KR20020020291A - end-to-end security system and method for wireless internet on WAP browser - Google Patents

Abstract

PURPOSE: A system and method for end-to-end security is provided to secure between mobile terminals using a wireless application protocol and a wired Internet terminal. CONSTITUTION: A mobile terminal transmits a connection request message, containing a server name, a client name, client authentication information, a time stamp, and digital signature information to an application server(1). The application server verifies the authentication information received from the mobile terminal(2). In case that it is verified that the mobile terminal user is valid, the application server transmits a certificate converting request message, containing server authentication information, to a certificate conversion gateway(3). The wired certificate authority executes authentication and transfers an error message or a certificate authenticated after conversion to the certificate conversion gateway with a converting confirmation message(4). The certificate conversion gateway transmits the converted certificate to the mobile terminal(5), and the mobile terminal verifies it(6).

Description

End-to-end security system and method for wireless internet on WAP browser}

The present invention relates to a public key infrastructure (PKI) authentication technology in the wireless Internet. More specifically, a mobile terminal using a WAP browser can be interchanged by converting a certificate of a wired Internet and a certificate in a wireless network. End-to-end security system and method.

Recently, with the development of information and communication technology and the spread of the Internet, which is the communication base on a global scale, it is creating a new economic paradigm of electronic commerce. Based on this, new companies / business cultures such as cyber companies, cyber markets, and cyber trading society are being born, and the environment for realizing electronic business has been prepared to escape the constraints of time and place.

The technical reason that e-commerce is attracting attention today is that the development of information and communication technologies such as computer network technology and multimedia technology represented by the appearance of the web (www) and the browser has opened the possibility of imitating various activities in real life. to be. In economic terms, the introduction of e-commerce into economic activities reduces the cost of commerce and facilitates the development of new markets.

Since the Internet is recognized as a major stage of electronic commerce in that it can guarantee worldwide connectivity and there are more than tens of millions of users, most electronic commerce systems, as shown in FIG. 104, the payment system 106, the store system 108 is connected based on the web of the Internet to perform electronic transactions.

Referring to Figure 1a, based on an electronic certificate or other authentication means issued from the certification authority 104 through a pre-certification procedure for secure commerce, defined between the customer 102, the store system 108, the payment system 106 This is done through an encryption protocol scheme. The certification authority 104 is an authority that issues, revises, and revokes an electronic certificate to identify and verify a transaction party, and authenticates a public key that will be used by the transaction party. The customer system 102 is a PC equipped with a web browser and an electronic wallet for payment. As a payment method, a credit card, a debit card, an account transfer, an electronic money, or the like can be used. The payment system 106 is a system for processing payment information required by the store system 108, and is referred to as a payment broker or payment gateway according to a payment method and a processing method. The store system 108 is a shopping mall that electronically sells tangible and intangible products to customers, and performs actual commerce functions such as sales management, customer management, store management, and order processing based on the product information DB.

And briefly look at the process of issuing a certificate for electronic commerce, as shown in Figure 1b, after the customer applies for registration to visit the registration window (BRA) to confirm the identity, the registration window (BRA) after the identity verification, the registration authority ( Enter the registration details in RA). Then, the customer generates a signature key pair on his PC and requests a certificate issuance to the registrar (RA), and the registrar (RA) sends a registration to the certificate authority (CA) and requests a certificate issuance. After issuing a certificate, the certification authority (CA) notifies the registrar (RA) and requests the customer to receive the certificate by e-mail. The customer then downloads the certificate from the registrar.

However, unlike conventional commerce, e-commerce is carried out in cyber space through a communication network, and therefore, it is exposed to various threats such as counterfeit trader's transaction, exposure of transaction contents, alteration of transaction contents, and denial of transaction facts. Therefore, in order to secure the safety and reliability of e-commerce, the trader's authentication, the integrity and confidentiality of the transaction contents, and the nonrepudiation to prevent the trader from denying the transaction facts. You need a security mechanism that provides such functionality.

However, since the conventional security mechanism was developed mainly for a computer environment with a large processing capacity (wired Internet environment) such as a PC, a security mechanism in a wireless web environment with a relatively poor processing capability such as a PDA or an IMT2000 terminal is still insufficient. There is this.

The present invention has been proposed to solve the above problems, and provides a security system and method for providing end-to-end security between a mobile terminal using WAP in a wireless Internet and a terminal in a wired internet. Its purpose is to.

Figure 1a is a diagram showing the configuration of a general electronic commerce system,

1b is a diagram illustrating a procedure for issuing a certificate from a certification authority;

2 is a schematic diagram showing an electronic commerce information protection environment using a public key applied to the present invention;

3 is a conceptual diagram illustrating an authentication concept using a public key applied to the present invention;

4 shows an example of a security system according to the invention,

5 is a flowchart illustrating an authentication procedure according to the present invention.

* Explanation of symbols for the main parts of the drawings

402: mobile terminal 410: mobile communication network

420: gateway 430: wireless certification authority

440: certificate conversion gateway 450: wired certification authority

460: Internet 470: Application Server

In order to achieve the above object, the system of the present invention, in the system for maintaining security between the end of the wireless Internet and the end of the wired Internet, a WAP browser is equipped with a wireless Internet access and public key-based authentication client Termination having; A wireless certification authority for issuing and managing certificates to endpoints on the wireless Internet; End connected to the Internet; A wired certification authority for issuing and managing certificates to terminals connected to the Internet; And a certificate conversion gate for converting the certificate of the wired certification authority and the certificate of the wireless certification authority.

In addition, in order to achieve the above object, the method of the present invention provides a method for maintaining security between a mobile terminal of a wireless internet and an application server of a wired internet, and transmits authentication information of the mobile terminal to request access to the application server. Doing; Verifying whether the user is a legitimate user by analyzing authentication information of the terminal when a connection request is received from the mobile terminal; Requesting a certificate conversion by the application server transmitting server authentication information to a certificate conversion gateway; A certificate conversion gateway converting the certificate, and confirming the converted certificate by transferring the converted certificate to a wired certification authority; Transmitting the verified and converted certificate to a mobile terminal; And verifying, by the mobile terminal, the converted certificate.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a schematic diagram showing an electronic commerce information protection environment using a public key applied to the present invention. Referring to FIG. 2, a certificate management server (CA: 202), a registration management system (RA: 204), and a directory are constructed by a public key infrastructure (PKI), and Internet banking 208 using each security toolkit. It provides security mechanisms such as authentication, integrity, confidentiality of information, denial of containment in electronic commerce such as cyber securities transaction 210, cyber shopping mall 212, electronic payment system 214, electronic payment system 216.

3 is a conceptual diagram illustrating a concept of authentication using a public key applied to the present invention.

Traditionally, the most commonly used method for information protection is a cryptographic method that provides security by encrypting and decrypting data transmitted and received using a key, which can be largely classified into a secret key cryptography method and a public key cryptography method. have.

The secret key cryptography is a symmetric key cryptography method in which the keys used for encryption and decryption are the same. The transceivers of the data to be encrypted share the same key to perform encryption and decryption. Secret key cryptography has the advantage of easy implementation and fast encryption / decryption. However, key management is difficult because the key must be shared among users who want to perform cryptographic communication.

In contrast, public key cryptography is an asymmetric cryptography method in which encryption / decryption is performed using a key pair, and the key used for encryption and the key used for decryption are different from each other. The key pair consists of a public key that anyone can use and a private key that only one keeps secret.

In order to perform information protection using the public key, it is necessary to prove that the owner of the public key is a legitimate user and has a private key corresponding to the public key. This is the basis for obtaining the safety and reliability of electronic transactions using the public key method. Certification of the legitimacy of the public key and its owner is performed by a trusted third party, the Certification Authority (CA). The certification authority issues a certificate for the user's public key, proving that the user is a legitimate owner of the public key and owns the private key corresponding to the public key, and expresses it in the form of a certificate. In general, certificates follow the X.509 [7] format, which records the receipt number, signature algorithm, issuer, expiration date, public key algorithm, and public key.

Referring to Fig. 3, user A has a private key and a public key identified by a certification authority, and user A sends a digitally signed document (file) to user B. According to the authentication (digital signature) technology based on public key cryptography, the user creates a document and transmits the document by encrypting (digital signature) using the private key, and the other party (user B) who receives the document receives the public key. Verify the digitally signed document by decrypting the encrypted document using. A document digitally signed with a private key can be verified only by a person with a corresponding public key, and if the digitally signed document is verified with A's public key, the document can be determined to be digitally signed with A's private key. . In this way, the user and the server can authenticate the other party using the public key technology. Here, authentication can be largely divided into user authentication and message (document) authentication. In an electronic transaction, the user's authentication means that the remotely connected user is a valid user, and the message (document) authentication is transmitted remotely. It proves that the message (document) has not been forged or altered.

4 is a diagram illustrating an example of an end-to-end security system according to the present invention.

The present invention has developed a certificate conversion gateway capable of converting and transmitting data types between a wireless certificate authority performing all roles of a certification authority over a wire over a wire, and a wire certification authority and a wireless certification authority.

Referring to FIG. 4, the mobile terminal 402 is wirelessly connected to the mobile communication network 410, and the mobile communication network 410 and the Internet 460 are connected through the gateway 420. The mobile communication network 410 is connected to a wireless certification authority 430 for issuing a certificate for wireless Internet, and the internet 460 is connected with a wired certification authority 450 for issuing a certificate on the Internet. The wireless certification authority 430 and the wired certification authority 450 are connected through the conversion gateway 440. In this configuration, end-to-end security is guaranteed between the mobile terminal 402 connected to the mobile communication network 410 and the application server 470 connected to the Internet 460.

The wireless certification authority 430 replaces the wired certification authority in the wireless Internet by performing a certificate issue and management (update, abolishment, etc.) function for the wireless Internet user. The certificate conversion gateway 440 converts the different types of data used by the wireless certification authority 430 and the wired certification authority 440 so that they can be processed by the certification authority. Accordingly, the mobile terminal 402 may authenticate the application server 470 through the wireless certification authority 430, and the application server 470 may authenticate the wireless terminal user through the existing wire certification authority 450.

The mobile terminal 402 integrates a general mobile phone function and a PDA function, and can perform voice, image, data communication, and the like. In particular, the mobile terminal 402 to which the present invention is applied has a built-in WAP browser for wireless Internet.

5 is a flowchart illustrating an authentication process according to the present invention, in which an authentication process is illustrated between a mobile terminal, a certificate conversion gateway, and an application server.

First, the mobile terminal 402 has a certificate issued by a wireless certification authority, the application server 470 has a certificate issued by a wired certification authority. The mobile terminal 402 transmits authentication information of the mobile terminal while requesting connection to the application server 470 to perform a task (e-commerce, etc.) requiring authentication with the application server 470. To this end, the mobile terminal 402 sends a connection request (Connect_req) message including the server name, client name, client authentication information, time stamp, electronic signature information (1).

Subsequently, the application server 470 verifies the authentication information received from the mobile terminal 402 according to a predetermined procedure to verify whether the mobile terminal user is a legitimate user (②). Certificate verification is handled by the procedures for checking each information element transmitted from the terminal, and if the result of the check is FALSE, an error message is sent to the mobile terminal.

Subsequently, if it is normal, it transmits the server authentication information to the certificate conversion gateway 440 through a certificate conversion request (Convert_req) message and requests certificate conversion (③). The certificate conversion request message includes the server name, client name, server authentication information, time stamp, and digital signature information.

Subsequently, the certificate conversion gate 440 extracts the data of the fields used for the WTLS certificate from the server authentication information, configures Sever_WTLSCert_Information, and puts it in the conversion confirmation message (Convert_Cert_req) to request a certificate to the wired certification authority 450, and then to the wired certification authority. 450 performs authentication according to a predetermined procedure and transfers an error message or an authenticated certificate after conversion to the certificate conversion gateway 440 by converting it into a conversion confirmation message (Convert_Cert) (④). That is, the certificate conversion gateway 440 verifies the received certificate, and if it is a correct certificate, converts it into a format of a certificate used in the requested browser, and requests a signature from the wired certification authority, and the wired certification authority verifies the signature if it is correct. Again, the certificate conversion gateway 440 is transferred.

The certificate conversion gateway 440 then transmits the converted certificate to the mobile terminal 402, and the mobile terminal 402 verifies the converted certificate (⑤, ⑥).

After the authentication is completed as described above, secure electronic commerce between the mobile terminal and the application server can be performed.

As described above, according to the present invention, by adding a wireless certification authority for user authentication in the wireless Internet and a certificate conversion gateway for converting certificates, the certificates are mutually converted to secure end-to-end. There is an advantage to implementing

Claims (2)

In the system for maintaining security between the end of the wireless Internet and the end of the wired Internet, Endpoints equipped with a WAP browser capable of wireless Internet access and having a public key based authentication client; A wireless certification authority for issuing and managing certificates to endpoints on the wireless Internet; Terminations connected to the Internet; A wired certification authority for issuing and managing certificates to endpoints connected to the Internet; And End-to-end security system for the wireless Internet of the WAP environment characterized in that it comprises a certificate conversion gate for converting the certificate of the wired certification authority and the certificate of the wireless certification authority. In the method for maintaining security between the mobile terminal of the wireless Internet and the application server of the wired Internet, Requesting access to the application server by transmitting authentication information of a mobile terminal; Verifying whether the user is a legitimate user by analyzing authentication information of the terminal when a connection request is received from the mobile terminal; Requesting a certificate conversion by the application server transmitting server authentication information to a certificate conversion gateway; A certificate conversion gateway converting the certificate, and confirming the converted certificate by transferring the converted certificate to a wired certification authority; Transmitting the verified and converted certificate to a mobile terminal; And And verifying, by the mobile terminal, the converted certificate.