KR102576819B1 - Cloud HSM system for providing financing token and security token and method thereof - Google Patents

Abstract

A cloud HSM system capable of issuing financial tokens and security tokens and its method of issuing financial tokens and security tokens are disclosed. The user terminal device stores application programs and HSM (Hardware Security Module) client programs, and the HSM server operates in a cloud environment and provides HSM services in conjunction with the HSM client program. When token generation is requested from the user terminal device, , you can create a security token and set the type of the generated security token to one of financial tokens and security tokens.

Description

Cloud HSM system capable of issuing financial tokens and security tokens and its method of issuing financial tokens and security tokens {Cloud HSM system for providing financing token and security token and method thereof}

The present invention relates to a cloud HSM system capable of issuing financial tokens and security tokens and its method of issuing financial tokens and security tokens. More specifically, it performs functions as a security token and a financial token while maintaining a standard interface (pkcs#11). It relates to a cloud HSM system and its method of issuing financial tokens and security tokens.

In general, certificates and private keys exist in the form of files, as in the case of public certificates, and to use them, they are loaded into memory, then the private key encrypted with a password is decrypted and the key is used in memory.

However, this method is intended to steal the password by taking it in the form of a file and intercepting the password through keylogging, or taking it from the decrypted memory, and attacks such as Heart Bleed are widely known as a strategy of taking the server certificate in the memory. .

In this way, security is strengthened by preventing the certificate or key from being exposed in files or memory. After installing separate hardware to prevent the key from being removed, if the secret key is to be used for signing, encryption, or decryption, the device must be used. The hardware security module (HSM) operates by safely protecting the operation key by sending it, performing an operation, and then receiving the result.

Security tokens also fall into the category of HSM. However, the medium through which security tokens are used is a general user terminal. Using a cloud HSM as a security token increases convenience of use because it can be used without carrying a hardware device, and has the advantage of being able to be used on any terminal rather than only on a personal computer.

However, in Korea's financial environment, when signing using a token, the key must be in the individual's possession (i.e., personal computer, personal smartphone, personal storage medium, etc.). Therefore, electronic signatures through security tokens can be used, but cloud HSM-based security tokens cannot be used in a financial environment because the signature is made on a remote cloud HSM server.

As a result, the method of transferring a certificate through a dedicated API (Application Programming Interface) or service and signing an electronic signature on the terminal is widely used. However, this is a non-standard method, which causes limitations in expansion and general use. For example, there is a restriction that it can only be used by organizations that call and use the API, so even if users want to use their certificate on various sites, they cannot use it on sites that do not use the API.

Domestic registered patent No. 10-2258215 (registered on May 25, 2021)

The purpose of the present invention is to solve the above problems, a cloud HSM system capable of issuing financial tokens and security tokens that allow tokens to be used in financial and general environments while maintaining a standard interface in the cloud HSM environment, and It provides methods for issuing financial tokens and security tokens.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

In order to achieve the above object, according to an embodiment of the present invention, a cloud HSM system capable of issuing financial tokens and security tokens includes a user terminal device storing an application program and a Hardware Security Module (HSM) client program; and an HSM server that operates in a cloud environment and provides HSM services in conjunction with the HSM client program, wherein the HSM server configures a standard provided by the HSM server for an application of the user terminal device to use the HSM service. When requesting token creation using an API (Application Programming Interface), a token can be created and the type of the generated token can be set to one of a financial token and a security token.

When an electronic signature is requested from the user terminal device, the HSM server may selectively perform a signature procedure at the HSM server according to a preset token type.

If the type of the preset token is a financial token, the HSM server extracts a pre-stored private key and transmits it to the user terminal device, and if the type of the preset token is a security token, electronically signs the pre-stored private key. The generated signature can be transmitted to the user terminal device.

If the type of the preset token is a financial token, the HSM server may transmit the private key to the user terminal device using the standard API used by the security token.

If the type of the preset token is a financial token, the user terminal device may perform an electronic signature using a private key received from the HSM server, and discard the private key when the electronic signature is completed.

Meanwhile, in order to achieve the above object, according to an embodiment of the present invention, the method of issuing financial tokens and security tokens in the cloud HSM system is: (A) When the user terminal device executes the application, HSM (Hardware Security Module) Requesting token creation by a client program using a standard API (Application Programming Interface) provided by the HSM server; And (B) the HSM server, generating a security token according to the request of the user terminal device, and setting the type of the generated security token to one of a financial token and a security token.

(C) The HSM server may further include, when a token signature is requested from the user terminal device, selectively performing a signature procedure at the HSM server according to a preset token type.

In step (C), if the type of the preset token is a financial token, a pre-stored private key is extracted and transmitted to the user terminal device, and if the type of the preset token is a security token, the pre-stored private key is used to send an electronic key to the user terminal device. The signature generated by signing can be transmitted to the user terminal device.

In step (C), when the type of the preset token is a financial token, the private key can be transmitted to the user terminal device using the standard API used by the security token.

(D) the user terminal device, when the type of the preset token is a financial token, performing an electronic signature with a private key received from the HSM server, and discarding the private key when the electronic signature is completed; More may be included.

The present invention makes it possible to transmit a key stored in a financial token in a cloud HSM environment to the user terminal device 100 by using the standard API used by the security token without conversion, thereby maintaining the standard interface of PKCS#11. It can function as a financial token and security token. In other words, using a dedicated API may cause restrictions on the usage site, but for customers who want strong security by satisfying not only security token but also financial token requirements (signature on the owner terminal device 100) through the standard API. By making it usable as a security token and as a financial token when used in a financial environment, the service competitiveness and value of HSM can be increased.

Additionally, when operating in a cloud environment, the present invention can increase user convenience by allowing each user to generate and use one or more financial tokens and one or more security tokens on the HSM server.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a diagram illustrating a cloud HSM system capable of issuing financial tokens and security tokens according to an embodiment of the present invention;
Figure 2 is a diagram showing a table classifying PKCS #11 API into 13 categories;
Figure 3 is a flowchart briefly showing a token generation method among the security enhancement methods of the cloud HSM system according to an embodiment of the present invention;
Figure 4 is a flowchart briefly showing a method of signing a financial token or security token among the security enhancement methods of the cloud HSM system, and
Figure 5 is a flowchart showing a method of enhancing security using a standard API function in a cloud HSM system according to an embodiment of the present invention.

The present invention can be implemented with various changes without departing from the spirit, and for example, other standard interfaces such as MS CNG (Cryptography API: Next Generation) or JCE (Java Cryptography Extension) other than PKCS#11 may be used. and may have one or more other embodiments. In addition, the examples described in the present invention, such as "specific details for carrying out the invention" and "drawings", are examples for specifically explaining the present invention, and do not limit or limit the scope of the present invention.

Accordingly, what a person skilled in the art of the present invention can easily infer from the "specific details for carrying out the invention" and "drawings" of the present invention shall be interpreted as falling within the scope of the present invention. can do.

In addition, the size and shape of each component shown in the drawings may be exaggerated for description of the embodiment, and do not limit the size and shape of the invention in actual practice.

Unless the terms used in the specification of the present invention are specifically defined, they may have the same meaning as those generally understood by those skilled in the art to which the present invention pertains.

A component (e.g., a first component) is “(operatively or communicatively) coupled with/to” another component (e.g., a second component). When referred to as “connected to,” it should be understood that any component may be directly connected to the other component or may be connected through another component (e.g., a third component). On the other hand, when a component (e.g., a first component) is said to be “directly connected” or “directly connected” to another component (e.g., a second component), It may be understood that no other component (e.g., a third component) exists between other components. The expression "configured to" used in the specification may be used depending on the context, for example, "suitable for," "having the capacity to." ," can be used interchangeably with "designed to," "adapted to," "made to," or "capable of." . The term “configured (or set to)” may not necessarily mean “specifically designed to” in hardware. Instead, in some contexts, the expression “a device configured to” may mean that the device is “capable of” working with other devices or components. For example, the phrase "subprocessor configured (or set) to perform A, B, and C" refers to a processor dedicated to performing those operations (e.g., an embedded processor), or executing one or more software programs stored on a memory device. By doing so, it may mean a general-purpose processor (eg, CPU or application processor) capable of performing the corresponding operations.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

Figure 1 is a diagram illustrating a cloud HSM system capable of issuing financial tokens and security tokens according to an embodiment of the present invention.

Referring to FIG. 1, a cloud HSM system capable of issuing financial tokens and security tokens according to an embodiment of the present invention may include a user terminal device 100 and an HSM server 200.

The user terminal device 100 can use the HSM service by communicating with the HSM server 200. The user terminal device 100 is a computing device used by a user and may be a smartphone, tablet, laptop, and/or desktop.

The user terminal device 100 can use security-related HSM services such as signature requests, encryption requests, and decryption requests required by the application by linking with the HSM server 200 through the HSM client program. To this end, one or more applications and an HSM client program may be stored and executed in the storage unit of the user terminal device 100.

An application program is a program that provides functions needed by the user and can be installed, run, or deleted by the user. The application program includes, for example, WAS (Web Application Server), a Java application, and a joint certificate toolkit, and may be a program for financial services or a general program that requires personal authentication (e.g., government offices). .

The HSM client program may be driver software provided by the HSM server 200 for an application program running on the user terminal device 100. The HSM client program can be provided in the form of a shared library, and the application loads the PKCS (Public Key Cryptography Standard) #11 library provided by the HSM server 200 and uses the standard API (Application Programming Interface) can be called. In other words, the HSM client program cannot operate alone as a library, and the application can dynamically load it and call the desired function. PKCS#11 is one of the standard interfaces created to call API HSM devices.

Figure 2 is a diagram showing a table classifying the PKCS #11 API into 13 categories.

Referring to Figure 2, PKCS #11 API is classified into 13 categories, and each category includes one or more standard APIs. If a standard API other than PKCS#11 is used, it can be replaced with the corresponding API.

The HSM server 200 operates in a cloud environment and may be a computing device that provides an HSM service (i.e., HSM function) requested by an application of the user terminal device 100 by calling a standard API.

The HSM server 200 is a device that safely stores encryption keys such as private keys and symmetric keys, and provides PKCS#11 API, a standard API, to enable use of key information and encryption module functions stored in the HSM server 200. .

To this end, the HSM server 200 generates a token using the standard API (e.g., PKCS#11) provided by the HSM server 200 in order for the application of the user terminal device 100 to use the HSM service. Upon request, a token is generated, but depending on the type of token (financial or general) specified in the user terminal device 100, the type of the generated token is set to one of a financial token and a security token, and is mapped to the token subscription conditions. You can save it.

If the application of the user terminal device 100 is a financial program, the application calls a standard API (for example, C_InitToken of PKCS#11) to generate a token when token subscription conditions are input from the user, and the HSM client The program may request to generate a financial token by sending token subscription conditions to the HSM server 200 while calling the called standard API. In addition, if the application is a general program that requires authentication, when the token subscription conditions are input from the user, the application calls the standard API for token generation and transmits the token subscription conditions to the HSM server 200 to obtain the security token. You can request creation. Token subscription conditions may include the type of token, user identification information, application identification information, and whether the application is a financial program or a general program.

The token is a logical device that performs cryptographic information and functions within the HSM server 200, and performs the function using a crypto accelerator or safe storage function provided by the HSM. One HSM server 200 may have multiple tokens, and the HSM server 200 may divide into partitions and allocate multiple tokens or create multiple tokens by assigning accounts to each user. Accordingly, the HSM server 200 may generate one or more financial tokens and one or more security tokens for one user when there is a user request.

Security token (HSM) uses the key (signature, encryption and decryption, etc.) inside the HSM server (200), but for financial tokens, the key must be used in the user terminal device (100), so the Cloud HSM server (200) In the case of , the key cannot be performed inside the HSM server 200 and is processed so that the key is moved to the user terminal device 100 for use.

After the HSM server 200 generates a token for each user and sets the token as either a financial token or a security token according to the token subscription conditions (or type of designated token) entered by the user through the application, the user can use the user terminal device. You can access the HSM server 200 through (100) and use the HSM service through the standard API.

For example, when a signature API (e.g., C_SignFinal or C_Sign in PKCS#11) is called from the application of the user terminal device 100 and the HSM client, the HSM server 200 requests an electronic signature, the application Depending on the type of token mapped to the identification information, the signature procedure can be selectively performed in the HSM server 200. That is, since the financial token is set for the financial application, the HSM server 200 automatically Financial tokens can be recognized and processed, and in other general programs, security tokens set by the user can be used.

If the type of the preset token is a financial token, the HSM server 200 may extract the pre-stored private key from the financial token and transmit it to the user terminal device 100. Even if the type of preset token is a financial token, the HSM server 200 uses the standard API (i.e., PKCS#11) used by security tokens to send the private key to the user terminal device ( 100). As a result, compatibility of the standard API can be maintained so that the private key required for financial processing can be provided from the HSM server 200 without modifying the existing standard API.

In addition, when a signature is requested from the user terminal device 100, if the type of token preset for the application requesting a signature is a security token, the HSM server 200 sends the signature generated by electronically signing with the pre-stored private key to the user. It can be transmitted to the terminal device 100. In addition, when encryption is requested from the user terminal device 100, the HSM server 200 encrypts with a symmetric key and transmits the ciphertext to the user terminal device 100. When decryption is requested, the HSM server 200 decrypts with the symmetric key and sends the decrypted text to the user terminal. It can be transmitted to the device 100.

If the type of the preset token is a financial token, the user terminal device 100 or the application performs an electronic signature with the private key received from the HSM server 200, and discards the private key when use of the electronic signature is completed. You can. After disposal, the application creates a notification window asking whether to generate a financial token, displays it on the user terminal device 100, and calls a standard API to generate a financial token according to the user's request through a user interface (not shown). A request can be made to the HSM server 200.

FIG. 3 is a flowchart briefly showing a token generation method among the security enhancement methods of the cloud HSM system according to an embodiment of the present invention, and FIG. 4 briefly illustrates a method of signing a financial token or security token among the security enhancement methods of the cloud HSM system. This is a flow chart.

Referring to FIG. 3, the application program of the user terminal device 100 may request the HSM server 200 to generate a token (S310). If the application running in step S310 is a financial program, when the token subscription conditions are input from the user, the application may transmit the token subscription conditions to the HSM server 200 to request creation of a financial token. Additionally, if the application is a general program that requires authentication, the application may manually receive token subscription conditions from the user and transmit them to the HSM server 200 to request generation of a security token.

The HSM server 200 checks the token type among the token subscription conditions received from the user terminal device 100, and if the confirmation result is for financial use (S320-Yes), the HSM server 200 generates a token and converts it into a financial token. The financial token created and set can be mapped to the token subscription conditions received in step S310 and stored (S330).

On the other hand, if the confirmation result is for general use (S320-No), the HSM server 200 may generate the token, set it as a security token, and store the generated financial token by mapping it to the token subscription conditions received in step S310 (S340). .

Referring to FIG. 4, when a signature request, application identification information, and user identification information are received from an application program of the user terminal device 100 (S410), the HSM server 200 maps the received application identification information to the identification information. Check the type of stored token.

As a result of the confirmation, if the token type is a financial token (S415-Yes), the HSM server 200 extracts a key (e.g., private key) from the financial token, performs serialization, and serializes it to the user terminal device 100. The key can be transmitted (S420~S430). Serialization is an operation that converts a key with a complex structure into a form that the user terminal device 100 can recognize.

The user terminal device 100 deserializes the received key to re-signature and then electronically signs it to generate a signature (S435, S440).

In an embodiment of the present invention, serialization is a task of converting the form of data to facilitate communication, and deserialization is a task of restoring serialized data to its original state. means.

The user terminal device 100 deletes the key in step S440 and transmits the generated signature to the application program to use the signature (S445).

On the other hand, if it is confirmed as a security token in step S415 (S415-No), the HSM server 200 acquires the handle of the pre-stored key in step S340, electronically signs it to generate a signature, and sends the generated signature to the user terminal. It can be transmitted to the device 100 (S450~S460).

The user terminal device 100 transmits the signature received from the HSM server 200 to the application program (S465). The application program receives and uses the same signature regardless of the type of token (S445)

Figure 5 is a flowchart showing a method of enhancing security using a standard API function in a cloud HSM system according to an embodiment of the present invention.

The security enhancement method shown in FIG. 5 specifically illustrates the operation described with reference to FIGS. 3 and 4, and modifies the operation of the function that generates the token and the function that performs the signature to enable the user terminal device 100 ) can include the action of calling a function.

Referring to FIG. 5, when a financial token is needed, the application program of the user terminal device 100 may call C_InitToken after receiving token subscription conditions from the user (S510).

The HSM client program of the user terminal device 100 may request processing of the token creation request requested by the application by sending token subscription conditions while calling C_InitToken called by the application to the HSM server 200 (S520).

When the token creation request and token subscription conditions are received, the HSM server 200 may generate a token based on the received token subscription conditions and set the type of token to one of a financial token and a security token (S530).

The HSM server 200 transmits the token creation result to the HSM client program, and the HSM client program transmits the received token creation result to the application program (S540, S550).

The application program of the user terminal device 100 that has received the token generation result may request a signature by calling a function that generates a signature value (S560). In step S560, the application can request a signature by sequentially calling C_SignInit and C_Sign or by calling C_SignInit, C_SignUpdate, and C_SignFinal sequentially. Since the function uses a private key, the security token of the HSM server 200 can generate a signature inside the HSM and send the signature value as a response, and the financial token can send the private key to the HSM client program.

The HSM client program calls C_SignFinal or a digest value and C_Sign to the HSM server 200 according to the function called by the application in step S560. At this time, the user identification information received from the application in step S560 and the identification of the application are used. The information can be transmitted together to the HSM server 200 (S570).

In step S570, if C_SignInit and C_Sign are called sequentially in step S560, the HSM client program can call C_Sign to the HSM server 200. Alternatively, if the application sequentially calls C_SignInit, C_SignUpdate, and C_SignFinal in step S560, the HSM client program may call C_SignFinal while transmitting the digest value obtained by performing the signature digest to the HSM server 200.

The HSM server 200 analyzes the called function, that is, the called standard API, and confirms the token mapped to the user identification information and the identification information of the application (S580).

As a result of the confirmation, if the mapped stored token is a financial token (S590-Yes), the HSM server 200 can extract the key from the financial token, convert it into a transmittable form, and transmit it to the user terminal device 100 (S600, S610). .

The HSM client program of the user terminal device 100 restores the received key to its original state, performs an electronic signature, creates a signature, deletes the key, and delivers the generated signature to the application (S620). .

The application program processes work using the received signature (S630).

On the other hand, if the mapping-stored token as a result of confirmation in step S580 is a security token (S590-No), the HSM server 200 extracts the key from the security token, signs it electronically, and sends the signature resulting from the electronic signature to the user terminal device 100. ) can be transmitted (S660, S670).

The HSM client program transmits the signature received in step S670 to the application program (S680).

The application processes work using the received signature (S690).

According to the present invention described above, the HSM server 200 is capable of transmitting the key stored in the financial token to the user terminal device 100 by using the standard API used by the security token without conversion, and as a result, PKCS #11 It can function as a financial token and security token while maintaining the standard interface. In other words, using a dedicated API may cause restrictions on the usage site, but for customers who want strong security by satisfying not only security token but also financial token requirements (signature on the owner terminal device 100) through the standard API. By making it usable as a security token and as a financial token when used in a financial environment, the service competitiveness and value of HSM can be increased.

Additionally, sending the key to the user terminal device 100 reduces security, so changing the security token to a financial token reduces the security of the security token. Therefore, according to the present invention described above, it is possible to maintain the security of the token by specifying the purpose when initially generating the token and preventing the use from being changed thereafter.

Meanwhile, the embodiments of the present invention described above can be implemented through various means. For example, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof.

In the case of hardware implementation, the method according to embodiments of the present invention uses one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), and Programmable Logic Devices (PLDs). , can be implemented by FPGAs (Field Programmable Gate Arrays), processors, controllers, microcontrollers, microprocessors, etc.

In the case of implementation by firmware or software, the method according to embodiments of the present invention may be implemented in the form of a module, procedure, or function that performs the functions or operations described above. Software code can be stored in a memory unit and run by a processor. The memory unit is located inside or outside the processor and can exchange data with the processor through various known means.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above embodiments, and may be varied within the scope of the detailed description and accompanying drawings, as long as it does not deviate from the spirit of the present invention and does not impair the effect. It can be implemented by changing it accordingly. It is also natural that such embodiments fall within the scope of the present invention.

100: User terminal device
200: HSM server

Claims (10)

A user terminal device where applications and Hardware Security Module (HSM) client programs are stored; and
It operates in a cloud environment and includes an HSM server that provides HSM services in conjunction with the HSM client program,
The HSM server,
When the application of the user terminal device requests token creation using a standard API (Application Programming Interface) provided by the HSM server to use the HSM service, a token is generated, and the type of the generated token is classified into financial token and Set it to one of your security tokens,
When an electronic signature is requested from the user terminal device using the standard API, a signature procedure is selectively performed according to a preset token type,
If the type of the preset token is a financial token, a pre-stored private key is extracted and transmitted to the user terminal device, and if the type of the preset token is a security token, a signature statement generated by electronically signing with the pre-stored private key is sent to the user terminal device. A cloud HSM system capable of issuing financial tokens and security tokens transmitted to the user terminal device.
delete delete According to paragraph 1,
If the type of the preset token is a financial token, the HSM server
A cloud HSM system capable of issuing financial tokens and security tokens, characterized in that the private key is transmitted to a user terminal device using the standard API used by the security token.
According to paragraph 1,
When the type of the preset token is a financial token, the user terminal device
A cloud HSM system capable of issuing financial tokens and security tokens, characterized in that an electronic signature is performed with a private key received from the HSM server, and the private key is discarded when the electronic signature is completed.
(A) When the application is executed, the user terminal device requests token generation by an HSM (Hardware Security Module) client program using a standard API (Application Programming Interface) provided by the HSM server;
(B) the HSM server generating a security token according to a request from the user terminal device, and setting the type of the generated security token to one of a financial token and a security token; and
(C) the HSM server, when a token signature is requested from the user terminal device using the standard API, selectively performing a signature procedure according to a preset token type;
Including,
In step (C),
If the type of the preset token is a financial token, a pre-stored private key is extracted and transmitted to the user terminal device, and if the type of the preset token is a security token, a signature statement generated by electronically signing with the pre-stored private key is sent to the user terminal device. Method for issuing financial tokens and security tokens of the cloud HSM system transmitted to the user terminal device.
delete delete According to clause 6,
In step (C),
When the type of the preset token is a financial token, the private key is transmitted to the user terminal device using the standard API used by the security token. A financial token and security token issuance method in a cloud HSM system.
According to clause 6,
(D) when the type of the preset token is a financial token, the user terminal device performs an electronic signature using a private key received from the HSM server, and discards the private key when the electronic signature is completed;
A method of issuing financial tokens and security tokens in a cloud HSM system, further comprising:

Images