KR101022788B1 - Apparatus and method of data preservating in public key infrastructure based on group - Google Patents

Abstract

The present invention relates to a data security apparatus and method for group-based PKI.

According to the present invention, after performing the subscriber authentication using the PKI-based authentication information received from the subscribers subscribed to the group, extracting the public key, retrieves the data required from the subscriber, and decrypts the retrieved data with the group's private key. And generating a session key for providing the data to the subscriber, encrypting the decrypted data, encrypting the generated session key using the extracted subscriber public key, and encrypting the encrypted data and session key. To be provided to the subscriber.

At this time, the data is encrypted and stored in the storage server with the private key to be shared between the subscribers between the groups.

According to the present invention, it is possible to perform security on data managed while maintaining confidentiality only within a group in an environment where a plurality of subscribers are free to join and leave.

PKI, public key, session key, security, data sharing

Description

Apparatus and method of data preservating in public key infrastructure based on group}

1 is a block diagram showing the structure of a data security device of a group-based PKI according to an embodiment of the present invention.

2 is a flowchart illustrating a method of joining a group of new subscribers in a data security method of a group-based PKI according to an embodiment of the present invention.

3 is a flowchart illustrating a method of leaving a group of subscribers in a data security method of a group-based PKI according to an embodiment of the present invention.

4 is an operation flowchart of a data transmission method in a data security method of a group-based PKI according to an embodiment of the present invention.

5 is an operation flowchart of a data receiving method in a data security method of a group-based PKI according to an embodiment of the present invention.

The present invention relates to a group-based public key infrastructure (PKI) security device and method, and more particularly, to a group-based PKI data security device and method that satisfies the security requirements in an environment where multiple subjects share data in groups. It is about.

PKI technology is widely used in various security fields such as authentication, digital signature, and confidentiality, but it is basically operated in a 1: 1 relationship between trading partners.

In other words, for Internet-based clubs that are free to join and unsubscribe, configurations for securing a group of random participants and keeping common data confidential are not used in a typical PKI environment.

Conventional security methods in group-based environments include a method in which the entire group shares the same key by performing symmetric key encryption and a secret sharing technique.

First, the symmetric key method is difficult to share by sharing the key among the group members, and in particular, it is difficult to manage to prevent the key of the group from being exposed to users who do not belong to the group.

In addition, in the case of an Internet club that frequently joins and withdraws from the group, a management problem occurs because the withdrawal person knows the shared key of the group.

In the second secret sharing scheme, if encryption is performed for confidentiality, after a group of participants share a secret, when a certain number of persons want to access the encrypted secret, it decrypts it using a combination of secret keys that it owns. This is a technique.

However, the above-mentioned secret sharing technique is applied to fields such as electronic voting, and is not suitable for a service in which a subject of encryption and decryption becomes an individual in a group-based environment.

 In order to solve the above problem, an object of the present invention is to provide a data security device and method of a group-based PKI to provide a security service using a PKI in a group-based environment.

Data security device of a group-based PKI according to an aspect of the present invention,

In the security device of the PKI for security in a group containing a plurality of subscribers,

An authentication center for issuing a public key certificate for authentication to the plurality of subscribers and groups; A directory server for storing a public key certificate issued by the authentication center; And encrypting and storing the personal information of the plurality of subscribers who have been issued the public key certificate, the Distinguish Name (DN) of the subscriber, the subscription group information of the subscriber, and the data shared within the group, and storing the stored data in the request of the subscriber. Accordingly, the storage server encrypts and provides a subscriber's public key.

The storage server includes a subscriber database for storing subscriber information, a subscriber database for storing a subscriber's DN and subscription group information, group information, a group manager virtually configured with a group manager's DN, and a group's public and private keys. Include a database.

Data security method of a group-based PKI according to an aspect of the present invention,

In a system including an authentication center for the security of a public key infrastructure (PKI), and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers, the subscriber may send data to the storage server. A storing method comprising: (a) a subscriber station subscribed to the group, receiving a certificate of a corresponding group using a DN (Distinguish Name) of the group to which the subscriber belongs, and extracting a public key of the group certificate; (b) generating a session key for the data transmission and encrypting the data using the generated session key; (c) encrypting the session key generated in step (b) using the public key of the group certificate extracted in step (a); And (d) transmitting the data encrypted in the step (b) and the session key encrypted in the step (c) to the storage server for storage.

In the step (a), receiving the group's certificate by the subscriber of the group, the DN search request of the group as the storage server, and receiving the DN value of the group from the storage server; And receiving a certificate of a corresponding group from the directory server by using the received group DN value.

In the group certificate of step (a), the public key is a public key of a group manager virtually generated for the group.

Data security method of the group-based PKI according to another aspect of the present invention,

Data stored by the storage server to a subscriber in a system including an authentication center for security of a public key infrastructure (PKI) and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers. A method for providing a method comprising the steps of: (a) performing subscriber authentication using a PKI-based authentication information received from a subscriber subscribed to the group, extracting a public key, and then retrieving data required from the subscriber; (b) decrypting the retrieved data with a private key of a group, generating a session key for providing the corresponding data to the subscriber, and then encrypting the decrypted data; (c) encrypting the session key generated in step (b) using the subscriber public key extracted in step (a); And (d) transmitting the encrypted data and the session key to the subscriber.

In the step (b), decrypting data using the private key of the group comprises: decrypting a session key of the corresponding data using the private key of the group; And decrypting the data using the decrypted session key.

After the step (d), the subscriber station receiving the encrypted data and the session key decrypts the session key using its private key; And decrypting the data by using the decrypted session key and using the corresponding data.

In this case, in the joining of the group, a subscriber station having received a personal certificate from the authentication center transmits subscriber application information and PKI-based authentication information to the storage server to register and store subscriber information in the storage server to join the group. Characterized in that it comprises a step.

And, withdrawing the corresponding group of subscribers joining the group, transmitting the withdrawal request and PKI based authentication information to the storage server; And performing, by the storage server, authentication of the subscriber who requested the withdrawal, and deleting information of the subscriber.                     

The subscriber application information is characterized by including personal information including the name, address, resident registration number of the subscriber.

A recording medium according to one aspect of the present invention,

In a system including an authentication center for the security of a public key infrastructure (PKI), and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers, the subscriber may send data to the storage server. A recording medium storing a program including a function of storing, (a) a subscriber station subscribed to the group receives a certificate of a corresponding group using a DN (Distinguish Name) of the group to which the subscriber belongs, Extracting the public key of the; (b) generating a session key for data transmission and encrypting data using the generated session key; (c) encrypting the session key generated in step (b) using the public key of the group certificate extracted in step (a); And (d) transmitting the data encrypted in step (b) and the session key encrypted in step (c) to the storage server for storage.

According to another aspect of the present invention,

Data stored by the storage server to a subscriber in a system including an authentication center for security of a public key infrastructure (PKI) and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers. A recording medium storing a program including a function for providing a service, comprising: (a) performing the subscriber authentication using the PKI-based authentication information received from the subscribers subscribed to the group and extracting the public key; Retrieving data required from subscribers; (b) decrypting the retrieved data with a private key of a group, generating a session key for providing the corresponding data to the subscriber, and then encrypting the decrypted data; (c) encrypting the session key generated in step (b) using the subscriber public key extracted in step (a); And (d) transmitting the encrypted data and session key to the subscriber.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the accompanying drawings, parts irrelevant to the description of the present invention are omitted in order to clearly describe the present invention, and the same or similar parts are denoted by the same reference numerals.

1 is a block diagram showing the structure of a data security device of a group-based PKI according to an embodiment of the present invention.

Referring to FIG. 1, a security device of a group-based PKI includes a certificate authority (CA) 310, a directory server (DS) 320, and a storage server 330, and includes a plurality of subscribers A, B, and C ( 100 is connected via the Internet 200.

The CA 310 is a certification center that issues public key certificates to subscribers 100 and the group's virtual group managers, and the DS 320 is a directory server that stores and publishes public key certificates issued by the CA 310. It is a device that includes encryption / decryption function for PKI system operation.

The storage server 330 includes a subscriber DB (DataBase) 331 and a group management DB 332.

The subscriber DB 331 has subscriber information available on a general application program, and stores a subscriber's DN (Distinguish Name) and subscription group information. By using this, subscribers can be authenticated when receiving the data of the subscribed group, and the public key included in their certificate can be shared data that can be decrypted using the public key that only the subscriber owns through the DN. It is used to make the server available to receive it in encrypted state.

The group management DB 332 stores the group manager's DN and the group's public key that are virtually set together with general information about the group. When the subscriber transmits the shared data to the storage server 330 by using the DN of the group manager, the encrypted data that can be decrypted only by the public key of the group manager may be transmitted.

In addition, when the subscriber of the group requests the encrypted data stored in the storage server 330, the public key of the virtual group manager for decrypting the data is stored and used to decrypt the encrypted data.

In this case, in order to securely store the public key and the certificate of the group manager, the storage server 330 uses already known technologies such as network security, host security, and access control.

The CA 310, the DS 320, and the storage server 330 are connected to the subscriber 100 through the Internet 200, and the Internet 200 has confidentiality in the network itself, such as the Internet Protocol Security protocol (IPSec). It is a general public network that does not provide.

In the security device of the group-based PKI according to the embodiment of the present invention, the individual subscriber cannot receive the security service without obtaining a certificate. In other words, in order for a subscriber to join a new group, a certificate must be issued, a public key must be generated, and PKI-based software must be provided to handle this.

In addition, in the security device of the group-based PKI according to the embodiment of the present invention, group participation, withdrawal and data transmission and reception of new subscribers are performed as follows.

2 is a flowchart illustrating a method of joining a group of new subscribers in a data security method of a group-based PKI according to an embodiment of the present invention.

Referring to FIG. 2, if there is a new subscriber 100 who wants to participate in the group, it is determined whether the corresponding subscriber 100 has been issued a certificate (S201).

As a result of the determination of step S201, the subscriber 100 has not been issued a certificate, and performs communication with the CA 310 and the DS 320 to obtain a certificate (S202). In this case, the certificate issuance is performed by the CA 310 issuing the certificate in accordance with the PKI-based operating principle, and then issued by the certificate issued to the DS (320).

In addition, the private key corresponding to the public key included in the issued certificate is securely stored in the terminal of the subscriber 100.

If the certificate is issued to the user, the subscription application for joining the group (S203), and the general subscriber application information and PKI-based authentication information to the storage server 330 (S204).

The storage server 330 stores the received general subscriber application information and PKI based authentication information in the subscriber DB 331 (S205), and the subscriber 100 is registered as a new subscriber of the group.

At this time, the PKI-based authentication process goes through a rigorous procedure based on a method in which the storage server 330 gives a challenge for authentication, and the subscriber 100 gives a response with its own private key. Since it is a well-known technique well-known description is omitted.

In order to withdraw from the group, the subscriber 100 registered through the above process performs the following process.

3 is a flowchart illustrating a method of leaving a group of subscribers in a data security method of a group-based PKI according to an embodiment of the present invention.

Referring to FIG. 3, when the subscriber 100 of the group makes a request for withdrawal (S301), the terminal of the subscriber 100 transmits withdrawal request information and PKI-based authentication information to the storage server 330 (S302).

The storage server 330 performs authentication of the corresponding subscriber 100 through communication with the DS 320 using the PKI-based authentication information (S303), and deletes the corresponding subscriber information item by the withdrawal request information (S304). . At this time, deleting the subscriber information item deletes not only the subscriber information of the subscriber 100 but also the group to which the subscriber 100 belongs and the DN item.

Data transmission and reception in the group performing the above joining and withdrawing are performed as follows.                     

4 is an operation flowchart of a data transmission method in a data security method of a group-based PKI according to an embodiment of the present invention.

Referring to FIG. 4, in order to transmit and store data to be shared with a group member by a member 100 who is a member of the group to the storage server 330, the subscriber 100 first stores a DN search of the group to which the member belongs. After the request to the server 330 (S401), the storage server 330 finds a group to which the subscriber 100 belongs (S402), and transmits the DN value of the group to the subscriber 100.

The subscriber 100 requests and receives a group certificate from the DS 320 using the group DN (S403), and extracts the public key of the virtual group manager from the received group certificate (S404).

The subscriber 100 generates a session key for data encryption, encrypts the data using the generated session key (S405), and then encrypts the session key with the public key extracted in step S404 (S406). .

The subscriber 100 transmits the encrypted data and the session key information to the storage server 330 (S407) and stores the data (S408).

At this time, the concept of the session key of step S405 may be introduced to perform asymmetric key encryption using a public key of a group manager without symmetric key encryption, but symmetric key encryption / decryption and asymmetric key encryption / Since the performance of decryption is remarkably different, the concept of session key is generally introduced using the efficiency of the system.

In addition, the symmetric key encryption method includes encryption techniques such as DES (Data Encryption Standard), 3DES, AES (Advanced Encryption Standard), SEED, etc.Asymmetric key encryption techniques include RSA (Rivest Shamir Adleman) and ECC (Elliptic Curve Cyptosystem). Elliptic curve cryptographic system).

In order to receive the data stored in the storage server 330 as described above, the subscriber 100 performs the following operations.

5 is an operation flowchart of a data receiving method in a data security method of a group-based PKI according to an embodiment of the present invention.

Referring to FIG. 5, the subscriber 100 who wants to receive shared data of a group stored in the storage server 300 transmits PKI-based authentication information stored in his terminal to the storage server 330 (S501). (S502).

At this time, the subscriber authentication of the step S502 is the storage server 330 is confirmed by the subscriber certificate from the DS 320 using the PKI-based authentication information received from the subscriber 100, the corresponding subscriber (from the group management DB 332) Perform the procedure to confirm that 100) is a member of the group to which it belongs.

After the subscriber authentication is completed, the subscriber 100 searches for files in the group stored in the storage server 330 and requests data to be downloaded (S503).

The storage server 330 decrypts the data using the private key of the virtual group manager according to the download request from the subscriber 100 (S504), and retrieves the certificate of the subscriber 100 from the DS 320. It receives (S505).

At this time, the process of decrypting the data of step S504 is to decrypt the session key of the corresponding data using the private key of the group manager in a manner opposite to the method of encryption when transmitting the data in FIG. To decrypt the data.

The storage server 330 extracts the public key of the subscriber 100 from the certificate of the subscriber 100 received from the DS 320 (S506), generates a new session key, and encrypts the data decrypted in step S504. The session key is encrypted with the public key of the subscriber 100 extracted in step S506 (S507).

Thereafter, the storage server 330 transmits the encrypted data and the session key to the subscriber 100 (S508), and the subscriber 100 decrypts the session key using the private key stored in its terminal. The decrypted data is used using the obtained session key (S509).

The security method of a group-based PKI according to an embodiment of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form.

In addition, the present invention proposes a method of sharing data while maintaining confidentiality among subscribers belonging to a group, and the embodiment has been described in a limited way to a single group, but a service in which one subscriber joins several groups Also applicable.

This is because the subscribers belonging to one or more groups are simple extensions of individual relationships for each group and are not required for special system configuration but can be made in terms of simple database management.

Although a preferred embodiment of the present invention has been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

As described above, the security apparatus and method of the group-based PKI according to the present invention can secure the data managed while maintaining confidentiality only in the group in an environment in which a plurality of subscribers are free to join and leave. There is.

Claims (13)

In the security device of the PKI for security in a group containing a plurality of subscribers, An authentication center for issuing a public key certificate for authentication to the plurality of subscribers and groups; A directory server for storing a public key certificate issued by the authentication center; And Encrypts and stores a plurality of subscriber information that has been issued the public key certificate, a subscriber's DN (Distinguish Name), the subscriber's subscription group information, and data shared within the group, and stores the stored data according to the subscriber's request. Storage server encrypted with public key of Group-based PKI data security device including a. The method of claim 1, The storage server, A subscriber database for storing the plurality of subscriber information, the subscriber's DN, and the subscriber's subscription group information; Group management database that stores the group manager's DN and the group's public key. Data security device of the group-based PKI including. In a system including an authentication center for the security of a public key infrastructure (PKI), and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers, the subscriber may send data to the storage server. In the method of storage, (a) receiving, by a subscriber station joined to the group, a certificate of a corresponding group using a DN (Distinguish Name) of the group to which the subscriber belongs, and extracting a public key of the group certificate; (b) generating a session key for transmitting the data and encrypting the data using the generated session key; (c) encrypting the session key generated in step (b) using the public key of the group certificate extracted in step (a); And (d) transmitting the data encrypted in the step (b) and the session key encrypted in the step (c) to the storage server for storage. Data security method of group-based PKI comprising a. The method of claim 3, wherein In step (a), Receiving a certificate of the group by the subscriber station joined to the group, Making a DN search request of the group as the storage server and receiving a DN value of the group from the storage server; And Receiving the group's certificate from the directory server using the received group DN value Data security method of group-based PKI comprising a. The method of claim 3, wherein In the group certificate of step (a), the public key is Data security method of a group-based PKI, characterized in that the public key of the group manager virtually generated for the group. Data stored by the storage server to a subscriber in a system including an authentication center for security of a public key infrastructure (PKI) and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers. In the method for providing, (a) performing subscriber authentication using a PKI-based authentication information received from a subscriber subscribed to the group, extracting a public key, and retrieving data required from the subscriber; (b) decrypting the retrieved data with a private key of a group, generating a session key for providing the corresponding data to the subscriber, and then encrypting the decrypted data; (c) encrypting the session key generated in step (b) using the subscriber public key extracted in step (a); And (d) transmitting the encrypted data and the session key to the subscriber Data security method of group-based PKI comprising a. The method of claim 6, In step (b), Decryption of data using the private key of the group, Decrypting a session key of the corresponding data using the group's private key; And Decrypting the data using the decrypted session key Data security method of group-based PKI comprising a. The method of claim 6, After step (d), Decrypting, by the subscriber terminal receiving the encrypted data and the session key, the session key using its private key; And Decrypting the data using the decrypted session key and using the corresponding data Data security method of group-based PKI comprising a. The method according to claim 3 or 6, wherein Join the group, And a subscriber station having received a personal certificate from the authentication center to transmit subscriber application information and PKI-based authentication information to the storage server to register and store subscriber information in the storage server to join the group. Data security method of group based PKI. The method according to claim 3 or 6, wherein A subscriber who has joined the group leaves the group, Transmitting a withdrawal request and PKI-based authentication information to the storage server; And The storage server performing authentication of the subscriber who requested the withdrawal and deleting information of the subscriber; Data security method of group-based PKI comprising a. The method of claim 9, The subscriber application information, Data security method of a group-based PKI comprising the personal information including the name, address, social security number of the subscriber. In a system including an authentication center for the security of a public key infrastructure (PKI), and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers, the subscriber may send data to the storage server. In the recording medium for storing a program comprising a function for storing, (a) a function of extracting a public key of a group certificate by a subscriber station subscribed to the group to receive a certificate of the group by using a Distinguish Name (DN) of the group to which the subscriber station belongs; (b) generating a session key for transmitting the data and encrypting the data using the generated session key; (c) encrypting the session key generated in the function (b) using the public key of the group certificate extracted in the function (a); And (d) transmitting and storing the data encrypted in the function (b) and the session key encrypted in the function (c) to the storage server; Recording medium for storing a program comprising a. Data stored by the storage server to a subscriber in a system including an authentication center for security of a public key infrastructure (PKI) and a storage server for securely sharing data in a group including a directory server and a plurality of subscribers. In the recording medium for storing a program comprising a function for providing a, (a) performing subscriber authentication using the PKI-based authentication information received from the subscribers subscribed to the group, extracting a public key, and retrieving data required from the subscribers; (b) decrypting the retrieved data with a private key of a group, generating a session key for providing the corresponding data to the subscriber, and then encrypting the decrypted data; (c) encrypting the session key generated in function (b) using the subscriber public key extracted in function (a); And (d) transmitting the encrypted data and the session key to the subscriber; Recording medium for storing a program comprising a.

Images