KR100723835B1 - System for key authentication/service with one time authentication code and method therefor - Google Patents

Abstract

The present invention discloses a key authentication / service system using a one-time authentication code and a method thereof.

According to the present invention, the key management client requests the key management server to transmit a message required for generating an authentication code for requesting a key management service, and the key management server uses a challenge / response challenge message based on the transmitted message. Generate a one-time authentication code using a challenge message from the key management client and transmit the one-time authentication code together with the key management service request message to the key management server, and the key management server receives the one-time authentication code from the key management client to determine whether to authenticate. Checks the authority of the key management client by checking it, and provides the service included in the key management service request message of the key management client whose authority has been verified by the key management server. Prevent false authentication after using verification code In particular, the authentication method according to the present invention does not require a separate hardware for authentication, and because the message on the communication protocol can be used as it is, without requiring additional tools of the key management server XML key It provides the advantage of strengthening the security of the management service.

Description

System for key authentication / service with one time authentication code and method therefor}

1 illustrates an example of an environment in which a key management client which is a request system for key authentication / service using a one-time authentication code and a key management server which is a key authentication / service management system using a one-time authentication code according to the present invention are combined.

2 is a block diagram showing an example of a preferred configuration of a key management client which is a key authentication / service request system using a one-time authentication code and a key management server which is a key authentication / service management system using a one-time authentication code according to the present invention. It is.

3 illustrates a flow of requesting an authentication / service using a one-time authentication code according to the present invention and in response to the authentication / service management method using the one-time authentication code.

TECHNICAL FIELD The present invention relates to security and relates to key authentication on a web service.

XML key management service integrates the existing PKI service and provides more convenient key related services to XML application service users in the form of web service. It is specified in XML message based XML Key Management Specification (XKMS). Perform key management procedures for checking the location of the key, verifying the validity, and registering, discarding, restoring, and reissuing the key.

When requesting the XML key registration service, the client exchanges an authentication code to be used as a secret key with the XML key management system. The authentication code is exchanged through a method separate from the XML key management standard specification. You can exchange the verification code by using a reliable method such as telephone, email or face-to-face meeting. Limited use of authentication is required or required to use a shared secret to authenticate an XML key registration service message. The key registration request message of the XML key management client is signed by using an authentication code. Through this, the XML key management system confirms that the request message is legitimate.

The conventional authentication code scheme is arbitrarily generated as a basic numeric value or represented in the form of a password and a character string in the form of a MAC function. That is, since the packet data transmitted and received through the communication channel itself is a password, there is a problem that the password of the client may be hacked by eavesdropping on the communication channel.

Currently, a number of XML key management systems have been developed, but there is a problem that a technical device and method for solving a security vulnerability that may occur when exchanging a key registration message have not been provided.

The technical problem to be achieved by the present invention, in order to solve the above problems, key authentication / service request system using a one-time authentication code that can solve the security vulnerabilities that may occur when the key registration message exchange in the XML key management system and The present invention provides a key authentication / service management system using a one-time authentication code that can manage authentication and service in response to the request.

Another technical problem to be achieved by the present invention is to provide a key authentication / service request method using a one-time authentication code and the authentication / service management method using a one-time authentication code using the above systems.

According to the present invention for solving the technical problem, the authentication / service request system using a one-time authentication code, the message required for generating the authentication code for the key management service request, and generates a message for requesting the desired key management service A key management message processor; And a security processing unit generating a one-time authentication code according to a predetermined method using a challenge message received in response to a message request required for generating an authentication code of the key management message processing unit.

According to the present invention for solving the other technical problem, the authentication / service management system using a one-time authentication code, the service request receiving unit for receiving a message requesting the generation of authentication code, one-time authentication code and key management service request message; A key management message interpreter for interpreting an authentication code generation request message received by the service request receiver and receiving the one-time authentication code; Using the authentication code generation request message interpreted by the key management message analysis unit, a challenge message based on a challenge / response method is generated, and the one-time authentication code received in response to the challenge message is converted into a one-time authentication code. A message authentication processing unit which analyzes using a predetermined method corresponding to the generated method and confirms whether to authenticate the authority of the requested key management service; And executing a key management function according to contents of a key management service request message whose authority is authenticated through the message authentication processing unit, or requesting a service corresponding to the key management service request message to another server including a predetermined certification authority. Key management service unit; characterized in that it comprises a.

According to the present invention for solving the another technical problem, the authentication / service request method using a one-time authentication code, (a) requesting the transmission of a message required for generating the authentication code for the key management service request; (b) receiving a response message for the request and generating a one-time authentication code using the response message; And (c) requesting a key management service by transmitting the generated one-time authentication code and a key management service request message together.

In accordance with another aspect of the present invention, there is provided a key authentication / service management method using a one-time authentication code, the method comprising: (a) receiving a request for transmitting a message required for generating an authentication code for a key management service request; (b) generating a challenge message based on a challenge / response scheme using the message requested in step (a), and responding to the request with the generated challenge message; (c) receiving the one-time authentication code and the key management service request message generated by using the response message; (d) checking the authority for the key management service request by analyzing the received one-time authentication code and confirming authentication; And (e) providing a service included in the key management service request message whose authority has been confirmed.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 illustrates an example of an environment in which a key management client which is a request system for key authentication / service using a one-time authentication code and a key management server which is a key authentication / service management system using a one-time authentication code according to the present invention are combined.

Hereinafter, the key used for key authentication / service according to the present invention will be described as being an XML key. It is apparent that the present invention can be applied to other key authentication / services in addition to the XML key.

The system of FIG. 1 is a system for requesting an XML key management service connected through a device such as a gateway 130 through a certificate authority 150 and a wired 140 or a wireless network 120 that issue and revoke a public certificate. And a key management server 110 that directly provides a service according to a request of the management client 100 and the key management client 100 or requests an XML key from the certification authority 150 to execute a key management function. .

When the key management client 100 requests a message for generating an authentication code required for requesting a key management service, the key management server 110 generates a challenge message based on a challenge / response method, and generates a key management message. The key management client 100 generates a one-time authentication code according to a predetermined method using the received challenge message, and designates a desired key management service and requests the service. The key management server 110 transmits to the key management server 110. The key management server 110 inspects the received one-time authentication code and executes a key management function or authentication according to the type of the key management service when the authorization of the requested service is confirmed. The authority 150 requests a service corresponding to the key management service.

2 is a block diagram showing an example of a preferred configuration of a key management client which is a key authentication / service request system using a one-time authentication code and a key management server which is a key authentication / service management system using a one-time authentication code according to the present invention. It is. Of the elements of FIG. 2, the same reference numerals used in FIG. 1 are used as in FIG. 1.

The key management client 100 requests a message required for generating an authentication code required for a key management service request to the key management server 110 and requests a desired key management service together with a one-time authentication code using a response message. The key management message processor 205 for transmitting the message to the key management server 110 and the challenge message transmitted from the key management server 110 in response to a message request for generating the authentication code of the key management message processor 205. It includes a security processing unit 200 for generating a one-time authentication code using a predetermined method and a client interface 210 for providing an interface for data transmission and reception with the key management server 110.

And the key management server 110, according to the request of the service request receiving unit 220, the service request receiving unit 220 for receiving a message, a one-time authentication code and a service request message for generating the authentication code of the key management client 100 The key management message interpreter 230 and the key management message interpreter 230 interpret the message received by the service request receiver 220 and receive and transmit the one-time authentication code received by the service request receiver 220. When a message required for generating the authentication code is received, a challenge message based on the challenge / response method is generated using the message, and the one-time authentication code received in response to the challenge message is received from the key management message interpreter 230. Confirmation of authority authentication for the requested key management service using a method corresponding to the method of receiving and generating the authentication code And, the authentication key management service request message transmitted through the message authentication processing unit 240 and the message authentication processing unit 240 for receiving the service request message transmitted, such as the authentication code and authenticated to the key management service unit 250 It includes a key management service 250 for executing a key management function according to the content or requesting a service corresponding to the key management service to the certificate authority (250).

In addition, the key management service unit 250 includes a key registration unit 255 for registering a user public key of the key management client 100, a key revocation unit 265 for retiring a key, and a key reissue unit 260 for reissuing a key. ), A key recovery unit 270 for recovering a key, and a PKI connection unit 270 connected to the certification authority 150 to transmit and receive the contents of the key management service.

In addition, the key management service unit 250, when the key management service request message transmitted from the key management client 100 to the key management server 110 includes a request to find the public key information desired by the client 100 The apparatus further includes a key location information unit 280 that finds the public key information and transmits the public key information to the client 100, and a key validity checking unit 285 that validates the public key found by the key location information unit 280.

3 illustrates a flow of requesting an authentication / service using a one-time authentication code according to the present invention and in response to the authentication / service management method using the one-time authentication code. The method of FIG. 3 is implemented using the system of FIG. 1 or 2.

A key management client requesting an XML key management service connected to a certificate authority that issues and revokes a public certificate through a wired or wireless network, and directly provides a service according to the request of the key management client, or provides an XML key to the certificate authority. In this method of providing an XML key management service using a one-time authentication code in a system including a key management server executing a key management function by request, the key management client generates an authentication code for requesting a key management service to the key management server. Request the transmission of the necessary message (step 300), generate a challenge message based on a challenge / response method using the message transmitted in step 300 at the key management server, and generate the generated challenge message to the key management client. Transmit (step 310), the transmitted challenge from the key management client A one-time authentication code is generated using a lindsay message and transmitted to the key management server together with a key management service request message (step 320). The key management server receives a one-time authentication code from the key management client to determine whether to authenticate. In operation 330, the key management client may verify the authority of the key management client, and provide the service included in the key management service request message of the key management client whose authority is verified in the key management server (operation 340).

Hereinafter, a detailed example of implementing the present invention according to FIG. 3 using the configuration of FIG. 2 will be described.

In the following description, a key in the XML key registration service is meant to include an authentication key to be used as a secret key. That is, the term "key" in the following description is a concept including a secret key or an authentication key.

As described above, the service for the XML key has a security problem when the key itself is exposed. Therefore, an effort to solve the security problem is required. For this security, it is necessary to determine whether the service request for the key and the legitimate authority according to the request are made, rather than requesting the service for the key directly from the server.

Services for keys include key registration, key reissue, key revocation and key recovery. If it is necessary to request a service for such a key, the client 100 requests the server 110 to transmit basic data for generating an authentication code for use in the service for key management (step 300). This is executed by the key management message processing unit 205.

Such a request is transmitted to the service request receiver 220 through the wireless network 120, the gateway 130 providing a connection between the wired and wireless networks, and the wired network 140 through the client interface 210.

The wireless network 120, the gateway 130, and the wired network 140 are examples of passages through which data is transmitted, and it is apparent that the wireless network 120, the gateway 130, and the wired network 140 may be transmitted through other communication networks. And such a communication network provides a web-based connection, and as a result, the present invention can be implemented on a web service basis.

The key management message interpreter 230 interprets the message received by the service request receiver 220 and transmits the message to the message authentication processor 240. Since the client 100 has requested a message for generating the authentication code, the message authentication processor 240 generates a challenge message based on the challenge / response method and transmits the challenge message to the client 100 (step 310).

At this time, the key management request message of the key management client 100 is signed using a predetermined authentication code, and the key management server 110 confirms that the key management request message is signed using the predetermined authentication code. It is desirable to confirm that it is a legitimate request message.

Since generating a challenge message based on a challenge / response scheme is obvious in a field using XML, it is obvious to a person having ordinary knowledge in the technical field to which the present invention belongs, and thus a separate description is omitted.

The challenge message transmitted as described above is transmitted to the security processing unit 200 through the client interface 210. The security processing unit 200 generates a one-time authentication code by using a challenge message according to a predetermined method. The predetermined method at this time may use a variety of encryption methods, not by a separate special method.

The one-time authentication code is generated and delivered as follows.

1) The security processing unit 200 generates a random algorithm stored value S (1) by inputting a random number and an ID assigned to itself. Similarly, we generate S (2) using different random numbers and IDs.

2) Then calculate the one-time authentication code values U (1), U (2) and U (3) with S (1) and S (2).

5) The calculated U (1), U (2) and U (3) are delivered in a challenge response manner.

This encryption method used by the security processing unit 200 is previously agreed with the server 110, in particular the message authentication processing unit 240. Since both sides of the client 100 and the server 110 know the challenge message and the encryption method used for encryption, the authentication code generated by the security processing unit 200 may be decrypted by the message authentication processing unit 240. .

The key management message processing unit 205 generates a message including the content of the key management service to be requested to the server 110 and transmits the message to the server 110 together with the authentication code (step 320).

As in step 300, the service request receiving unit 220 receives this, and the key management message interpreting unit 230 interprets the key management service content message so that the client 100 receives the type of key management service desired.

The message authentication processor 240 verifies the authority for the key management request of the client 100 by decrypting the received one-time authentication code as described above (step 330).

When the authority for key management is confirmed as described above, the message authentication processing unit 240 delivers the contents of the service and information on the client 100 who requested the service to the key management service 250. Since the client 100 is not the only one, the client 100 may transmit information about the client that has requested the key management so that the plurality of clients can be identified.

The one-time authentication code is literally one-time use, and is generated and used again when necessary in the next service request.

The following is a description of the process (step 340) of the key management service unit 250 for key management in the server 110 according to the type of service requested by the client 100.

The key registration unit 255 is responsible for registering the public key of the client user. There are two ways of generating an XML key for key registration, a method of generating a key by the key management client 100, and a method of generating a key through the key management server 110.

When the client 100 generates a key, the client 100 must prove through the private key ownership certificate that it has a private key and public key pair.

At this time, the private key ownership verification process may use an ownership verification method. An example thereof is as follows.

1) When the client accesses the server, the server generates a challenge value and delivers it to the client.

2) The client signs the challenge value with its private key and sends the signature value and request to the server.

3) The server extracts the public key from the request and extracts the signature value with the public key to obtain a hash value (1).

4) The server hashes the random value sent by itself to obtain the hash value (2).

5) Proceed private key possession proof by comparing hash value (1) and (2)

When generating a key through the key management server 110, the key management server 110 may create a public key pair for the client user. The key management server 110 encrypts and stores the private key of the client through its own password and provides the client in the form of encrypting it with a one-time authentication code at the request of the client.

The XML key registration service unit 250 requests the key registration service again using a PKI connection method through the PKI connection unit 275. Such a key registration service is performed in the form of an asynchronous message.

To this end, when the key management client 100 generates a key pair of a private key and a public key, the request message transmitted in step 320 includes a request for key registration, and the one-time authentication code includes the key management client 100. Includes the contents of proving that the user has a private key and a public key pair, which are verified by the message authentication processing unit 240 and the key corresponding to the key management client 100 to the certificate authority 150 in step 340. It is desirable to request a registration service.

In addition, when the server 110 generates a key, the message authentication processing unit 240 encrypts and stores the key corresponding to the key management client 100 using a predetermined password, and the key is included in the request message transmitted in step 320. The request for registration is included, and in step 340, the message authentication processing unit 240 decrypts the encrypted and stored key and encrypts the predetermined key using a one-time authentication code transmitted in step 320. Provided to the key management client 100, the key registration unit 255 preferably requests a key registration service corresponding to the key management client 100 to the certificate authority 150 through the PKI connection unit 250.

At this time, the private key ownership certificate is also processed when the message service is requested to the certification authority.

In this case, the predetermined encryption method may be executed using a conventional public technique.

The key reissue unit 260 is responsible for reissuing a key of the client user. The client user is issued an extended key using the key reissue function. The function of the key reissue section 260 is similar to that of the key registration section 255. The one-time authentication code to be used as a secret key is exchanged between the key management server 110 and the key management client 100. In the key management client 100, the request message of the key reissue service is signed through the one-time authentication code, and the private key ownership certificate proves that the client now has the private key. The key reissue unit 260 requests the key reissue service to the certificate authority again using the PKI connection unit. Similarly, key reissue services are performed in the form of asynchronous messages.

To this end, the key management service request message transmitted from the key management client 100 to the key management server 110 includes a request for reissuance of a key that has already been issued, and the message authentication processing unit 240 requests a reissue. In the one-time authentication code, it is confirmed that the key management client 100 currently has a private key, and the key reissue unit 260 reissues a key corresponding to the key management client to the certificate authority through the PKI connection unit 275. It is desirable to request a service.

In this case, the message authentication processing unit 240 confirms that the key management client 100 currently has a private key in the one-time authentication code, so that the key management client 100 may request a reissue of the key, that is, an extension of the usage period. It can be said to be substantially the same as confirming that you have authority.

The key discarding unit 265 discards the issued key of the client user. The client user can use the key revocation service function to retire an existing key. The operation for the key discard service first checks whether the client 100 has a right to discard the corresponding key. For this purpose, a one-time authentication code is used.

Prior to requesting a key revocation service, the one-time authentication code is exchanged and the request message is signed using this one-time authentication code. The key management server 110 confirms the legitimate request through signature verification of this request message. The key revocation service requests the certificate authority to revoke the certificate through the PKI connection by deleting the key information in the key data store. Key closure services are performed in the form of asynchronous messages.

To this end, the key management service request message transmitted from the key management client 100 to the key management server 110 includes a request for discarding a key that has already been issued and has not expired, and the message authentication processing unit 240 From the one-time authentication code, the key management client 100 confirms whether the authority to discard the key is deleted, and deletes key information corresponding to the key management client 100, and the key revocation unit 265 is a PKI connection unit ( It is preferable to request a key revocation service corresponding to the key management client 100 to the certificate authority 275 through 275.

The key recovery unit 270 recovers the private key of the client user. The key recovery service is performed only when the XML key management server 110 creates a key pair and is not performed when the key pair is created by the client 100.

The key recovery service, like other services, only works when the server and client exchange a one-time authentication code. The client 100 signs and sends its key recovery request message using a one-time authentication code, and the key management server 110 processes the key recovery request after verifying it.

In order to prevent the key recovery indefinitely, the number of key recovery is limited according to the policy, and when the limit is exceeded, it is necessary to delete the user's private key in the key data store. Also, unlike other services, the key recovery service does not communicate with the certification authority 150 through the PKI connection unit 275 and is independently performed.

The key management service request message transmitted from the key management client 100 to the key management server 110 for key recovery includes a request to recover the issued key to the key management client 100. The message authentication processor 240 checks whether the key management client 100 has a key recovery authority from the one-time authentication code, and provides the corresponding key to the key management client 100.

Since the number of key recovery is limited in advance, the key recovery service is provided only within the number of key recovery. When the recovery service is provided for a limited number of times, it is preferable to delete the corresponding key management client 100 key.

The key location information unit 280 retrieves the public key information corresponding to the request of the client 100. The client can obtain the public key and the personal certificate through the key location information service as needed.

The key validity checking unit 285 performs a function of verifying whether the public key is valid according to the request of the client.

In the case of the authentication according to the present invention as described above, the one-time authentication code used once is not used again, and the next authentication is performed next time even if the authentication code is leaked by using a one-time authentication code having a different random number. When the newly updated authentication code is used, false authentication by hacking or the like can be prevented.

In addition, although the above description mainly refers to XML keys, it is obvious that the above description can be used in the field of authentication using keys.

Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. Examples included in the above description are introduced for the understanding of the present invention, and these examples do not limit the spirit and scope of the present invention. It will be apparent to those skilled in the art that various embodiments in accordance with the present invention in addition to the above examples are possible. The scope of the present invention is shown not in the above description but in the claims, and all differences within the scope will be construed as being included in the present invention.

In addition, it can be easily understood by those skilled in the art that each of the above steps according to the present invention can be variously implemented in software or hardware using a general programming technique.

And some steps of the invention may also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, CD-RW, magnetic tape, floppy disks, HDDs, optical disks, magneto-optical storage devices, and carrier wave (eg, Internet It also includes the implementation in the form of). The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

According to the present invention, the key management client requests the key management server to transmit a message required for generating an authentication code for requesting a key management service, and the key management server uses a challenge / response challenge message based on the transmitted message. And generate a one-time authentication code using a challenge message from the key management client and send it to the key management server together with the key management service request message, and the key management server receives the one-time authentication code from the key management client and authenticates it. Checks the authority of the key management client by checking the information, and provides the service included in the key management service request message of the key management client whose authority has been verified by the key management server. False authentication after using a valid authentication code In particular, the authentication method according to the present invention does not require a separate hardware for authentication, and since the message on the communication protocol can be used as it is, an XML key without requiring additional tools of the key management server. It provides the advantage of strengthening the security of the management service.

Claims (18)

A key management message processing unit for requesting a message for generating an authentication code for requesting a key management service and generating a message for requesting a desired key management service; And Authentication using a one-time authentication code comprising a; security processing unit for generating a one-time authentication code according to a predetermined method using a challenge message received in response to the message request for generating the authentication code of the key management message processing unit; / Service request system. The method of claim 1, The key management request message is a key authentication / service request system using a one-time authentication code, characterized in that signed using an authentication code according to a predetermined method using a public key / secret key method. A service request receiving unit receiving a message requesting generation of an authentication code, a one-time authentication code and a key management service request message; A key management message interpreter for interpreting an authentication code generation request message received by the service request receiver and receiving the one-time authentication code; Using the authentication code generation request message interpreted by the key management message analysis unit, a challenge message based on a challenge / response method is generated, and the one-time authentication code received in response to the challenge message is converted into a one-time authentication code. A message authentication processing unit which analyzes using a predetermined method corresponding to the generated method and confirms whether to authenticate the authority of the requested key management service; And A key for executing a key management function according to the contents of a key management service request message whose authority is authenticated through the message authentication processing unit or for requesting a service corresponding to the key management service request message to another server including a predetermined certification authority. Authentication service / service management system using a one-time authentication code, characterized in that it comprises a management service unit. The method of claim 3, If the received key management request message is signed using a predetermined authentication code, confirm that the key management request message is signed using the predetermined authentication code according to a predetermined method including a public key / secret key method. Key authentication / service management system using a one-time authentication code, characterized in that for verifying that the request message. The method of claim 3, The received key management service request message includes a key registration, key reissue, key revocation and key recovery request, The key management message analyzer analyzes which key management service is included in the received key management service request message and transmits the key management service to the message authentication processor. The key management service unit, Key authentication / service using a one-time authentication code, wherein the user public key of the client requesting the key management service is registered, discarded, reissued, recovered, and the contents of the key management service are transmitted and received with another server requesting the service. Management system. The method of claim 3, The key management service unit, If the key management service request message transmitted from the client requesting the key management service includes a request to find the desired public key information of the client requesting the key management service, the key location information unit locates and delivers the public key information to the client. ; And Key authentication / service management system using a one-time authentication code further comprises a; key validation check unit for checking the validity of the public key found by the key location information. The method of claim 3, When the client requesting the key management service generates a key, the client requesting the key management service includes the one-time authentication code to confirm that the client has the private key and the public key pair, and confirms by the message authentication processing unit. The message authentication processing unit encrypts and stores the private key of the client requesting the key management service through a predetermined password, and provides the stored private key to the client in the form of an encrypted form at the request of the client requesting the key management service. To register the key, The key management service unit is a key authentication / service management system using a one-time authentication code, characterized in that for requesting the key registration service of the client requesting the key management service to the other server. The method of claim 3, The key management service request message transmitted from the client requesting the key management service includes a request for reissuance of an already issued key. The message authentication processing unit confirms that the client requesting the key management service in the reissue request and the one-time authentication code currently has a private key, And the key management service unit requests a key reissue service corresponding to a client that has requested the key management service to the other server. The method of claim 3, The key management service request message transmitted from the client requesting the key management service includes a request for discarding a key that has already been issued and has not expired. The message authentication processing unit deletes key information corresponding to the client requesting the key management service by checking whether the client requesting the key management service is authorized to discard the key from the one-time authentication code, And the key management service unit requests a key revocation service corresponding to a client requesting the key management service to the other server. The method of claim 3, The key management service request message transmitted from the client requesting the key management service includes a request for recovering a key issued to the client requesting the key management service. The message authentication processing unit checks whether the client requesting the key management service from the one-time authentication code has a key recovery authority, and provides a corresponding key to the client requesting the key management service. Certification / Service Management System. The method of claim 10, The number of key recovery is limited in advance to provide a key recovery service only within the number of key recovery, A key authentication / service management system using a one-time authentication code, characterized in that when the recovery service is provided for a limited number of times, the key of the client requesting the corresponding key management service is deleted. (a) requesting transmission of a message necessary for generating an authentication code for requesting a key management service; (b) receiving a response message for the request and generating a one-time authentication code using the response message; And (c) requesting a key management service by transmitting the generated one-time authentication code and a key management service request message together. The method of claim 12, When the key management service request message is generated by a public key / private key method, the key management service request message includes a content request for key registration, and the one-time authentication code includes the public key, Authentication / service request method using a one-time authentication code, characterized in that the content is generated that proves that generated by a secret key pair. (a) receiving a request for transmission of a message required for generating an authentication code for requesting a key management service; (b) generating a challenge message based on a challenge / response scheme using the message requested in step (a), and responding to the request with the generated challenge message; (c) receiving the one-time authentication code and the key management service request message generated by using the response message; (d) checking the authority for the key management service request by analyzing the received one-time authentication code and confirming authentication; And (e) providing a service included in the key management service request message whose authority has been confirmed; key authentication / service management method using a one-time authentication code. The method of claim 14, The key management service request message received in step (c) includes a request for key registration, and the one-time authentication code includes proof that the client requesting the service has a secret key / public key pair. If so, In step (e), the key authentication / service management method using a one-time authentication code, characterized in that for requesting a key registration service for a secret key / public key to a predetermined authentication authority. The method of claim 14, The key management service request message received in step (c) includes a request for reissuance of an already registered key, and the one-time authentication code verifies that the client requesting the service currently has a private key. If it contains content, In step (e), the key authentication / service management method using a one-time authentication code, characterized in that for requesting a key reissue service corresponding to the service request client to a predetermined authentication authority. The method of claim 14, The key management service request message received in step (c) includes a request for discarding a key that has already been issued and has not expired, and the one-time authentication authority to discard the key by the client requesting the service. If it contains content to verify that it exists, In the step (e), the key using the one-time authentication code, characterized in that for deleting the key corresponding to the client requesting the service, requesting a service for discarding the key corresponding to the client requesting the service to a predetermined certification authority. How to manage authentication / services. The method of claim 14, The key management service request message received in step (c) includes a request for recovering a key issued to the client requesting the service, and the one-time authentication code includes a key recovery authority for the client requesting the service. If it contains content to verify that And a key previously stored in correspondence with the client requesting the service in step (e), to the client requesting the service.

Images