KR100758790B1 - The aparatus and method for batch processing about authentication by RA - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

The present invention relates to an apparatus for supporting batch processing of a certificate related task, a method thereof, and a computer-readable recording medium having recorded thereon a program for realizing the method.

2. The technical problem to be solved by the invention

The present invention provides a batch processing apparatus and method for supporting a certificate related task for supporting a certificate processing task by interworking a subscriber management system and a CA system based on an RA system, and to realize the method. Provides a computer-readable recording medium for recording the program.

3. Summary of Solution to Invention

The present invention, the subscriber information and certificate information of the subscribers belonging to the RA system in the authentication system of the subscriber information and certificate information managed by an external CA system to carry out the batch processing function of the certificate-related tasks, bring to the RA system DB management means linked with CA for managing / managing ; According to a request for batch processing of certificate related tasks from an interfacing means of an external subscriber management system, the database is searched for a batch of certificate related tasks for the RA system itself, and the corresponding information is extracted to communicate with the CA system. A certificate related task batch means for delivering a result of the certificate related task to the subscriber management system after batch processing the certificate related task; And RA self-log management means for recording and managing the batch process of certificate related tasks in the certificate related task batch processing means.

4. Important uses of the invention

The invention is used in certificate systems and the like.

Batch, certificate, subscriber management system, RA system, CA system

Description

Apparatus and method for supporting batch processing of certificate related tasks {The aparatus and method for batch processing about authentication by RA}             

Figure 1 is an exemplary configuration of a batch processing support system of RA-based certificate-related tasks to which the present invention is applied.

Figure 2 is a configuration diagram of an embodiment of a batch processing support device for RA-based certificate-related work according to the present invention.

3 is a diagram illustrating an embodiment of a DB management method for supporting batch processing of RA-based certificate related tasks according to the present invention.

Figure 4a is a flow diagram of an embodiment for a process of collectively sending a certificate issuance authorization request to the RA system according to the present invention.

Figure 4b is a flow diagram of an embodiment of the process of the batch processing the certificate issuance authorization request in the RA system according to the present invention.

Figure 4c is a flow diagram of an embodiment of a process for delivering information necessary for issuing a subscriber certificate to the subscriber management system by the RA system according to the present invention.

5A is a flow diagram of an embodiment of a process for collectively sending a request relating to certificate revocation to an RA system according to the present invention;                 

5b is a flow diagram of an embodiment of a process for a certificate revocation request batch by a RA system according to the present invention;

Figure 6a is an embodiment flow diagram for a process of collectively sending a certificate reissue request to the RA system according to the present invention.

Figure 6b is an embodiment flow diagram for the process of the batch processing the certificate reissue request by the RA system according to the present invention.

* Explanation of symbols for the main parts of the drawings

101: application system 102: subscriber management system

103: CA System 104: X.500 Directory Server

105: RA system 106,108: user DB

107,109: Certificate DB 109: Certificate DB

110: certificate issue request DB 111: certificate revocation request DB

112: certificate reissue request DB 21: Subscriber Management Module

22: interface module 23: RA base module

24: DB management module interworking with CA 25: Certificate related task processing module

26: RA self log management module

The present invention relates to an apparatus for supporting batch processing of certificate related tasks, a method thereof, and a computer-readable recording medium having recorded thereon a program for realizing the method.

The present invention is included in the public key infrastructure (PKI) technology field, and is related to the digital signature law that entered into force in July 1999 in Korea. When analyzing the process of certificate-related work of private or accredited certification authorities based on PKI and digital signature law, the certification authority (CA) operator is responsible for the registration / certificate issuance and the operation of the CA system. The RA operator is required to perform all the tasks related to issuing users' certificates through face-to-face verification of application service users.

However, there is a potential problem with the above method of processing the present. First of all, the face-to-face verification procedure for issuing a user certificate is practically impossible. In addition, by managing the certificate-related tasks and subscriber management system for each application service by dualizing them, potential error occurrence factors in terms of service provision are included due to inconsistency between specific information.

In addition, in the sequence of providing PKI-based security services, a section where service delay occurs relatively is a certificate related task that occurs between CA system and RA system and between RA system and subscriber. Moreover, such service delays are even more severe when adopting a certified certification infrastructure such as PKI. Accordingly, the present invention is to provide a mechanism that can efficiently handle the certificate-related tasks in the RA area.

The present invention has been proposed to solve the above problems, a batch of certificate-related tasks to support the collective management of certificate-related tasks by interworking subscriber management system and CA system based on the RA system It is an object of the present invention to provide a processing support apparatus and a method thereof and a computer-readable recording medium having recorded thereon a program for realizing the method.

The apparatus of the present invention for achieving the above object is, in the batch processing support apparatus for certificate-related tasks, in order to perform the batch processing function of the certificate-related tasks, the authentication system of subscriber information and certificate information managed by an external CA system DB management means interworking with CA for importing and storing / managing subscriber information and certificate information of subscribers belonging to the RA system to the RA system ; According to a request for batch processing of certificate related tasks from an interfacing means of an external subscriber management system, the database is searched for a batch of certificate related tasks for the RA system itself, and the corresponding information is extracted to communicate with the CA system. A certificate related task batch means for delivering a result of the certificate related task to the subscriber management system after batch processing the certificate related task; And RA self-log management means for recording and managing the batch process of the certificate related task in the certificate related task batch processing means.

On the other hand, the method of the present invention, in the batch issuing method of certificate issuance authorization work applied to the batch processing support device for certificate-related work, the RA system is the first to receive a request for authorization issuance from the subscriber management system collectively; step; A second step of the RA system searching for its own certificate issuance authorization database and extracting information for issuing a certificate issuance, and collectively processing the certificate issuance authorization task through communication with a CA system; And a third step of storing a batch processing result of the certificate issuance authorization task and transferring the result to the subscriber management system.

In addition, another method of the present invention is a batch processing method of a certificate revocation task applied to a batch processing support apparatus for certificate related services, wherein the RA system collectively receives a certificate revocation request from a subscriber management system. ; A second step of the RA system searching for its own certificate revocation database and extracting information for revocation of a certificate, and collectively processing a corresponding certificate revocation task through communication with a CA system; And a third step of storing a batch processing result of the certificate revocation task.

Further, another method of the present invention is a batch processing method of a certificate reissue task applied to a batch processing support apparatus for certificate related tasks, wherein the RA system collectively receives a certificate reissue request from a subscriber management system. step; A second step of the RA system searching for its own certificate reissue database to extract information for certificate reissue, and collectively processing the certificate reissue task through communication with the CA system; And a third step of storing a batch processing result of the certificate re-issuance task and delivering the result to the subscriber management system.

On the other hand, the present invention provides a batch processing support apparatus for a certificate-related task having a processor, comprising: a first function for the RA system to collectively receive a certificate issuance authorization request from a subscriber management system; A second function of the RA system searching for its certificate issuance authorization database and extracting information for issuing the certificate issuance, and collectively processing the certificate issuance authorization task through communication with the CA system; And a computer readable recording medium storing a program for realizing a third function of storing a batch processing result of the certificate issuance authorization task and transferring the result to the subscriber management system.

In addition, the present invention provides a batch processing support apparatus for a certificate related task including a processor, comprising: a first function for the RA system to collectively receive a certificate revocation request from a subscriber management system; A second function of the RA system searching for its own certificate revocation database and extracting information for revocation of a certificate, and collectively processing a corresponding certificate revocation task through communication with a CA system; And a computer readable recording medium having recorded thereon a program for realizing a third function of storing the batch processing result of the certificate revocation task.

The present invention also provides a batch processing support apparatus for a certificate related task including a processor, comprising: a first function for the RA system to collectively receive a certificate reissue request from a subscriber management system; A second function of the RA system searching for its own certificate reissue database and extracting information for certificate reissue, and collectively processing a corresponding certificate reissue through communication with a CA system; And a computer-readable recording medium storing a program for realizing a third function of storing the batch processing result of the certificate reissue issuance and delivering it to the subscriber management system.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an exemplary configuration of a batch processing support system for RA-based certificate-related business to which the present invention is applied.

As shown in Fig. 1, the present invention includes a service operation center, a public (private) certification authority, and an application service user, and these are configured to operate in a TCP / IP environment.

The service operation center includes an application system 101 in which PKI-based security services are embedded, a subscriber management system 102 which performs subscriber management and operator management of the application system entirely, and a subordinate of the CA system 103. User information belonging to RA system 105 in the authentication system among RA system 105 and CA system 103 that perform certificate issuance tasks of users based on the certification business rules defined by CA system as an authority. Extract the certificate information of the users belonging to the RA system 105 in the authentication scheme from the user information DB 108 and the CA system 103 managed by the RA system by extracting the certificate information. In order to process certificate related tasks collectively in conjunction with the subscriber management system of the application service in the certificate DB 109, RA system 105 A certificate revocation request DB 111, a certificate issuance authorization request DB 110, and a certificate reissue request DB 112 which are managed by themselves.

In addition, an authorized certification authority is a CA system 103, which is an authority and system that performs various tasks related to certificates including issuing user certificates, and an X.500 directory server which is a system that manages certificates and certificate revocation lists published by the CA system. 104), the user DB 106 managed by the CA system issuing the user certificate among the DB tables managed by the CA system, and the certificate related information is extracted and managed from the CA system when the user certificate is issued among the DB tables managed by the CA system. The certificate DB 107 is provided.

Figure 2 is a configuration diagram of an embodiment of a batch processing support device for RA-based certificate-related tasks according to the present invention.

As shown in FIG. 2, a module for RA-based batch processing function includes a subscriber management system, a RA system, and a CA system, and the subscriber management system includes a subscriber management module 21 and an interface module 22. The RA system includes a RA basic module 23, a DB management module 24 interworking with a CA, a certificate related task batch module 25, and an RA self-log management module 26. Among the modules related to the present invention, the interface module 22, the DB management module 24 linked with the CA, the certificate related task batch module 25, and the RA self-log management module 26 are included.                     

The DB management module 24 linked with the CA stores and manages information necessary for a batch processing function of a certificate related task in a RA system among DBs managed by a CA system, that is, a user who stores and manages information of subscribers who receive a certificate. In the certificate DB 109 that stores and manages the certificate information issued to the DB 108 and the subscribers, the subscriber information and the certificate information are imported to the RA system only for subscribers belonging to the RA system in the authentication scheme. It is a device that provides a function to store and manage tables.

At this time, a method of obtaining data from the CA system is divided into a manual data access method and an automatic data access method. This will be described later in detail with reference to FIG. 3.

The interface module 22 provides the subscriber management system with a means for requesting the RA system to collectively process certificate related tasks received from subscribers, and the RA system with a means for accepting the request from the subscriber management system. This module allows you to batch process future work.

The certificate related task batch module 25 transmits each request transmitted by the subscriber management system of the application service from each service request DB (certificate issue request DB, certificate revocation request DB, certificate reissue request DB) managed by the RA system itself. After searching, extract the necessary information from the relevant DBs, provides the function to process the request through secure communication with the CA system and to transmit the result to the subscriber management system of the application service offline.                     

The RA self-log management module 26 sends a random request from the subscriber management system of the application service to the RA system, receives the request from the RA daemon processor, and records the request in the local DB, and the RA system retrieves the request. It provides a function to manage a series of processes through the communication with the CA system as a log DB.

3 is a diagram illustrating an embodiment of a DB management scheme for supporting batch processing of RA-based certificate related tasks according to the present invention.

As shown in FIG. 3, a method for acquiring data required for an RA system from a CA system is divided into an automatic data access method and a manual data access method.

Manual data access method manages RA system by bringing all data belonging to RA system in certification system from CA system regardless of user DB and certificate DB contents managed by existing RA system through RA operator intervention. It is a method of storing and managing in user DB and certificate DB.

The automatic data access method excludes RA operator intervention and imports new or changed data among the data belonging to the RA system in the authentication system at regular intervals, and stores and manages them in the user DB and certificate DB managed by the RA system. That's how.

4A is a flowchart illustrating a process of collectively transmitting a certificate issuance authorization request to the RA system according to the present invention.

Any processor running in the subscriber management system retrieves a new service subscription request DB (401), extracts the number of subscribers N who requested a new subscription, and sets the processed subscriber number n to 0 (402). If the calculated number of subscribers is greater than 0, subscriber identity information necessary for certificate issuing is sequentially extracted (403), and information necessary for authorization of certificate is extracted (404). With the new subscriber information extracted in step 403 and the information required for certificate issuance extracted in step 404, a certificate issuance function is called (405) and a certificate issuance authorization packet is generated and delivered to the interface daemon processor running in the RA system. (406).

Then, after receiving the certificate issuance authorization packet (412), the interface daemon processor running in the RA system verifies the structure of the certificate issuance authorization request packet (413). If the packet is determined to be correct (415), if it is not correct, that is, if there is an error in the packet, the error is recorded in the log table through the log management module managed by the RA system, and then an error occurs in the interface module operated in the subscriber management system. (415, 420). Meanwhile, if the packet is correct, the request is inserted into the certificate issuance authorization request DB (416). It is determined whether the corresponding insert operation is successful (417), if it fails, the error is recorded in the log DB (418), and the result of receiving the request is transmitted to the subscriber management system (420). On the other hand, if the insertion is successful, after recording the success of the request reception (419), and transmits the result value of the request reception to the subscriber management system (420).

The subscriber management system checks whether the result is successful according to the result value 420 from the RA system (407), and if successful, increments "n" by 1 to extract the task of issuing the certificate of the next subscriber. If there is no (where the last subscriber is the n-1 th subscriber), that is, "N = n" (410), the process terminates (411). On the other hand, if the request has not been successfully received by the RA system, and confirms whether or not to retry the request (408), if the retry proceeds to the certificate issuance authorization packet transmission process (405). On the other hand, if n is less than N (410) it is repeated from the process of extracting the information of the new subscription (403).

FIG. 4B is a flowchart illustrating a process of collectively processing a certificate issuance authorization request by the RA system according to the present invention, and continuing with FIG. 4A is a batch of certificate issuance authorization requests received from the subscriber management system. The process of processing is described.

The RA operator enters the card password and the digital signature password into the RA system and logs in to the RA program (422). The temporary variable n is set to 0 (423) and the certificate issuance request DB is searched from the certificate issuance authorization request (421) to check whether there are a number of certificate issuance requests (N> 0) (424). If the number of certificate issuance requests is not greater than zero, terminate the process. If N is greater than 0, extract the nth certificate issuance request data from the certificate issuance request DB (426), and perform an electronic signature on the certificate issuance request data (426). 427) Generate a certificate issuance authorization request packet (428).

Thereafter, when the certificate issuance authorization request packet is transmitted to the CA system, the CA system stores the certificate issuance authorization processing result and informs the RA system (438, 439).

Thereafter, it is determined whether the processing result is successful (429), and if successful, the corresponding request data is stored in the table (431), and the certificate issuing authorization request success DB is recorded (430). On the other hand, if the processing result value from the CA system is a failure, the request data is stored in the table (432) and the certificate issuance or request failure DB (433). Regardless of whether the certificate issuance request succeeds or fails, the result of the request is recorded in the log table (434). Then, the number of previously processed n is increased by 1 (435), and compared with the number of certificate issuance authorization requests N (436), if not equal to the nth certificate issuance authorization request data extraction process 426, and the number of previously processed n is If equal to N, the certificate issuance authorization record is deleted (437).

4C is a flowchart illustrating an example of a process of delivering information required for issuing a subscriber certificate to a subscriber management system by the RA system according to the present invention; information required for a subscriber to be issued a certificate from the RA system to the subscriber management system; That is, a method of transmitting a reference number and an authorization number will be described.

This function is based on the premise that the latest subscriber information belonging to the RA system is stored in the user table managed by the RA system by the DB management module presented in the present invention.

The number of subscribers n that meets the condition (eg, duration) is found (442). If there is no subscriber, the process is terminated. If the number of subscribers is greater than 0 (443), the subscriber needs to extract information necessary for issuing a certificate, that is, subscriber DN (Distinguished Name), reference number, and authorization number (444). The file name is stored as a predefined file name (445). The generated file is transferred to a subscriber management system and a predefined location using an arbitrary file transfer method (446).

If the certificate issuance authorization information is passed to the subscriber management system (448), this information is stored in the predefined directory (449). The subscriber is notified of certificate issuance authorization information by using any method (450).

 In subsequent steps, the information is delivered to subscribers based on the processor flow of the subscriber management system for each application service.

5A and 5B illustrate a series of processes for an interface device / batch processing device related to a certificate revocation request to be presented in the present invention. The subscriber certificate revocation request by the subscriber management system is a function that can be used when the subscriber requests service termination / stop. In fact, if the subscriber who requested the service cancellation / suspension does not revoke his / her certificate, an abnormal service may be provided, and thus, a device capable of handling the certificate revocation task in the subscriber management system is needed to prepare for such a case.

FIG. 5A is a flowchart illustrating a process of collectively transmitting a request for certificate revocation to a RA system according to the present invention. The method for a subscriber management system to collectively transmit a request for certificate revocation to a RA system is provided. It is explained.

First, a processor running in the subscriber management system retrieves a certificate revocation request DB (501), calculates the number of certificate revocation request subscribers N, and sets the processed number n to 0 (502). The DN of the subscriber who should make the certificate revocation request is extracted from the certificate revocation request DB 501 (503). Calling the certificate revocation request function with the DN of the subscriber extracted from the certificate revocation request DB (504). The certificate revocation request interface function generates a certificate revocation request packet and delivers the certificate revocation request packet to an interface daemon processor running in the RA system (505).

The daemon processor running in the RA system verifies the structure of the certificate revocation request packet after receiving the certificate revocation request packet (512) (513). If there is an error by checking whether the packet is correct according to the verification result (514), record the error of the request in the log table through the log management module driven by the RA system, and then revoke the certificate operated by the subscriber management system. Return an error to the request interface function (515, 520). Meanwhile, if the received packet is normal, the request is inserted into the certificate revocation request DB managed by the RA system itself (516), and it is checked whether an error has occurred in the process of inserting the request into the certificate revocation request DB (517). If an error occurs, the relevant information is recorded in the log table through the log management module (518), and an error is returned (520) to the certificate revocation request interface function operating in the subscriber management system.

On the other hand, if no error occurred in the above process, through the log management module records the success of the request received in the log table (519) and returns the success to the certificate revocation request interface function operated in the subscriber management system ( 520).

Thereafter, the certificate revocation interface module checks whether the result value received from the RA system is successful (506). If the result is successful, n is incremented by 1 (508). If the result value returned from the interface module is unsuccessful, the request is repeated. If it is determined whether to retry (507), the process proceeds to the certificate revocation request function call process 504, and if the retry is not selected, the number n of processings is increased by one (508). Thereafter, the number of subscribers to which the certificate revocation request should be sent is checked (509), and if there are remaining subscribers to be processed, the process proceeds to step 502 of extracting the DN of the nth certificate revocation request subscriber from the data table. The processor for processing a certificate revocation request is terminated (510).

In general, to revoke a certificate, you need the certificate serial number in the certificate structure defined in X.509. However, in the general subscriber management system, it is not only difficult to know the subscriber's DN accurately, but also impossible to know the subscriber's certificate serial number. Thus, in the present invention, in order to solve this problem, in the subscriber management system, only the subscriber DN or subscriber name is delivered to the RA system, and the user DB and certificate managed in the local system using the subscriber DN or subscriber name received from the RA system as a key. We proposed a method of substituting the certificate revocation request by extracting the certificate serial number of the subscriber who requested the certificate revocation by linking the DB.

5B is a flowchart illustrating a process of collectively processing a certificate revocation request by the RA system according to the present invention, and illustrates a process of collectively processing a certificate revocation request received from the subscriber management system by the RA system.

The RA operator enters the card password and the digital signature password and logs in to the RA system (522) and sets n to 0 (523). The certificate revocation request DB 521 is searched to calculate the number of certificate revocation requests N (524). Check if the number of certificate revocation requests is greater than 0 (525) and terminate if small, and extract the DN (or subscriber name) of the subscriber who requested the certificate revocation from the certificate revocation request DB (526). The subscriber's certificate serial number information is obtained from the certificate DB 528 using the extracted subscriber DN as a key (527). A certificate revocation packet is generated using the certificate serial number as an input value and the digital signature is performed (529). The certificate revocation request packet is transmitted to the CA system.

The CA system accepts the request, performs the certificate revocation process, stores it (539, 540), and transmits the result value to the RA system.

The RA system checks whether the received result value is successful (530) and stores the corresponding certificate revocation request data in the certificate revocation request failure DB 533 in case of failure (532). On the other hand, if the result value is successful, the corresponding certificate revocation request data is stored in the certificate revocation request success DB (531) (534). After storing the certificate revocation request failure / success in the above process, the processing status is stored and managed in a log table through the log management module (535). Thereafter, the number of previously processed n is increased (536) and the request to be processed remains checked (537), and if so, the process proceeds to the process of obtaining the nth certificate revocation request subscriber DN (526). If there is no request to do so, after deleting the records of the certificate revocation request DB, the certificate revocation batch module is terminated (538).

The reason why the certificate revocation request failure DB is separately managed in the above-described process is to allow the operator to perform certificate revocation after confirming why the request processing failed for each request. In the present invention, if the certificate revocation is successful in such a process, the request is deleted from the certificate revocation request failure DB, added to the certificate revocation request success DB, and each processing result is provided in the log table to provide a device for future by the RA operator It can be compared and verified with the work and related information managed by the corresponding CA system.

6A and 6B illustrate a series of processes for an interface device / batch processing device related to certificate reissue is proposed in the present invention.

In the present invention, the certificate reissue is proposed as a complex certificate related task that provides a new reference number and authorization number to subscribers so that the existing certificate can be discarded and a new certificate can be issued and used for the remaining valid period. Through this, the digital signature key pair and key management key pair used by the subscriber are defined as being different from those used previously.

In real service situations, this certificate re-issue is a frequent occurrence. For example, if the subscriber does not remember the password for the password, the password is not physically stored on any system or medium, so that the digital key and the key management secret key cannot be decrypted. It becomes impossible. In this case, through the certificate reissue interface device / batch device proposed in the present invention, the subscriber management system accepts the corresponding complaint from the users and through the identification process of the subscriber, the subscriber can use the service as soon as possible. You have a mechanism to make it work.

FIG. 6A is a flowchart illustrating a process of collectively transmitting a certificate reissue request to the RA system according to the present invention, and illustrates a method of collectively transmitting a certificate reissue request from the subscriber management system to the RA system.

First, a processor running in the subscriber management system retrieves a certificate reissue request DB 601 to calculate a certificate reissue request subscriber number N, and sets the processed subscriber number n to 0 (602). After extracting the DN (or subscriber name) of the subscriber who requested the certificate reissue from the corresponding table (603), the certificate reissue request function is called with the extracted subscriber DN as an input value (604). The certificate reissue request packet is generated from the reissue request interface function and transferred to the interface daemon processor running in the RA system (605).

The daemon processor running in the RA system verifies the structure of the certificate reissue packet after receiving the certificate reissue request packet (611) (612). After verification, it is checked whether there is an error in the certificate re-issuance request packet (613), and if there is an error, the corresponding information is recorded in the log table through the log management module driven in the RA system (614) and then operated in the subscriber management system. An error is returned to the certificate reissue request interface function (619). On the other hand, if the received packet is normal, as a result of the check, the certificate reissue request is inserted into the certificate reissue request DB (615). In operation 616, the controller checks whether an error has occurred in the insertion process, if an error has occurred, records it in a log table through a log management module (617), and returns an error to a certificate revocation request interface function operated in the subscriber management system (619). . On the other hand, if an error has not occurred in the insertion process, the success of receiving the request is recorded in the log table through the log management module (618), and returns success to the certificate reissue request interface function operating in the subscriber management system (619). ).

Thereafter, the certificate reissue interface module checks whether the result value received from the RA system is successful (606) and increases n if it is successful (608), and determines whether to retry the request (607) if it fails. If an attempt is made, the process proceeds to a step 604 of invoking a certificate reissue function with the subscriber DN as an input value, and increments n by 1 if no retry is selected. Thereafter, the number of subscribers to which a certificate reissue request is to be sent is checked (609). If there are remaining subscribers to process, the process of extracting the DN of the nth certificate reissue request subscriber from the table proceeds to step 603. If there are no subscribers to be processed, the processor for processing the certificate reissue request ends (610). ).

As described above, certificate reissue is a certificate related task that includes a combination of certificate revocation and certificate issuance. Therefore, the certificate serial number is required in the certificate structure defined in X.509 for the relevant business process. However, in the general subscriber management system, it is not only difficult to know the subscriber's DN accurately, but also impossible to know the subscriber's certificate serial number. Accordingly, in the present invention, in connection with the certificate revocation batch processing described above, the subscriber management system delivers only the subscriber DN or subscriber name to the RA system, and manages in the local system with the subscriber DN or subscriber name received from the RA system as a key. Introduced a method of extracting the certificate serial number of the subscriber who requested the certificate reissue by linking the user DB and the certificate DB and acting for the certificate revocation request.

6B is a flowchart illustrating a process of collectively processing a certificate reissue request by the RA system according to the present invention, and illustrates a process of collectively processing a certificate reissue request received from the subscriber management system by the RA system. .

After the RA operator inputs the card password and the digital signature password, the RA operator logs in to the RA program (621) and sets n to 0 (622). The certificate reissue request DB 620 is searched to calculate the number of certificate reissue requests (623). If the number of requests is greater than zero (624) or terminates and is greater than zero, the certificate reissue request DB (620) extracts the Distinguished Name (DN) of the subscriber who requested the certificate reissue (625). The certificate serial number of the subscriber is extracted from the certificate DB 627 managed by the RA system using the corresponding subscriber DN as a key (626). After generating the packet corresponding to the certificate reissue with the certificate serial number as an input value, the digital signature is performed (628) and the certificate reissue packet is transmitted to the processor executed in the CA system.

The CA system receives the certificate reissue request and performs certificate reissue process (638 to 641) and transmits the result value to the RA system.

The RA system checks whether the result value is successful (630), and if it fails, stores the corresponding certificate reissue request data in the certificate reissue request failure DB 632 (631). On the other hand, if the result value is successful, the certificate reissue request data is stored in the certificate reissue request success DB 629 (S633). Thereafter, the processing status is recorded and managed in a log table through a log management module (634). Thereafter, after increasing the number n of processings (1) (635), it is checked whether there is a request to be processed (636), and if it remains, the process proceeds to a process (617) of obtaining the nth certificate reissue request subscriber DN. If there is no request to be left, the certificate reissue batch module is terminated after deleting the data of the certificate reissue request DB (637).

The reason why the certificate reissue request failure DB is separately managed in the series of processes is to allow the certificate reissue to be performed after checking the reason for the failure of the request processing for each operator's request. In the present invention, if the certificate reissue task succeeds in this process, the request is deleted from the certificate reissue request failure DB, added to the certificate reissue request success DB, and the respective RA results are provided in the log table to provide a device for future RA operator The work performed by and the related information managed by the corresponding CA system can be compared / verified.

After performing the certificate reissue batch processing device, the information required for the subscriber to issue the certificate, that is, the reference number and the authorization number, is transmitted according to a series of processes shown in FIG. 4C.

The method of the present invention as described above may be implemented in a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be apparent to those of ordinary skill.

The present invention as described above, the service, such as certificate issuance, certificate issuance, certificate revocation, certificate reissue is not only hidden from subscribers can be handled smoothly, but also there is an effect that can eliminate the service delay factor.

In addition, the present invention has the effect of ensuring efficient operation of the RA system by minimizing errors or operator intervention due to RA system operator intervention by supporting batch processing on the RA system.

Claims (13)

In the batch processing apparatus for certificate-related work, In order to perform the batch processing of certificate related tasks, the subscriber information and certificate information of subscribers belonging to the RA system in the authentication system among the subscriber information and certificate information managed by an external CA system are imported and stored / managed into the RA system. DB management means linked with CA ; According to a request for batch processing of certificate related tasks from an interfacing means of an external subscriber management system, the database is searched for a batch of certificate related tasks for the RA system itself, and the corresponding information is extracted to communicate with the CA system. A certificate related task batch means for delivering a result of the certificate related task to the subscriber management system after batch processing the certificate related task; And RA self-log management means for recording and managing the batch process of certificate related work in the certificate related work batch processing means Apparatus for supporting batch processing of certificate-related tasks, including. The method of claim 1, The certificate related business batch processing means, An apparatus for supporting batch processing of certificate related services, characterized in that a batch of certificate related tasks such as certificate issuance, certificate revocation, and certificate reissue. The method according to claim 1 or 2, DB management means linked to the CA, Certificate-related work, characterized in that for obtaining a new or changed data of the data belonging to the RA system in the authentication system by a certain period from the CA system to store in the user DB and certificate DB managed by the RA system Batch Support Device. The method according to claim 1 or 2, DB management means linked to the CA, According to a command from the RA operator, the data related to the RA system in the authentication system from the CA system, the batch management device supporting the certificate-related work, characterized in that stored in the user DB and certificate DB managed by the RA system. In the batch processing method of the certificate issuance authorization task applied to the batch processing support device of the certificate-related tasks, A first step in which the RA system collectively receives a certificate issuance authorization request from the subscriber management system; A second step of the RA system searching for its own certificate issuance authorization database and extracting information for issuing a certificate issuance, and collectively processing the certificate issuance authorization task through communication with a CA system; And A third step of storing a batch processing result of the certificate issuance authorization task and transferring the result to the subscriber management system; The batch issuing method of the certificate issuance authorization task comprising a. The method of claim 5, The storing process of the third step, The certificate issuance authorization task is characterized in that the certificate issuance authorization task is classified and stored and managed as success or failure so that an operator can reprocess and reclassify the batch processing result of the certificate issuance authorization task. Batch method. In the batch processing method of the certificate revocation work applied to the batch processing support device of the certificate related work, A first step in which the RA system collectively receives a certificate revocation request from the subscriber management system; A second step of the RA system searching for its own certificate revocation database and extracting information for revocation of a certificate, and collectively processing a corresponding certificate revocation task through communication with a CA system; And A third step of storing a batch processing result of the certificate revocation task; The batch processing method of the certificate revocation task comprising a. The method of claim 7, wherein The third step, Batch processing method of the certificate revocation task, characterized in that to classify the result of the certificate revocation task to success and failure so that an operator can re-process and reclassify the result of the batch processing of the certificate revocation task . In the batch processing method of certificate reissue is applied to the batch processing support device of the certificate-related business, A first step in which the RA system collectively receives a certificate reissue request from the subscriber management system; A second step of the RA system searching for its own certificate reissue database and extracting information for certificate reissue, and collectively processing a corresponding certificate reissue through communication with a CA system; And A third step of storing a batch processing result of the certificate re-issuance task and transferring the result to the subscriber management system; The batch processing method of the certificate reissue task including. The method of claim 9, The storing process of the third step, A batch processing method of certificate reissue work, characterized in that the result of the batch processing of the certificate reissue work is classified and stored and managed so that an operator can reprocess and reclassify the batch processing result of the certificate reissue work. . In the batch processing support device for certificate-related work with a processor, A first function for the RA system to collectively receive a certificate issuance authorization request from the subscriber management system; A second function in which the RA system searches for a certificate issuance authorization database of its own and extracts information for issuing a certificate and processes the certificate issuance authorization task through communication with a CA system; And A third function of storing a batch processing result of the certificate issuing authorization task and transferring the result to the subscriber management system; A computer-readable recording medium having recorded thereon a program for realizing this. In the batch processing support device for certificate-related work with a processor, A first function for the RA system to collectively receive a certificate revocation request from the subscriber management system; A second function of the RA system searching for its own certificate revocation database and extracting information for revocation of a certificate, and collectively processing a corresponding certificate revocation task through communication with a CA system; And A third function of storing a batch processing result of the certificate revocation task; A computer-readable recording medium having recorded thereon a program for realizing this. In the batch processing support device for certificate-related work with a processor, A first function for the RA system to collectively receive a certificate reissue request from the subscriber management system; A second function of the RA system searching for its own certificate reissue database to extract information for reissue of a certificate, and then collectively processing a corresponding certificate reissue through communication with a CA system; And A third function of storing a batch processing result of the certificate re-issuance task and transferring the result to the subscriber management system; A computer-readable recording medium having recorded thereon a program for realizing this.

Images