KR101415698B1 - Certificate System and Method - Google Patents

Abstract

The present invention relates to a certificate authentication system and method. According to the present invention, the certificate authentication system is configured to comprise a security token which includes financial authentication certificates, generates a digital signature based on the financial authentication certificates, and transfers the digital signature to a wireless terminal via a near field wireless communication; the wireless terminal which transfers the digital signature transferred from the security token to an authentication server; and the authentication server which verifies the digital signature transmitted from the wireless terminal.

Description

{Certificate System and Method}

The present invention relates to a public authentication system and method, and more particularly, to a public authentication system and method that can use public certificates securely and conveniently in common in a PC environment and a smart phone environment.

An official certificate is an electronic signature certificate issued by a public certificate authority that has public confidence. In Korea, it is used in various fields such as online banking, online certificate issuance, electronic commerce, and internet stock trading. In recent years, financial transactions have been rapidly increasing in smart phones, which have been widely used, and the use of official certificates in smartphones is gradually increasing.

In the conventional PC environment, if you look at the form of using a public certificate, you can store the public certificate in a hard disk, a removable disk, a mobile phone, a storage token, a security token and the like. And the authentication server verifies the digital signature, thereby performing public authentication.

However, in the case of a hard disk or a removable disk storage method, it is possible to easily copy a public certificate in which a hacking program is stored as a file in a specific folder, and also to easily identify a public certificate password by monitoring the PC, There is a problem that financial accidents are frequently caused by hacking. On the other hand, if a removable disk is used, it can be considered safer than a hard disk because it can be exposed to hacking only when it is connected to a PC. However, a portable disk is likely to be lost, Also, even in the case of the mobile phone or the storage token storage method, although the public key certificate is not stored as a file, when the public key certificate is used, the personal key of the public key certificate is exposed to the PC memory and hacked There is still a vulnerability that can be exploited.

Therefore, a security token (HSM (Hardware Security Module) storing method that stores the authorized certificate in the security chip and performs the electronic signature in the security chip is the most secure, and the Korea National Internet Development Agency also recommends the use of the security token. However, since these types of security token products, which are currently being certified and sold by the Korea Internet & Security Agency, operate only in a PC environment, there is a problem that they can not be used in a smart phone.

Meanwhile, in the case of using a public certificate in an existing smartphone environment, a public certificate issued by a PC is copied to a smart phone and stored as a file in a specific folder, and various applications (applications) It is a method of copying and storing the issued official certificate to each data storage space of each smartphone application.

However, even in this case, the public certificate stored in the smartphone can be hacked in the same manner as the hard disk storage method in the PC environment, and there is a problem that the public certificate can leak due to the loss of the smart phone as in the case of the mobile disk storage method.

Therefore, there is a demand for a security token that can not be hacked and is safe to be lost even in a smartphone. In particular, there is a desperate need for a way to use such a security token in a safe and comfortable manner in a shared environment between a PC environment and a smart phone environment do.

United States Patent Application Publication No. US2012 / 0072718 Korean Patent Publication No. 10-2011-0078601

SUMMARY OF THE INVENTION It is an object of the present invention to provide a public authentication system and method that can use a public certificate securely and conveniently in a PC environment and a smartphone environment.

It is another object of the present invention to provide a public authentication system and method that enables public authentication using a security token even in a smartphone using short-range wireless communication.

It is yet another object of the present invention to provide a public authentication system and method that can be used more securely than existing methods while maintaining the form of using public certificates in an existing smartphone environment.

According to an aspect of the present invention, there is provided a public authentication system including a public key certificate, generating an electronic signature based on the public key certificate, and transmitting the electronic signature to the mobile terminal through short- token; A wireless terminal for transmitting the digital signature transmitted from the security token to an authentication server; And an authentication server for verifying the digital signature transmitted from the wireless terminal.

According to another aspect of the present invention, there is provided a public authentication system including: a security token having a public certificate and transmitting the public certificate to a wireless terminal through short-range wireless communication; A wireless terminal for generating an electronic signature based on the public key certificate transmitted from the security token and transmitting the electronic signature to the authentication server; And an authentication server for verifying the digital signature transmitted from the wireless terminal.

According to another aspect of the present invention, there is provided a security token for a public authentication system, including: a security chip for storing a public key certificate and generating an electronic signature; A USB connection to an external computer's USB port; And an internal communication control unit connected to the USB connection unit to control USB communication with the computer and to control wired communication with the security chip in connection with the security chip, And transmits the digital signature or the authorized certificate requested by the wireless terminal.

According to another aspect of the present invention, there is provided a wireless terminal for a public authentication system including: a wireless Internet module for performing wireless Internet communication with an authentication server; A short-range wireless communication module for performing short-range wireless communication with the security token; And a control unit interlocked with the wireless Internet module and the short-range wireless communication module and performing public authentication by driving an application, wherein the control unit deletes the public certificate transmitted from the security token after a predetermined time elapses, After the authentication is performed, the authentication is performed.

Meanwhile, a public authentication method according to an aspect of the present invention includes: a step in which a wireless terminal requests an electronic signature as a security token through short-range wireless communication; Receiving a digital signature generated based on a public key certificate stored in the security token through short-range wireless communication from the security token; Transmitting the electronic signature to an authentication server via a wireless Internet; And performing authorized authentication by receiving an authentication result from the authentication server through the wireless Internet.

According to another aspect of the present invention, there is provided a public authentication method including: requesting a wireless terminal for a public key certificate as a security token through short-range wireless communication; Receiving a public key certificate stored in the security token through short-range wireless communication from the security token; Generating a digital signature based on the received public key certificate; Transmitting the electronic signature to an authentication server via a wireless Internet; And performing authorized authentication by receiving an authentication result from the authentication server through the wireless Internet.

According to the present invention, it is possible to use an authorized certificate safely and conveniently anywhere in a PC environment and a smartphone environment.

According to the present invention, it is possible to perform public authentication using a security token even in a smartphone using a short-range wireless communication. Particularly, since a short-range wireless communication is used, a battery is unnecessary, .

In addition, according to the present invention, even if various applications of a smart phone do not support the function of performing digital signature in short-range wireless communication, it is possible to maintain the form of using a public certificate in a smart phone environment supporting conventional short- , The authorized certificate transmitted from the security token is automatically deleted after a predetermined time, so that the authorized certificate can be used more securely than the existing method.

1 is a schematic diagram of a public authentication system commonly used in a PC environment and a smartphone environment according to the present invention.
2 is a detailed block diagram of a security token according to an embodiment of the present invention.
3 is a diagram illustrating a method of using a security token according to an embodiment of the present invention in a PC environment.
4 is a flowchart of a public authentication method using a USB communication according to an embodiment of the present invention.
5 is a diagram illustrating a method of using a security token according to an embodiment of the present invention in a smartphone environment.
6 is a flowchart of a public authentication method using near field wireless communication according to an embodiment of the present invention.
7 is a flowchart of an embodiment in which a security chip according to the present invention generates an electronic signature.
FIG. 8 is a diagram illustrating a power change of the security chip in the embodiment of FIG.
9 is a flowchart of another embodiment in which a security chip according to the present invention generates an electronic signature.
FIG. 10 is a diagram illustrating a change in power of the security chip in the embodiment of FIG.
11 is a diagram illustrating a method of using a security token according to another embodiment of the present invention in a smartphone environment.
12 is a flowchart of a public authentication method using near field wireless communication according to another embodiment of the present invention.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings and preferred embodiments. In the following description, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention unnecessarily obscure.

In order to use the security token commonly in the PC environment and the smartphone environment, a security token is connected to the PC through a USB, and a smart phone (wireless terminal) is used with a Wi-Fi, a Bluetooth, , Near field communication (NFC), and the like.

However, in order to connect a security token to a smart phone with Wi-Fi or Bluetooth, it is necessary to supply power through a battery. When a battery is built in a security token, a manufacturing cost increases and a charge management is required for a user. In addition, Wi-Fi and Bluetooth have a problem in that a security vulnerability may occur due to a long connection distance.

Therefore, the present invention proposes a method of using a security token in connection with a smart phone (wireless terminal) by using Near Field Communication (NFC).

1 is a schematic diagram of a public authentication system commonly used in a PC environment and a smartphone environment according to the present invention.

Referring to FIG. 1, the authentication system according to the present invention includes a security token 100, a computer 200, a wireless terminal 300, and an authentication server 400.

The security token 100 can be connected to both a computer and a wireless terminal, and is a hardware security module (HSM) capable of generating an electronic signature by having a public certificate therein. For example, the security token 100 performs a USB (Universal Serial Bus) communication with the computer 200 and a near field communication (NFC) with the wireless terminal 300 to communicate with the computer and the wireless terminal Or transmits the generated digital signature to the computer 200 and / or the wireless terminal 300, or transmits the internal authorized certificate directly to the computer 200 and / or the wireless terminal 300, To perform public authentication.

The computer 200 transmits the digital signature transmitted from the security token 100 to the authentication server 400 through, for example, USB communication to perform public authentication, and provides services such as finance, issuance, game, and education do. For reference, in the present invention, the computer 200 includes all kinds of computers capable of communicating with the authentication server 400 through a USB port, such as a PC (personal computer), a notebook computer, etc., It is meant to include.

Then, the wireless terminal 300 transmits the digital signature transmitted from the security token 100 to the authentication server 400, for example, via short-range wireless communication, or transmits the digital signature based on the authentication certificate transmitted from the security token 100 And transmits it to the authentication server 400 to perform public authentication, and similarly provides services such as finance, issuance, game, and education on the basis thereof. For reference, in the present invention, the wireless terminal 300 includes all kinds of wireless terminals capable of short-range wireless communication such as a smart phone and a tablet PC, and capable of communicating with the authentication server 400 via a wireless Internet to be.

Lastly, the authentication server 400 is a device that verifies the entire book name transmitted from the computer 200 and / or the wireless terminal 300, performs the identity authentication, and informs the result.

2 is a detailed block diagram of a security token 100 according to an embodiment of the present invention.

2, the security token 100 according to an exemplary embodiment of the present invention includes a USB connection unit 110, an internal communication control unit 120, a security chip 130, an antenna 140, The wireless communication module 130 includes a contact communication module 131, a short range wireless communication module 132, an electronic signature module 133, an internal memory 134, a controller 135, and the like.

The USB connection unit 110 is a device for connecting the USB port 220 of the computer 200 and the security token 100 (specifically, the internal communication control unit 120). The shape of the USB port is typically Type A, which is the most commonly used type, but may be formed of Type B, Mini-A, Mini-B, Micro-A, Micro-B,

The internal communication control unit 120 controls the USB communication with the computer 200 and controls the contact type communication with the security chip 130. The internal communication control unit 120 operates by receiving power from the computer 200 according to the USB standard. Communicates with the computer 200 in compliance with the USB standard and communicates with the contact communication module 131 of the security chip 130 in compliance with, for example, the ISO 7816 standard, Command to the security chip 130 and transmits the response of the security chip 130 to the application software 210 of the computer 200. [ The internal communication control unit 120 may be a single chip, but the USB communication control unit and the contact communication control unit may be configured as independent chips, and the internal communication control unit 120 may be a general-purpose MCU Or may be configured as a part of the security chip 130. When the internal communication control unit 120 is configured as a part of the security chip 130, the internal communication control unit 120 may communicate with the control unit 135 of the security chip 130 directly without communicating with the contact communication module 131 of the security chip 130 have.

The security chip 130 includes a contact communication module 131, a short range wireless communication module 132, an electronic signature module 133, an internal memory 134, a controller 135, and the like. When the security token 100 is connected to the computer 200, the security chip 130 receives power from the computer 200 and / or the internal communication control unit 120 according to, for example, the ISO 7816 standard, When the mobile terminal 300 is close to the wireless terminal 300, the wireless terminal 300 operates with the power derived from the short range wireless communication module 330 of the wireless terminal 300 to the antenna 140 according to, for example, the ISO14443 standard. The security chip 130 is preferably implemented in a fixed form on a board of the security token 100, but may be inserted into a SIM (Subscriber Identity Module) type.

The contact communication module 131 is a module for performing contact communication with the internal communication controller 120. For example, conforming to the ISO 7816 standard, receives commands transmitted from the application software 210 of the computer 200 via the internal communication control unit 120 to the security chip 130, And transmits the response of the application server 130 to the application software 210 of the computer 200 via the internal communication control unit 120 again.

The short-range wireless communication module 132 is a module for performing communication with the short-range wireless communication module 330 of the wireless terminal 300. For example, conforming to the ISO14443 standard, and transmits the command transmitted from the application 320 of the wireless terminal 300 to the near field wireless communication module 330 of the wireless terminal 300 330 to the security chip 130 and transmits the response of the security chip 130 to the application 320 of the wireless terminal 300 through the short range wireless communication module 330 of the wireless terminal 300 It plays a role.

The electronic signature module 133 is a module for generating an electronic signature using the private key of the public key stored in the security chip 130. Generally, a digital signature is generated using a cryptographic operation accelerator inside the security chip 130.

The internal memory 134 stores the authorized certificate as a memory inside the security chip 130. [ The authorized certificate is preferably generated in the security chip 130, but it is also possible to copy the authorized certificate generated outside the security chip 130 to the internal memory of the security chip 130 for use.

The control unit 135 controls the contact communication module 131, the short-range wireless communication module 132, the electronic signature module 133 and the internal memory 134 of the security chip 130 as a whole, Copying, generating and transmitting digital signatures, setting and changing passwords, automatic locking of security tokens, and initialization of security tokens.

The antenna 140 is connected to the short-range wireless communication module 132 of the security chip 130 and used for short-range wireless communication with the wireless terminal 300. The antenna 140 is preferably fixed to the substrate of the security token 100, but may be inserted into the SIM when the security chip 130 is inserted into the security token 100 as a SIM type.

Hereinafter, the security token according to the present invention will be described in detail in connection with the PC environment and the smartphone environment, with reference to FIGS. 3 to 12. FIG.

3 is a diagram illustrating a method of using a security token according to an exemplary embodiment of the present invention in a PC environment. 4 is a flowchart of a public authentication method using a USB communication according to an embodiment of the present invention.

As described above, the computer 200 may be any type of computer capable of communicating with the authentication server 400 through a wired / wireless Internet, including a USB port 220 such as a personal computer (PC) . The computer 200 is provided with application software 210 to provide a variety of services to the user and transmits the digital signature transmitted from the security token 100 to the authentication server 400 when authentication is required, Games, and education.

3 and 4, when the authentication of the application program of the computer is required, the application software 210 of the computer 200 searches the USB port 220 for the security token 100 S100).

When the application software 210 of the computer 200 succeeds in finding the security token 100, the application software 210 of the computer 200 and the security chip 130 connect the wired channel. At this time, the application software 210 of the computer 200 connects the channel with the internal communication control unit 120 through the USB communication, and the internal communication control unit 120 connects the channel with the security chip 130 by, for example, ISO7816 communication See step S101).

The security chip 130 transmits the key information to be used for digital signature to the security chip 130 through the wired channel to which the application software 210 of the computer 200 is connected and requests digital signature (refer to step S102) The digital signature module 133 reads the private key of the public key certificate stored in the internal memory 134 and generates an electronic signature using the private key (see step S103).

The application software 210 of the computer 200 transmits the digital signature to the application software 210 of the computer 200 via the wired channel to which the security chip 130 is connected And transmits it to the authentication server 400 via the Internet (see step S105).

Then, the authentication server 400 verifies the transmitted digital signature (refer to step S106), and transmits the verification result again to the application software 210 of the computer 200 via the wired / wireless Internet (refer to step S107).

If the verification is successful (see step S108), the application software 210 of the computer 200 provides services such as finance, issuance, game, and education (refer to step S109), and the authorized authentication process is terminated.

On the other hand, if the application software 210 of the computer 200 fails to find the security token 100 in step S100, the continuous search condition of the application software 210 of the computer 200 is checked (refer to step S150). Here, the continuous search condition can use the set time or number of times, infinite repetition, and the like. If the continuation search condition of the application software 210 is satisfied, the process returns to step S100 and proceeds to the subsequent steps.

However, if the continuous search condition of the application software 210 is not satisfied in step S150, the application software 210 of the computer 200 outputs a search failure message (refer to step S151), and ends the authentication process.

On the other hand, if the verification fails in step S108, the application software 210 of the computer 200 outputs a verification failure message (refer to step S160), and ends the authentication process.

5 is a diagram illustrating a method of using a security token according to an embodiment of the present invention in a smartphone environment. 6 is a flowchart of a public authentication method using near field wireless communication according to an embodiment of the present invention.

As described above, the wireless terminal 300 may be any type of terminal capable of short-range wireless communication such as a smart phone, a tablet PC, and the like and capable of communicating with the authentication server 400 through the wireless Internet. The wireless terminal 300 includes a wireless Internet module 310 and a short-range wireless communication module 330, and a smartphone application 320 is installed. The wireless Internet module 310 may be implemented as a 3G, 4G, WiFi, or Bluetooth device, and is a wireless communication module that wirelessly connects to the Internet network using at least one of the devices. The short-range wireless communication module 330 uses NFC (Near Field Communication) capable of wireless communication within a short distance of 10 cm or less (usually 3 to 4 cm). The NFC may operate in a card emulation mode, a reader mode, a P2P mode, or the like. In the present invention, it is preferable to use the reader mode of the ISO14443 standard. The smartphone application 320 is installed in the wireless terminal 300 and provides various services to the user. When the authentication is required, the smartphone application 320 transmits the digital signature transmitted from the security token 100 to the authentication server 400, Finance, issuance, games, and education.

5 and 6, when public authentication is required during the execution of the application of the wireless terminal 300, the application 320 of the wireless terminal 300 transmits the security token 100 using short-range wireless communication (See step S200).

When the application 320 of the wireless terminal 300 succeeds in finding the security token 100, the application 320 of the wireless terminal 300 and the security chip 130 connect the short-range wireless channel. At this time, the short-range wireless communication module 330 of the wireless terminal 300 connects the channel with the security chip 130 by, for example, ISO14443 communication (refer to step S201).

When the application 320 of the wireless terminal 300 transmits the key information to be used for digital signature to the security chip 130 through the connected short-range wireless channel and requests digital signature (refer to step S202), the security chip 130 transmits the key information The private key of the public key certificate stored in the internal memory 134 corresponding to the information is read and the electronic signature module 133 generates an electronic signature with the private key (see step S203).

The application 320 of the wireless terminal 300 transmits the digital signature to the application 320 of the wireless terminal 300 via the short distance wireless channel to which the security chip 130 is connected To the authentication server 400 via the wireless Internet (see step S205).

Then, the authentication server 400 verifies the transmitted digital signature (refer to step S206), and transmits the verification result to the application 320 of the wireless terminal 300 again via the wireless Internet (refer to step S207).

If the verification is successful (see step S208), the application 320 of the wireless terminal 300 provides services such as finance, issuance, game, and education (refer to step S209), and the authorized authentication process is terminated.

On the other hand, if the application 320 of the wireless terminal 300 fails to find the security token 100 in step S200, the continuation condition of the application 320 of the wireless terminal 300 is checked (refer to step S250). Here, the continuous search condition can use the set time or number of times, infinite repetition, and the like. If the continuation search condition of the application 320 is satisfied, the process returns to step S200 and proceeds to the subsequent steps.

However, if the continuation search condition of the application 320 is not satisfied in step S250, the application 320 of the wireless terminal 300 outputs a search failure message (refer to step S251), and ends the authentication process.

On the other hand, if the verification fails in step S208, the application 320 of the wireless terminal 300 outputs a verification failure message (refer to step S260), and ends the authentication process.

Hereinafter, the process of generating the digital signature by the security chip 130 according to the present invention will be described in detail with reference to the steps S202, S203, and S204.

7 is a flowchart of an embodiment in which a security chip according to the present invention generates an electronic signature. For reference, the embodiment of FIG. 7 illustrates a case where the security chip 130 performs digital signature with one power charge (i.e., one instruction execution).

Referring to FIG. 7, the wireless terminal 300 transmits the key information to be used for digital signature and the data to be signed to the security chip 130 with the "COMPUTE DIGITAL SIGNATURE command" (refer to step S202a).

Then, the security chip 130 selects the private key of the public key certificate corresponding to the key information (refer to step S203a), performs the initialization operation for the digital signature operation with the selected private key (see step S203b) And generates an electronic signature value (see step S203c).

Then, the security chip 130 transmits the digital signature value and status information to the wireless terminal 300 in a "COMPUTE DIGITAL SIGNATURE RESPONSE" (see step S204a).

Meanwhile, since the wireless token (100) directly generates electric power from the electromagnetic wave emitted from the wireless terminal (300) and communicates, the NFC does not require a battery and has a short connection distance, There is a problem that it is not easy for the mobile terminal 100 to generate electric power for performing digital signature.

For example, a transportation card system, which is a type of short-distance wireless communication, communicates directly with electric power generated from electromagnetic waves emitted from a bus terminal. The operation performed on the transportation card is a simple operation of reading and writing data It does not require much power. However, the wireless terminal (eg, smart phone) has a weaker electromagnetic wave output than the bus terminal, the security token is smaller than the traffic card, the internal parts interfere with the induction of the electromagnetic wave, The 2048-bit Rivest Shamir Adleman (RSA) operation requires a lot of power.

As a result of a practical experiment, a security chip conforming to "Financial IC Card Security Token Specification v1.10" of KFTC, which is one implementation of a security chip, which is a component of a security token, COMPUTE DIGITAL SIGNATURE command ", but in a short-range wireless communication connection state in which power is generated from an electromagnetic wave emitted from a wireless terminal (for example, a smart phone), a case where the electronic signature can not be normally performed by the command is frequently Respectively.

8, if the output of the electromagnetic wave emitted from the wireless terminal 300 is weak, even if the security chip 130 is maximally charged with the power generated from the electromagnetic wave emitted from the wireless terminal 300 In the course of performing the "COMPUTE DIGITAL SIGNATURE command", the power consumption increases more than the produced power, so that the power is gradually reduced and reset to fall below the minimum threshold value for driving the security chip.

Therefore, an alternative scheme is needed in which the security chip 130 can perform digital signature using minimum power even when the output of the electromagnetic wave emitted from the wireless terminal 300 is weak. Hereinafter, referring to FIGS. 9 and 10 To explain this.

9 is a flowchart of another embodiment in which a security chip according to the present invention generates an electronic signature. The embodiment of FIG. 9 differs the power usage by separating one electronic signature command into two or more electronic signature commands. When the security chip 130 charges two or more power (that is, executes two or more commands) As shown in FIG.

Referring to FIG. 9, first, the wireless terminal 300 transmits key information to be used for digital signature to the security chip 130 with an " INITIALIZE CRYPTO command "(refer to step S202b). For reference, this is a process in which the wireless terminal 300 requests the security chip 130 to prepare for digital signature generation.

Then, the security chip 130 selects a private key of the public key corresponding to the key information (see step S203a), and performs an initialization operation for the digital signature operation with the selected private key (see step S203b). Then, the security chip 130 transmits the status information to the wireless terminal 300 in an " INITALIZE CRYPTO RESPONSE " (see step S204b).

Thereafter, the wireless terminal 300 transmits the data to be signed with the "PERFORM CRYPTO command " to the security chip 130 (see step S202c). For reference, this is a process in which the wireless terminal 300 requests the security chip 130 to execute the digital signature generation.

Then, the security chip 130 generates an electronic signature value by performing an electronic signature operation on the data to be signed (refer to step S203c), and transmits the digital signature value and status information to the wireless terminal 300 in the "PERFORM CRYPTO response & (See step S204c).

10, the process of performing an electronic signature with the "INITIALIZE CRYPTO command" and the "PERFORM CRYPTO command" performs an "INITIALIZE CRYPTO command" before the power of the security chip 130 falls below a minimum threshold value The security chip 130 is recharged while the process is completed and the wireless terminal 300 processes the " INITIALIZE CRYPTO response "and prepares the" PERFORM CRYPTO command & The process of performing the "PERFORM CRYPTO command" is completed and the digital signature process can be normally performed.

Meanwhile, according to the present invention, it is possible to perform public authentication using the security token 100 in the wireless terminal 300 using the short-range wireless communication. However, various applications of the wireless terminal 300 can use the short- Since it is necessary to support the function to perform, it may take a considerable time to be applied to the real life.

Accordingly, it is also required to provide a method of using the public certificate in the existing smartphone environment more safely than the conventional method while maintaining the form of using the public certificate. Hereinafter, a description will be made with reference to FIG. 11 and FIG.

Wireless terminals (for example, smart phones) that support short-range wireless communication are mainly based on the Android operating system. In the Android operating system, the official certificates issued by the PC are copied to the wireless terminal and stored as files in a specific folder, A common method is used.

Accordingly, in the present invention, only when a public certificate is required, the wireless terminal 300 reads the public certificate securely stored in the security chip 130 of the security token 100 as a short-range wireless communication, And the authentication certificate stored in the wireless terminal 300 is automatically deleted after a predetermined time has elapsed or after a predetermined number of authorized authentications have been performed to solve security problems such as hacking and loss.

11 is a diagram illustrating a method of using a security token according to another embodiment of the present invention in a smartphone environment. 12 is a flowchart of a public authentication method using near field wireless communication according to another embodiment of the present invention.

As described above, the wireless terminal 300 can use the wireless terminal according to an embodiment of the present invention described in FIG. 5 and FIG. 6, and can also store it in a file form in a specific folder 340 of the wireless terminal 300 Or a processor monitor, in order to delete the authorized certificate after a predetermined time elapses, or to delete the authorized certificate after a predetermined number of authorized authentications. Meanwhile, the smartphone application 320 is installed in the wireless terminal 300 to provide a variety of services to the user, generates an electronic signature based on the public key certificate transmitted from the security token 100 when public authentication is required, Transmits the digital signature to the authentication server 400, and provides services such as finance, issuance, game, and education.

11 and 12, when it is required to perform public authentication during the execution of an application of the wireless terminal 300, the application 320 of the wireless terminal 300 transmits the security token 100 using short- (Refer to step S300).

When the application 320 of the wireless terminal 300 succeeds in finding the security token 100, the application 320 of the wireless terminal 300 and the security chip 130 connect the short-range wireless channel. At this time, the short-distance wireless communication module 330 of the wireless terminal 300 connects the channel with the security chip 130 through ISO14443 communication (refer to step S301).

When the application 320 of the wireless terminal 300 requests the security chip 130 from the authorized wireless terminal through the connected wireless LAN channel (refer to step S302), the security chip 130 transmits the authentication certificate to the wireless chip 300 through the connected short- To the application 320 of the terminal 300 (refer to step S303).

The application 320 of the wireless terminal 300 stores the transmitted public key certificate in the form of a file in the specific folder 340 of the wireless terminal 300 and generates an electronic signature with the private key of the stored public key certificate (see step S304) .

For reference, the application 320 of the wireless terminal 300 after step S304 and the application 320 of the wireless terminal 300 before step S303 may be different from each other. For example, the application 320 of the wireless terminal 300 before the step S303 is a dedicated application for reading the public certificate of the security token 100, and the application 320 of the wireless terminal 300 after the step S304, Financial application.

Then, the application 320 of the wireless terminal 300 transmits the generated digital signature to the authentication server 400 via the wireless Internet (refer to step S305).

Then, the authentication server 400 verifies the transmitted digital signature (refer to step S306), and transmits the verification result to the application 320 of the wireless terminal 300 again via the wireless Internet (refer to step S307).

If the verification is successful (see step S308), the application 320 of the wireless terminal 300 provides services such as finance, issuance, game, and education (refer to step S309), and the authorized authentication process is terminated.

On the other hand, if the application 320 of the wireless terminal 300 fails to find the security token 100 in step S300, the continuation condition of the application 320 of the wireless terminal 300 is checked (see step S350). Here, the continuous search condition can use the set time or number of times, infinite repetition, and the like. If the continuation search condition of the application 320 is satisfied, the process returns to step S300 and proceeds to the subsequent steps.

However, if the continuation search condition of the application 320 is not satisfied in step S350, the application 320 of the wireless terminal 300 outputs a search failure message (refer to step S351), and ends the authentication process.

On the other hand, if the verification fails in step S308, the application 320 of the wireless terminal 300 outputs a verification failure message (refer to step S360), and ends the authentication process.

On the other hand, the application 320 of the wireless terminal 300 starts a timer for automatically deleting the authorized certificate stored at the time of storing the public certificate, and the timer of the wireless terminal 300, The authorized certificate stored in the form of a file in the specific folder 340 of the portable terminal 300 may be deleted. Alternatively, instead of using the timer, the wireless terminal 320 may monitor the number of times the authorized authentication is performed, and delete the authorized certificate after the predetermined number of authorized authentications have been performed.

For reference, the above-described method significantly reduces the possibility that the authorized certificate is hacked because the authorized certificate exists in the wireless terminal 300 only when the authorized certificate is used, and is secure against the loss of the wireless terminal 300, In the smartphone environment that supports short-range wireless communication, it has the advantage of being more secure than the existing form while maintaining the form of using the authorized certificate.

2, in accordance with a preferred embodiment of the present invention, the security token 100 of the present invention includes a password setting and changing function, a public certificate copying and backup function, a security token automatic locking function , A security token initialization function, and the like.

Specifically, the control unit 135 of the security chip 130 receives the password from the user via the USB communication, stores the password in the internal memory 134, and requests the password input when requesting the authentication, thereby confirming that the user is a legitimate user. If there is a password change from the user, the password change function is performed by storing the changed password in the internal memory 134 after confirming the previous password. Meanwhile, the control unit 135 of the security chip 130 may automatically lock the security token by automatically deactivating the security token when the password inputted from the user is erroneous more than a predetermined number of times (for example, five times). The control unit 135 of the security chip 130 may perform an initialization function by initializing a security token by an initialization command input from a user.

Meanwhile, all and / or some steps of the public authentication method according to the present invention can be implemented through a computer-readable recording medium including program instructions for performing various computer-implemented operations. The computer-readable recording medium may include a program command, a data file, a data structure, and the like, alone or in combination. The recording medium may be those specially designed and configured for the present invention or may be those known and used by those skilled in the computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floppy disks, and ROMs, And hardware devices specifically configured to store and execute the same program instructions. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

In addition, the program for performing all and / or partial steps of the public authentication method according to the present invention may be manufactured in the form of an application and may be transmitted to individual wireless terminals (e.g., a smart phone) via wired / wireless communication And the present invention may be embodied as a device (e.g., a server) for transmitting a program that performs such an authorized authentication method.

 While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. It is to be understood that the embodiments are to be considered in all respects as illustrative and not restrictive.

It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. .

Claims (22)

In the authorized authentication system,
A security token having a public certificate, generating a digital signature based on the public certificate, and transmitting the digital signature to a wireless terminal through NFC (Near Field Communication) communication;
A wireless terminal for transmitting the digital signature transmitted from the security token to an authentication server; And
And an authentication server for verifying the digital signature transmitted from the wireless terminal,
The security token
When the mobile terminal is requested to prepare for generation of an electronic signature, selects a private key of a public key corresponding to key information received from the wireless terminal using the electric power charged through the electromagnetic wave radiated from the wireless terminal, Initializing an electronic signature operation with the selected private key, transmitting status information to the wireless terminal,
Wherein the mobile terminal performs a digital signature operation on the data to be signed received from the wireless terminal using the power recharged through the electromagnetic wave emitted from the wireless terminal when the execution of generation of the digital signature is requested from the wireless terminal, To the wireless terminal. The method of claim 1, wherein the security token
A security chip for storing the authorized certificate and generating an electronic signature;
A USB connection to an external computer's USB port; And
And an internal communication control unit connected to the USB connection unit to control USB communication with the computer and configured as a part of the security chip or connected to the security chip to control wired communication with the security chip. system. 3. The security chip of claim 2,
A contact communication module for performing contact communication with the internal communication controller;
A short range wireless communication module for performing short range wireless communication with the wireless terminal;
An electronic signature module for generating an electronic signature based on the authorized certificate;
An internal memory storing the authorized certificate; And
A contact communication module, a short range wireless communication module, an electronic signature module, and a controller for controlling the internal memory. delete delete delete delete delete delete A security token for a public authentication system,
An electronic signature module for generating an electronic signature based on the public certificate, a short range wireless communication module for performing NFC (Near Field Communication) communication with the wireless terminal, and an internal memory, an electronic signature module And a control unit for controlling the short-range wireless communication module,
The security chip
When the mobile terminal is requested to prepare for generation of an electronic signature, selects a private key of a public key corresponding to key information received from the wireless terminal using the electric power charged through the electromagnetic wave radiated from the wireless terminal, Initializing an electronic signature operation with the selected private key, transmitting status information to the wireless terminal,
Wherein the mobile terminal performs a digital signature operation on the data to be signed received from the wireless terminal using the power recharged through the electromagnetic wave emitted from the wireless terminal when the execution of generation of the digital signature is requested from the wireless terminal, To the wireless terminal. 11. The method of claim 10, wherein the security token
A USB connection to an external computer's USB port; And
And an internal communication control unit connected to the USB connection unit to control USB communication with the computer. The method according to claim 10 or 11,
Wherein the security chip deactivates the security token when the password inputted by the user is more than a predetermined number of times. The method according to claim 10 or 11,
Wherein the security chip initializes a security token by an initialization command input from a user. delete In the public authentication method,
Receiving a security token from a wireless terminal via NFC (Near Field Communication) communication to prepare for generation of an electronic signature;
The security token selects the private key of the public key certificate corresponding to the key information received from the wireless terminal using the electric power charged through the electromagnetic wave emitted from the wireless terminal and initializes the digital signature operation with the selected private key Transmitting status information to the wireless terminal through the NFC communication;
Receiving the security token from the wireless terminal via NFC communication to perform generation of a digital signature; And
The security token performs an electronic signature operation on the data to be signed received from the wireless terminal using the power recharged through the electromagnetic wave emitted from the wireless terminal and transmits the digital signature value to the wireless terminal through NFC communication Lt; RTI ID = 0.0 > 1, < / RTI > 16. The method of claim 15,
The wireless terminal transmitting the digital signature value to an authentication server through a wireless Internet; And
Further comprising the step of the wireless terminal receiving the authentication result from the authentication server through the wireless Internet and performing authorized authentication. delete delete delete delete A computer-readable recording medium having recorded thereon a program for performing the authorized authentication method according to claim 15 or 16. delete

Images