment is approved (S107), and notifies the content provider server, that is, the electronic transaction server 30 of the approval result. (S109) The electronic payment transaction is completed (S111).

In the present embodiment, the digital signature verification server 10 may be configured independently of the electronic transaction server and the card company server similar to the ISP method, or in a module form to the card company server, that is, the electronic financial transaction server similar to the secure click method. It may be configured.

In a preferred embodiment of the present invention, if the transaction amount exceeds the specified amount, the TBS data transmitted by the electronic transaction server 30 to the digital signature verification server 10 may include a certificate. Accordingly, after creating the secure channel, the client 40 digitally signs the public certificate with the corresponding private key, and uses the company-certified public certificate and transaction request information as the TBS data, and uses the negotiated security method when creating the secure channel. After the digital signature can be transmitted to the digital signature verification server (10).

Then, the digital signature verification server 10 decrypts the TBS data, extracts the digitally signed public certificate, and verifies the public certificate by interworking with the public certification authority server 50.

7 is a flowchart illustrating another example of the electronic transaction method according to the present invention, which illustrates an electronic financial transaction and an electronic contract / bidding method.

As the client 40 accesses the electronic transaction server 30 (any one of the electronic financial server 303 including the bank company server and the securities company server, the electronic contract / bid server 305) and requests a transaction (S201). ), The electronic transaction server 30 transmits the data to be signed (TBS) to the client 40, that is, the financial transaction details or the contract / bid details (S203).

Accordingly, the client 40 transmits the TBS data to the digital signature verification server 10 to perform the digital signature verification process (S20 to S40). The electronic verification process S20 to S40 has been described above with reference to FIGS. 4 and 5. In summary, the digital signature verification server 10 and the client 40 create a secure channel to determine the security method (encryption method, key exchange method, signature method, compression method, etc.), while the TBS data is sent to the client 40. Send a hash value of. When receiving the digitally signed TBS data from the client 40, the original data is generated by using the hash value of the TBS data, and the electronic signature is decrypted by decoding the digitally signed TBS data transmitted from the client 40. will be.

The electronic financial transaction, electronic contract / bidding transaction is generally performed based on a certificate, therefore, the TBS data transmitted from the client 40 to the digital signature verification server 10 in step S203 may include a certificate. Accordingly, after the secure channel is generated, the client 40 digitally signs the public certificate with the corresponding private key, electronically signs TBS data including the publicly signed public certificate and transmits the digital signature to the digital signature verification server 10.

Then, the digital signature verification server 10 decrypts the TBS data, extracts the digitally signed public certificate, and verifies the public certificate by interworking with the public certification authority server 50 (S205).

When the verification of the digitally signed TBS data including the digitally signed public certificate is completed, the electronic signature verification server 10 notifies the electronic transaction server 30 (S50), so that the electronic transaction is completed (S207).

As such, in the present invention, when the electronic transaction such as electronic payment, financial transaction, contract, bidding, etc., the electronic signature verification server 10 using the SSL / TLS security protocol and the client 40 in the handshake process during the handshake process to receive a signature ( TBS) data to be included in the secure communication. Accordingly, the client digitally signs the TBS data by the encryption method and the signature method determined during the handshake process and transmits the TBS data to the digital signature verification server 10.

As a result, the electronic signature and verification are performed by the browser authentication method without installing a browser plug-in such as a PG client, a certificate support client, or the like on the client 10.

Browser plug-ins can be misused beyond their inherent purpose, and present a variety of risks when installed. However, the present invention can achieve integrity, confidentiality, and nonrepudiation in electronic transactions without using such a plug-in, so that the electronic transaction can be secured while protecting the client.

Those skilled in the art to which the present invention pertains will understand that the present invention can be implemented in other specific forms without changing the technical spirit or essential features. Therefore, the above-described embodiments are to be understood as illustrative in all respects and not as restrictive. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

10: digital signature verification server
110: communication network interface
120: TBS management department
130: secure channel generation unit
140: verification unit
150: OSI 7th layer
160: linkage

Claims (27)

An electronic signature verification server connected to an electronic transaction server and a client through a communication network,
A TBS management unit which receives To Be Signed (TBS) data from the e-commerce server or the client as the client requests a transaction to the e-commerce server;
A security channel generator for transmitting the TBS data to the client and generating a secure channel as the TBS data is received; And
A verification unit for verifying the client and transmitting the verification result to the electronic transaction server as the electronically signed TBS data is transmitted from the client;
Electronic transaction verification server comprising a. The method of claim 1,
The secure channel generation unit, the digital signature verification server for generating a secure channel with the client using a secure socket layer / transport layer security (SSL / TLS) security protocol. The method of claim 1,
The verification unit, the digital signature verification server for verifying the digital signature by decoding the digitally signed TBS data transmitted from the client. The method of claim 1,
The TBS management unit is an electronic signature verification server for receiving TBS data including a certificate. The method of claim 4, wherein
The digital signature verification server is connected to a public certification authority server through a communication network,
The verification unit verifies the electronic signature by decrypting the electronically signed TBS data as the client electronically signs and transmits the TBS data including the public certificate electronically signed by the public certificate signature key, and the public certification authority server. Electronic signature verification server for verifying the electronic certificate signed in conjunction with the public key certificate key signed. The method of claim 1,
Electronic signature verification server configured in the module form on the electronic transaction server. The method of claim 1,
The electronic transaction server is any one of a content provider server, electronic financial transaction server, electronic contract / bid server. The method of claim 7, wherein
Electronic signature verification server configured in a module form on the electronic financial transaction server. An electronic transaction method using an electronic signature verification server connected to an electronic transaction server and a client through a communication network,
As the client requests a transaction to the electronic transaction server, the electronic signature verification server receiving To Be Signed (TBS) data from the electronic transaction server or the client;
The digital signature verification server transmitting the TBS data to the client and creating a secure channel; And
Verifying, by the digital signature verification server, the client as the electronically signed TBS data is transmitted from the client;
Allowing the electronic transaction to be completed according to the verification result;
Electronic trading method comprising a. The method of claim 9,
The generating of the secure channel may include determining a security method between the digital signature verification server and the client. The method of claim 10,
The security method includes an encryption method, a key exchange method, a signature method, and a compression method. The method of claim 10,
And electronically signing the digitally signed TBS data according to the determined security scheme. The method of claim 9,
The digital signature verification server transmits the TBS data to the client and creates a secure channel,
Sending, by the client, a security scheme supported by the client to the digital signature verification server;
Determining, by the digital signature verification server, any one of the client's supportable security schemes, and transmitting a response message including the TBS data; And
Performing authentication between the digital signature verification server and the client;
Electronic trading method comprising a. The method of claim 13,
The method according to claim 6,
The TBS data transmitted from the digital signature verification server to the client is transmitted in the form of a hash value. The method of claim 14,
As the client digitally signs and transmits the original data of the TBS data, the digital signature verification server generates the original data signed by the client from the hash value of the TBS data, and transmits the TBS data transmitted from the client. And decrypting the digital signature to verify the electronic signature. The method of claim 13,
The security method includes an encryption method, a key exchange method, a signature method, and a compression method. The method of claim 13,
The step of performing authentication between the digital signature verification server and the client,
Transmitting, by the digital signature verification server, a certificate of a server storing an encryption public key to the client;
The digital signature verification server requesting a certificate of the client;
Sending, by the client, the client's certificate to the digital signature verification server;
Sending, by the client, a signature value signed by the client to the digital signature verification server for a key exchange and a signature private key of the client;
Verifying the client by the digital signature verification server; And
If the verification result of the client is confirmed to be a legitimate client, the digital signature verification server transmitting the verification value of the client to the client;
Electronic trading method comprising a. The method of claim 17,
And the certificate transmitted by the client to the digital signature verification server is a security certificate embedded in the client's browser. The method of claim 17,
The signature value signed with the signature private key of the client is a signature value for a message transmitted and received in a previous process including the data to be signed. The method of claim 17,
Verifying the client by the digital signature verification server comprises decrypting the signature value using a public key included in a certificate received from the client. The method of claim 9,
The digital signature verification server is connected to an accredited certification authority server, the TBS data received by the digital signature verification server includes an electronic certificate. The method of claim 21,
The verifying of the client may include verifying the digital signature by decrypting the digitally signed TBS data as the electronically signed TBS data for the TBS data including the digitally signed certificate is transmitted from the client. And verifying the electronic certificate signed with the public certificate signing key in association with the public certification authority server. The method of claim 9,
The generating of the secure channel is a process of creating a secure channel with the client using a Secure Socket Layer / Transport Layer Security (SSL / TLS) security protocol. The method of claim 9,
The electronic transaction server is a content provider server, wherein the step of receiving the TBS data by the digital signature verification server is a process of receiving transaction request data from the content provider server. The method of claim 24,
And the electronic transaction is completed according to the verification result, wherein the electronic signature verification server receives a payment from a payment server and notifies the content provider server. The method of claim 9,
The electronic transaction server is connected to an accredited certification authority server, the electronic transaction server is an electronic financial transaction server or an electronic contract / bidding server, and the TBS data received by the electronic signature verification server is a financial transaction request data and an accredited certificate. Electronic transaction method that is a process that includes. The method of claim 26,
The verifying of the client may include verifying the digital signature by decrypting the digitally signed TBS data as the electronically signed TBS data for the TBS data including the digitally signed certificate is transmitted from the client. And verifying the electronic certificate signed with the public certificate signing key in association with the public certification authority server.

Images