KR100834576B1 - Key management method and apparatus for providing secure communication on p2p network - Google Patents

Abstract

A key management method for providing secure communication on a P2P network and an apparatus for managing the key are provided to authenticate ownership of a public key safely by using an authentication method using a PK1-based structure. A message receiving process is performed to receive a file search request message transmitted from a first peer of a P2P network. A search process is performed to search the presence of the file requested in the message receiving process. A file search response message composition process is performed to compose a file search response message including internet protocol address and public key data of a second peer for storing the corresponding file when the file is searched in the search process. A transmission process is performed to transmit the composed response message to the first peer.

Description

 KEY MANAGEMENT METHOD AND APPARATUS FOR PROVIDING SECURE COMMUNICATION ON P2P NETWORK}

1 is an overall configuration diagram of a P2P network performing a key management method for secure communication according to an embodiment of the present invention;

2 is a database managed by an authentication server of a P2P network performing a key management method for secure communication according to an embodiment of the present invention;

3 is a database managed by a super peer of a P2P network performing a key management method for secure communication according to an embodiment of the present invention;

4 is a block diagram showing a configuration of a terminal device corresponding to a peer for generating a key for secure communication in a P2P environment according to another embodiment of the present invention;

5 is a flowchart illustrating a process of registering a peer's public key to generate a key for secure communication in a P2P environment according to another embodiment of the present invention;

6 is a flowchart illustrating a process of generating a key for secure communication by a super peer in a P2P environment according to another embodiment of the present invention;

7 is a flowchart illustrating in detail a process of generating a key for secure communication when exchanging files between peers in a P2P environment according to another embodiment of the present invention.

The present invention relates to a method and apparatus for securely generating, transmitting, and verifying a key for secure communication between peers in order to apply an authentication scheme using a PKI infrastructure to a P2P network.

The representative authentication mechanism currently applied on the Internet is an authentication method using a public key infrastructure (PKI) infrastructure. According to the authentication technique using the PKI infrastructure, secure communication is performed based on the public key. That is, in order to transmit data or a message to user A, user B encrypts the data using user A's public key and then transmits the data. Decrypt the data.

In order to perform this operation, a process of verifying whether the public key disclosed as the public key of the user A is the public key of the user A is required. To this end, User B verifies the ownership of User A's public key by verifying the signature on User A's public key through communication with the server.

The PKI-based public key authentication scheme is a very widely used method, and in the case of an actual banknote, a certificate for online banking is issued and used. However, there is a problem that offline procedures are required when following this method. For example, banks need to go directly to the counter to verify their identity and receive an authentication key.

In addition, the PKI infrastructure is not only expensive to build and maintain the PKI infrastructure, but also has a problem of increasing the load of the authentication server. In particular, in the case of P2P networks, there is a difficulty in applying the existing PKI-based certificate method because an environment in which desired members join and leave without restriction.

In order to solve this problem, a method of directly generating public and private keys by peers on a P2P network and distributing their public keys directly through a network without going through a server has been proposed. However, this method has a problem that malicious nodes are vulnerable to MITM (Man in the Middle Attack) such as forgery of public key.

An object of the present invention for solving the above problems, method and apparatus for securely authenticating the ownership of the public key by applying the authentication scheme using the PKI infrastructure in a P2P network environment without the existing PKI infrastructure To provide.

In order to achieve the object of the present invention as described above, a key management method for secure communication in a P2P network,

Receiving a file search request message sent from another first peer of the P2P network;

A second step of searching whether the file requested in the first step exists;

A third step of creating a file search response message including an Internet protocol address and a public key information of a second peer storing the file if the file is found to be present as a result of the search of the second step; And,

And a fourth step of sending the response message created in the third step toward the first peer.

Preferably the key management method for secure communication in the P2P network,

A fifth step of receiving a request for providing a public key information of a first peer from a second peer that has received a file transfer request from the first peer;

A sixth step of collecting public key information of the first peer; And,

The method may further include a seventh step of providing the second peer with the public key information collected in the sixth step.

In order to achieve the object of the present invention as described above, a terminal device for generating a key for secure communication in a P2P network,

A database that stores files that can be provided to other peers on a P2P network and information necessary for authentication, public key registration, and file exchange required to enter the P2P network;

An interface unit for exchanging messages or data with an authentication server or other peers on a P2P network; And,

A control unit which checks whether a role of a terminal device on a P2P network is a super peer or a general peer, and performs an operation required for authentication, public key registration, and file exchange required to enter the P2P network;

The control unit,

Compose a message for making a public key registration, file retrieval, and file transfer request, and when creating a response message for the file retrieval request, include a public key information of the peer storing the file in the response message. module;

A search module for searching whether a file which is a target of the file search request is stored according to a file search request from another peer on a P2P network;

A message provided to another peer on the P2P network is encrypted using the public key information of the receiving peer, and the message received from the other peer includes an encryption and decryption module for decrypting using its private key information. .

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known functions or configurations may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The same reference numerals are used for parts having similar functions and functions throughout the drawings.

Throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "electrically connected" with another element in between. . In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless otherwise stated.

In addition, the term module described herein refers to a unit for processing a specific function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

1 is an overall configuration diagram of a P2P network performing a key management method for secure communication according to an embodiment of the present invention.

Referring to FIG. 1, the P2P network is composed of one authentication server (100), N super peers (200 to 202), and M general peers (300 to 302) (at this time). , N and M are natural numbers), and each component is connected by a wired or wireless network. In this case, the peers 200 to 202 and 300 to 302 are terminal devices such as personal computers (PCs), personal digital assistants (PDAs), mobile phones, and network terminals.

The authentication server 100 authenticates each of the super peers 200 to 202 and the general peers 300 to 302 to enter the P2P network, and authenticates the authenticated peers 200 to 202 and 300 to 302. It is a device that collects public key information and performs a role of managing it. To this end, the authentication server 100 according to a preferred embodiment of the present invention is a group ID (100-1), a peer ID (100-2), a flag (flag, 100-3), public key as shown in FIG. Manages a database including (Public key, 100-4) and Internet Protocol (IP) information 100-5.

2, the group ID 100-1 is a unique ID assigned to each group including the peers 200 to 202 and 300 to 302. One peer group includes one super peer and several general peers. It consists of a peer. The peer ID 100-2 is identification information for identifying each of the peers 200 to 202 and 300 to 302. The flag 100-3 is information for distinguishing whether a peer corresponding to the peer ID 100-2 is a normal peer or a super peer. For example, in FIG. In case of super peer, it has 'S' value.

The public key 100-4 information is information used to encrypt data provided to the corresponding peers 200 to 202 and 300 to 302 according to a public key infrastructure based on a public key infrastructure (PKI). The peers 200 to 202 and 300 to 302 that have received the data can decrypt the data using their own private keys. The Internet protocol information 100-5 is location information where corresponding peers 200 to 202 and 300 to 302 exist on a network.

The super peers 200 to 202 are peers having additional functions such as communication and public key management between general peers 300 to 302 in a P2P environment. For this purpose, the super peers 200 to 202 manage a database as shown in FIG. 3. do. In this case, as shown in FIG. 1, in the P2P network according to the present invention, one super peer 200 supports a plurality of general peers 300 to 302.

Referring to FIG. 3, the peer ID 200-1 is identification information for distinguishing each of the peers 200-202, 300-302, and the flag 200-2 is the peer ID 200-1. ) Is information for distinguishing whether a peer corresponding to) is a normal peer, a super peer, or a normal peer managed by the super peer. For example, in FIG. 3, a 'P' value is used as a normal peer. In the case of, it has a value of 'S', and in the case of a normal peer managed by the super peer, the value 'D' is obtained.

At this time, in the preferred embodiment applicable to the present invention as shown in FIG. 3, the super peers 200 to 202 are public key 200-3 information of each peer 200 to 202 and 300 to 302 in a database. And internet protocol (IP) information 200-4, which is location information on the network of the corresponding peers 200 to 202 and 300 to 302, is also stored and managed.

The general peers 300 to 302 may exchange files with other general peers on the P2P network upon entering the P2P network after receiving authentication from the authentication server 100. At this time, in the preferred embodiment applicable to the present invention as the authentication method, the peers 200 to 202 and 300 to 302 are authenticated by the authentication server 100 in a P2P network in the technical field to which the present invention belongs. Known methods, such as username and password based methods, can be readily selected and used by those skilled in the art.

4 is a block diagram illustrating a configuration of a terminal device corresponding to a peer for generating a key for secure communication in a P2P environment according to another embodiment of the present invention.

Referring to FIG. 4, the terminal device according to the embodiment of the present invention includes a control unit 310, a database 320, and an interface unit 330.

The controller 310 checks whether the role of the terminal device is a super peer or a general peer on the P2P network, and performs the necessary operations for authentication, public key registration, and file exchange required to enter the P2P network. To this end, the controller 310 includes a message composition module 311, a search module 312, and an encryption and decryption module 313.

The message creation module 311 is a component that composes a message for performing a public key registration, a file search, and a file transfer request, and creates a message for requesting a public key registration in a preferred embodiment applicable to the present invention. In this case, a hash value using a password of a terminal device as a key may be generated and included in the message for requesting the registration of the public key, and a corresponding file is included in the response message for the search request when a response message for the search request is generated. You can include the public key information of the peer that stores the.

The search module 312 is a component for searching whether a file which is a target of the file search request is stored according to a file search request from another peer on a P2P network, and the encryption and decryption module 313 is a P2P. A message provided to another peer on a network is encrypted using public key information of a receiving peer, and a message provided from the other peer is a component that decrypts using its private key information.

The database 320 is a component that stores a file that can be provided to other peers on a P2P network and information necessary for authentication, public key registration, and file exchange required to enter the P2P network, and a message from the terminal device. It stores the authentication server or the peer side public key information to be provided, the public key and private key information of the terminal device and the Internet protocol information. In this case, when the terminal device is a super peer in the P2P network, a peer ID, a flag value for each of the peer IDs, public key information, and Internet protocol information, which are identification information of a general peer belonging to a group to which the terminal device belongs, It may include.

The interface unit 330 is a component for exchanging messages or data with an authentication server or other peers on a P2P network.

5 is a flowchart illustrating a process of registering a peer's public key to generate a key for secure communication in a P2P environment according to another embodiment of the present invention.

Referring to FIG. 5, the peer 300 collects public key information of the authentication server 100 (S500). The public key of the authentication server 100 is for encrypting a public key registration request of a peer according to a public key infrastructure (PKI) based public key authentication scheme. In the preferred embodiment to which the present invention belongs, the step S500, the peer 300 entering the P2P network can check the public key information of the authentication server 100, a method known in the art, for example, the peer 300 Public key of the authentication server 100 is loaded in the binary form in the P2P software used to enter the P2P network, or the peer 300 connects to the authentication server 100 to access the P2P software. The method of acquiring the public key of the server only by downloading and installing the server may be easily selected and used by the person skilled in the art.

The peer 300 collecting the public key information of the authentication server 100 through the step S500 creates a public key registration message (S501). The public key registration message preferably includes an ID (ID), a password, an Internet Protocol (IP) address, and public key information of the corresponding peer 300. At this time, the public key registration message is encrypted using the public key of the authentication server 100 collected in step S500.

In a preferred embodiment applicable to the present invention, the peer 300 generates a hash value using the password of the peer 300 as a key in the public key registration message created in step S501. Can be attached. The purpose of encryption using the public key of the authentication server 100 in step S501 is to prevent an unauthorized person from seeing the public key registration message in the middle, and the attached hash value indicates that the unauthorized person has no data. This is to detect the change of contents.

The public key registration message created in step S501 is transmitted to the authentication server 100 (S502), and the authentication server 100 decrypts the received data with its own private key (S503). The public key registration message is verified by comparing the password value of the peer 300 included in the public key registration message with the password value of the peer 300 stored in its database (S504). If the verification of step S504 fails, the public key registration message is discarded and the procedure ends.

If a hash value is attached to the public key registration message, the authentication server 100 uses the password value of the peer 300 stored in its database as a key to replay the message through the hash value. Can be verified Even if the verification in step S504 succeeds, if the verification through the hash value fails, the public key registration message is discarded and the procedure ends.

In a preferred embodiment applicable to the present invention, if the verification of the public key registration message is successful, the public server 100 may store the public key information of the peer 300 in its database.

Next, the authentication server 100 writes a response message for the public key registration request (S505). In this case, when the corresponding peer 300 is a normal peer, the response message includes information on whether the public key registration is successful, a flag value indicating that the corresponding peer 300 is a normal peer, and a super peer for the corresponding peer 300. It may include the ID, public key and Internet protocol information of the. If the corresponding peer 300 is a super peer, the response message may include information on whether the public key registration succeeds, a flag value indicating that the peer 300 is a super peer, and certificate information for the super peer. . In this case, the response message is encrypted using the public key of the corresponding peer 300.

The authentication server 100 may sign a response message created in step S505 using a private key of the authentication server 100.

The response message created through the step S505 is transmitted to the corresponding peer 300 (S506), the peer 300 decrypts the response message with its own private key if necessary, and then discloses the authentication server 100. The signature of the authentication server 100 is verified using the key (S507).

Next, when the peer 300 is a normal peer, information about the super peer included in the response message verified through the step S507 may be stored in its database, and when the peer 300 is the super peer. In the S507, the super peer certificate included in the verified response message may be stored in its database.

In addition, although not shown in FIG. 5, in the preferred embodiment applicable to the present invention, when the peer 300 is a super peer, the peer 300 receives information of other super peers from the authentication server 100. And it can be provided with information about the general peers that it manages, it can be provided with the information necessary to enter under its management from other general peers.

For example, when receiving information of other super peers from the authentication server 100, the peer 300 is encrypted with its public key and signed with the private key of the authentication server 100. And super peer list data including the public key information. In addition, when receiving information about general peers managed by the user, the ID and Internet protocol address of the peer, which is encrypted with its public key and managed by the corresponding peer 300 signed with the private key of the authentication server 100, must be managed. And peer list data including the public key information.

In addition, the process of receiving information required to enter under the management from another general peer, the general peer (not shown) to authenticate with the authentication server 100, register the public key, and then manage the super peer (300) It may proceed after receiving the information of). For example, a message including the ID, Internet protocol address, and public key information of the general peer encrypted with the public key of the corresponding peer 300 that is a super peer and signed with the private key of the general peer may be provided.

6 is a flowchart illustrating a process in which a super peer generates a key for secure communication in a P2P environment according to another embodiment of the present invention.

Referring to FIG. 6, first, a super peer receives a file search request (S600). Such a file search request may be provided from a general peer managed by the super peer or from another super peer. In this case, the file search request includes public key information of a peer (hereinafter, referred to as a “first peer”) requesting a search for a corresponding file.

The super peer that has received the file search request through step S600 searches for whether a corresponding file exists in itself and a general peer managed by the super peer (S601). If it is determined that the search result file does not exist, the file search ends (S602).

If the search result file of step S601 is found to exist, a file search response including information about a peer (hereinafter referred to as a 'second peer') storing the file is created (S603). . In this case, the file search response may include the Internet protocol address and public key information of the second peer that stores the file, and the file search response may be the public key of the first peer that requested the search for the file. It is desirable to be encrypted. The file search response generated in step S603 is provided to the first peer.

Next, the public key information of the first peer is collected and provided to the second peer according to the request of the second peer that has received the file transfer request from the first peer that has received the file search response in step S603 (S604). ). The second peer, which has received the public key information of the first peer through the step S604, encrypts the corresponding file that has received the transfer request from the first peer with the public key of the first peer, and then provides the file to the first peer. Decrypts the provided file using its private key.

7 is a flowchart illustrating in detail a process of generating a key for secure communication when exchanging files between peers in a P2P environment according to another embodiment of the present invention. The P2P environment illustrated in FIG. 7 includes the normal peer 1 300 and the super peer 2 201 managed by the authentication server 100, the super peer 1 200, the super peer 2 201, and the super peer 1 200. It consists of a general peer 2 (301) managed by).

First, when the general peer 1 300 requests a search for a specific file from the super peer 1 200 that manages itself (S600), the super peer 1 200 receives the search among the general peers under its management. In addition to searching for the peer that stores the file, super peer 2 201, which is a super peer belonging to another group, is also requested to search for the file (S701).

Upon receiving a file search request from Super Peer 1 (200), Super Peer 2 (201) searches for peers that store the file among normal peers under its management, so that Normal Peer 2 (301) retrieves the file. If it is determined that the data is stored, a file search response including the information on the general peer 2 301 is created and provided to the super peer 1 200 (S702). In this case, the file search response may include the Internet protocol address and public key information of the general peer 2 301 that stores the file, and the file search response may include the general peer 1 that requested the search for the file. It is desirable to be encrypted with the public key of 300.

When the super peer 1 200 that has received the file search response through the step S702 provides it to the general peer 1 300 (S703), the general peer 1 300 is based on the information included in the file search response. The file transfer request is made directly to the general peer 2301 (S704).

The general peer 2 301 which receives the file transfer request S704 from the general peer 1 300 requests the public key information about the general peer 1 300 from the super peer 2 201 (S705). If there is no public key information for the general peer 1 (300) in the super peer 2 (201), the super peer 2 (201) through the authentication server 100, the public key of the general peer 1 (300) After collecting the information (S706, S707), and provides it to the general peer 2 (301) (S708).

After receiving the public key information of the general peer 1 (300), general peer 2 (301) encrypts the file received from the general peer 1 (300) with the public key of the general peer 1 (300) (S609), and then general Provided to peer 1 (300).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

According to the present invention, it is possible to securely authenticate the ownership of a public key in an environment without an existing PKI infrastructure, such as in the case of a P2P network in which a desired peer can join and leave without restriction. Can be applied.

Claims (14)

Receiving a file search request message sent from another first peer of the P2P network; A second step of searching whether the file requested in the first step exists; A third step of creating a file search response message including an Internet protocol address and a public key information of a second peer storing the file if the file is found to be present as a result of the search of the second step; And, And a fourth step of sending the response message created in the third step toward the first peer. The method of claim 1, A fifth step of receiving a request for providing a public key information of a first peer from a second peer that has received a file transfer request from the first peer; A sixth step of collecting public key information of the first peer; And, And a seventh step of providing the public key information collected in the sixth step to the second peer. The method of claim 1, The first file search request message includes a public key information of a first peer, the key management method for secure communication in a P2P network. The method of claim 1, The file search response message written in the third step between the third step and the fourth step further includes encrypting using the public key of the first peer for secure communication in the P2P network. How to manage keys. The method of claim 1, Prior to the first step, a method for managing a key for secure communication in a peer-to-peer network, characterized in that the peer further comprises registering its public key with the authentication server. The method of claim 5, The peer registers its public key with the authentication server, A1 step of collecting public key information of the authentication server; A2 step of creating a public key registration message including an ID, password, internet protocol address, and public key information of the corresponding peer and providing it to the authentication server; And, And a third step of receiving a message including information on whether the public key registration succeeds and a flag value indicating a role of the peer in a P2P network in response to the public key registration message of step a2. Key management method for secure communication in a P2P network, characterized in that. The method of claim 6 The public key registration message created in step a2 has a hash value generated by using a password of the peer as a key. The key management method for secure communication in a P2P network. The method of claim 6 If the peer is a normal peer, the message provided in step a3 includes key ID, public key, and internet protocol information of the super peer managing the peer. Key management for secure communication in a P2P network Way. The method of claim 6 In the P2P network, if the peer is a super peer, after the step a3, further comprising receiving information about another super peer or general peers managed by the authentication server from the authentication server. Key management method for secure communication. The method of claim 6 If the peer is a super peer, after the step a3, the key management method for secure communication in a P2P network, characterized in that further comprising the step of receiving information required to enter under the super peer's own management from another peer. . A database that stores files that can be provided to other peers on a P2P network and information necessary for authentication, public key registration, and file exchange required to enter the P2P network; An interface unit for exchanging messages or data with an authentication server or other peers on a P2P network; And, A control unit which checks whether a role of a terminal device on a P2P network is a super peer or a general peer, and performs an operation required for authentication, public key registration, and file exchange required to enter the P2P network; The control unit, Compose a message for making a public key registration, file retrieval, and file transfer request, and when creating a response message for the file retrieval request, include a public key information of the peer storing the file in the response message. module; A search module for searching whether a file which is a target of the file search request is stored according to a file search request from another peer on a P2P network; A message provided to another peer on the P2P network is encrypted using public key information of the receiving peer, and the message provided from the other peer includes an encryption and decryption module for decrypting using its private key information. Terminal device. The method of claim 11, The message generating module is a terminal device, characterized in that for generating a message for requesting the registration of the public key, generating a hash value using the password of the terminal device itself in the message for requesting the public key registration. The method of claim 11, And the database stores the authentication server or the peer side public key information to receive the message from the terminal device, the public key and private key information of the terminal device, and internet protocol information. The method of claim 11, When the terminal device is a super peer in the P2P network, the database may include a peer ID which is identification information of a general peer belonging to a group to which it belongs, a flag value for each peer ID, public key information, and an internet protocol. Terminal device comprising the information.

Images